5 ms·

At the risk of sounding like the "why do you need DropBox if you have rsync herr derr" guy, why... do I need DDoS protection from my VPS provider if I have Clou

At the risk of sounding like the "why do you need DropBox if you have rsync herr derr" guy, why... do I need DDoS protection from my VPS provider if I have Cloudflare anyway?

whitepoplar 3y ago
Isn't it trivial to discover the origin IP and then just hit it directly?
- andersa 3y ago
  If you set it up correctly, it's not possible.
  - Sebguer 3y ago
    Depends on the usecase, and whether you're shelling out the huge sums for Cloudflare Enterprise. Don't think there's too many cheap options for obfuscation if e.g. you're hosting a game server, which also happens to be one of the most common DDoS targets.
- berkle4455 3y ago
  you deny all, accept <cloudflare IPs> to the machines actually serving content.
- stavros 3y ago
  How would you?
  - charcircuit 3y ago
    one method is to look up what IPs someone owns and try to direct connect to them. Or you can just guess and assume they picked an IP address near the start of the block they have.
    - stavros 3y ago
      That only works for companies that own blocks, though, and assumes a company big enough to own a block won't just drop non-Cloudflare traffic (which is trivial: https://www.stavros.io/posts/block-non-cloudflare-ips-with-ufw/ https://www.stavros.io/posts/block-non-cloudflare-ips-with-u...).
      - charcircuit 3y ago
        >assumes a company big enough to own a block You don't have to be a big company to own a block. An ipv4 block is <$10k and the price is on a downtrend now that covid is over. It is risky as a site if you don't own your IP block because false abuse complaints can be sent to the ASN you are renting an IP from and can result in downtime. If you own the IP, the abuse reports for it go to you to handle. >won't just drop non-Cloudflare traffic Not all sites do this. Also they likely have other stuff running on the machines that are accessible without cloudflare.
- re-thc 3y ago
  You can use Cloudflare tunnel so there's no "origin" exposed.
andersa 3y ago
What if you want to run a service that can't go behind Cloudflare (such as a game server)?
- jgrahamc 3y ago
  We have plenty of game servers behind us. See Cloudflare Spectrum: https://developers.cloudflare.com/spectrum/ https://developers.cloudflare.com/spectrum/
  - buildbuildbuild 3y ago
    Spectrum is cool but priced completely out of reach for most Cloudflare users. I proxy through Fly.io or AWS Global Accelerator when I can’t use Cloudflare for TCP as a hobbyist. (Why only three protocols and such strict limits, years after launching? You won’t cannibalize Spectrum by allowing more hobbyists to use it, you’ll market it for use at scale - like Argo Tunnel’s trycloudflare)
  - jonathantf2 3y ago
    I presume they were referring to gameservers run by communities and not by game studios? I run gameservers for events that raise money for charity and we're having more and more of our boxes get hit offline - last time I had a look Spectrum required an enterprise plan for anything other than Minecraft?
- lxchase 3y ago
  You rent with a provider that uses Magic Transit by CF, Corero appliances, OVH, Psychz, or Path networks.
capableweb 3y ago
Why do you need DDoS protection from Cloudflare if your VPS provider has it anyway? Some people prefer all-in-one solutions, otherwise things like AWS wouldn't exists. Others prefer to spread out their eggs. One is not absolutely right and the other absolute wrong.
jonathantf2 3y ago
Cloudflare doesn't proxy all applications, just HTTPS.
- re-thc 3y ago
  It can e.g. magic transit. Might cost a lot more and might not work as good, but you can.
  - jonathantf2 3y ago
    Correct yes - although having used a provider that used Magic Transit as protection I can safely say it's a terrible option.
    - wilkystyle 3y ago
      > I can safely say it's a terrible option. Can you elaborate?
      - re-thc 3y ago
        It can't block most attacks. This was a few years ago though. Maybe it's better now.
      - jonathantf2 3y ago
        Compared to other mitigation providers there were very few filters, and when you were under attack it just seemed to throttle your whole connection to as low as 50Kbps, meaning players would disconnect.
        lxchase 3y ago
        Magic Firewall exists now which is pretty powerful a la wire shark filters if I remember correctly. Otherwise MT filters are pretty good now. However I have encountered a few cases where a valid connection may drop depending on how sensitive your application is but pretty rare.
  - 3y ago

At the risk of sounding like the "why do you need DropBox if you have rsync herr derr" guy, why... do I need DDoS protection from my VPS provider if I have Cloudflare anyway?

whitepoplar 3y ago

Isn't it trivial to discover the origin IP and then just hit it directly?

andersa 3y ago
If you set it up correctly, it's not possible.
- Sebguer 3y ago
  Depends on the usecase, and whether you're shelling out the huge sums for Cloudflare Enterprise. Don't think there's too many cheap options for obfuscation if e.g. you're hosting a game server, which also happens to be one of the most common DDoS targets.
berkle4455 3y ago
you deny all, accept <cloudflare IPs> to the machines actually serving content.
stavros 3y ago
How would you?
- charcircuit 3y ago
  one method is to look up what IPs someone owns and try to direct connect to them. Or you can just guess and assume they picked an IP address near the start of the block they have.
  - stavros 3y ago
    That only works for companies that own blocks, though, and assumes a company big enough to own a block won't just drop non-Cloudflare traffic (which is trivial: https://www.stavros.io/posts/block-non-cloudflare-ips-with-ufw/ https://www.stavros.io/posts/block-non-cloudflare-ips-with-u...).
    - charcircuit 3y ago
      >assumes a company big enough to own a block You don't have to be a big company to own a block. An ipv4 block is <$10k and the price is on a downtrend now that covid is over. It is risky as a site if you don't own your IP block because false abuse complaints can be sent to the ASN you are renting an IP from and can result in downtime. If you own the IP, the abuse reports for it go to you to handle. >won't just drop non-Cloudflare traffic Not all sites do this. Also they likely have other stuff running on the machines that are accessible without cloudflare.
re-thc 3y ago
You can use Cloudflare tunnel so there's no "origin" exposed.

andersa 3y ago

What if you want to run a service that can't go behind Cloudflare (such as a game server)?

jgrahamc 3y ago
We have plenty of game servers behind us. See Cloudflare Spectrum: https://developers.cloudflare.com/spectrum/ https://developers.cloