5 ms·

Hi, just asking around, I'm trying to self host on a basic Ubuntu server, I'll run some websites (behind nginx), databases (docker), cron jobs and other things

Hi, just asking around, I'm trying to self host on a basic Ubuntu server, I'll run some websites (behind nginx), databases (docker), cron jobs and other things on there. Normally, I don't really care about ddos, however since this is going to run on my home network (on it's own vlan separate from my vlan) and I have static IP, I'm kinda scared? I usually hosted my stuff on cloud with ddos protection included. What are some security precautions I can take to prevent this from happening?

bsenftner 4y ago
Not sure is this is the best option today, but in a previous self hosting situation I relied on CloudFlare's DDOS protection. We survived several attacks thanks to them. One attack was a 3 days long, and CloudFlare worked fine the entire time, our regular customers were lightly impacted but could still work.
- capableweb 4y ago
  I guess it depends on where you draw the limit, but if you tunnel all your traffic via an external proxy to your "self-hosted" platform, how much can you really call that solution self-hosted? Did you try anything else before slapping cloudflare in front of your setup?
  - bsenftner 4y ago
    At the time, I was running a game service, so had a fair number of script kiddies attempting whatever. Expecting them, before using Cloudflare I got a hardware firewall. With a bit of research I located the same hardware firewall used by Federal Reserve Banks. At that time, an outright purchase of that thing was $24K, but it was well worth it. It had every bell and whistle one could ask: deep pack inspection, load balancing, and a quite a bit more. When I closed, that hardware firewall sold for the same price I paid, years earlier.
wswope 4y ago
Safest move would be to not actually expose your server from your public IP, but instead tunnel traffic from your home server through a cheap, public-facing VPS instance acting as a gateway host. To fully automate, you can use a premade tool like autossh, or just replicate it using standard ssh with keepalive option + a custom sysd unit file.
capableweb 4y ago
The other comments you received relies on 3rd parties and/or tunneling traffic via others, which may or may not impact the performance/latency negatively (depending on what you're trying to achieve). If you want to self-host a solution, few things to keep in mind: - Rate-limit "heavy" (RAM, CPU, I/O) processes that can be externally triggered via HTTP calls or similar (if you have a HTTP endpoint for regenerating a cache or something like that, make sure it can only be called max once per hour, and so on) - Setup fail2ban, and things like mod_evasive if you're using Apache (I'm sure Caddy/nginx have similar solutions) - Only expose what you really want to with iptables Ultimately, unless you're hosting something really popular or controversial, you don't really need to be scared about being ddosed. People don't spend resources just ddosing random stuff without a reason for it, and unless it's popular/controversial, you just won't get hit by anything but random port scans/vulnerability scans.
chasd00 4y ago
A downside to self hosting is I don’t think you can realistically defend against a ddos without network help from a third party. It’s been a while since I thought about it but iirc you need upstream routers to cut off the traffic for you because by the time the traffic gets to your router it’s too late. That’s what made ddos so effective when it first came on the scene. Stopping or mitigating one took a lot of time, phone calls, and coordination between service providers. Edit: another thing, a large scale ddos on a residential IP address will for sure get the attention of your ISP. If you’re running something that may get that kind of attention check your TOS :)
Nextgrid 4y ago
So let's say you do get DDoS'd, what happens? Your internet connection is virtually unusable because it's saturated. You call your ISP and they will mitigate the attack, most likely by just giving you a new static IP. It's not great, but it's not the end of the world either, and doesn't actually incur any risk to your data or home network. Hell, if you want to learn mitigating this yourself, open Wireshark on your WAN interface, get the attacking IPs and send out abuse reports to their respective hosts. You can clear most script-kiddie "booter" style attacks like this in a day, dismantling their botnet in the process.
dn3500 4y ago
I hosted web sites at my house on the cheapest Comcast service from about 2002 to 2016 and never once had a problem. It's possible things have changed, but a ddos attack does cost money and I think it's mostly the large or controversial sites that get targeted. I would still be hosting at home but where I live it's nearly impossible to get a static, routable IP.
- pak9rabid 4y ago
  I've been self-hosting at home with a dynamic IP for over 10 years. Services like dyn.org and ddclient (running on your router) work well enough.
  - dn3500 4y ago
    How does that work if you're behind two NATs?

bsenftner 4y ago

Not sure is this is the best option today, but in a previous self hosting situation I relied on CloudFlare's DDOS protection. We survived several attacks thanks to them. One attack was a 3 days long, and CloudFlare worked fine the entire time, our regular customers were lightly impacted but could still work.

capableweb 4y ago
I guess it depends on where you draw the limit, but if you tunnel all your traffic via an external proxy to your "self-hosted" platform, how much can you really call that solution self-hosted? Did you try anything else before slapping cloudflare in front of your setup?
- bsenftner 4y ago
  At the time, I was running a game service, so had a fair number of script kiddies attempting whatever. Expecting them, before using Cloudflare I got a hardware firewall. With a bit of research I located the same hardware firewall used by Federal Reserve Banks. At that time, an outright purchase of that thing was $24K, but it was well worth it. It had every bell and whistle one could ask: deep pack inspection, load balancing, and a quite a bit more. When I closed, that hardware firewall sold for the same price I paid, years earlier.

wswope 4y ago

Safest move would be to not actually expose your server from your public IP, but instead tunnel traffic from your home server through a cheap, public-facing VPS instance acting as a gateway host. To fully automate, you can use a premade tool like autossh, or just replicate it using standard ssh with keepalive option + a custom sysd unit file.

capableweb 4y ago

The other comments you received relies on 3rd parties and/or tunneling traffic via others, which may or may not impact the performance/latency negatively (depending on what you're trying to achieve). If you want to self-host a solution, few things to keep in mind: - Rate-limit "heavy" (RAM, CPU, I/O) processes that can be externally triggered via HTTP calls or similar (if you have a HTTP endpoint for regenerating a cache or something like that, make sure it can only be called max once per hour, and so on) - Setup fail2ban, and things like mod_evasive if you're using Apache (I'm sure Caddy/nginx have similar solutions) - Only expose what you really want to with iptables Ultimately, unless you're hosting something really popular or controversial, you don't really need to be scared about being ddosed. People don't spend resources just ddosing random stuff without a reason for it, and unless it's popular/controversial, you just won't get hit by anything but random port scans/vulnerability scans.

chasd00 4y ago

A downside to self hosting is I don’t think you can realistically defend against a ddos without network help from a third party. It’s been a while since I thought about it but iirc you need upstream routers to cut off the traffic for you because by the time the traffic gets to your router it’s too late. That’s what made ddos so effective when it first came on the scene. Stopping or mitigating one took a lot of time, phone calls, and coordination between service providers. Edit: another thing, a large scale ddos on a residential IP address will for sure get the attention of your ISP. If you’re running something that may get that kind of attention check your TOS :)

Nextgrid 4y ago

So let's say you do get DDoS'd, what happens? Your internet connection is virtually unusable because it's saturated. You call your ISP and they will mitigate the attack, most likely by just giving you a new static IP. It's not great, but it's not the end of the world either, and doesn't actually incur any risk to your data or home network. Hell, if you want to learn mitigating this yourself, open Wireshark on your WAN interface, get the attacking IPs and send out abuse reports to their respective hosts. You can clear most script-kiddie "booter" style attacks like this in a day, dismantling their botnet in the process.

dn3500 4y ago

I hosted web sites at my house on the cheapest Comcast service from about 2002 to 2016 and never once had a problem. It's possible things have changed, but a ddos attack does cost money and I think it's mostly the large or controversial sites that get targeted. I would still be hosting at home but where I live it's nearly impossible to get a static, routable IP.

pak9rabid 4y ago
I've been self-hosting at home with a dynamic IP for over 10 years. Services like dyn.org and ddclient (running on your router) work well enough.
- dn3500 4y ago
  How does that work if you're behind two NATs?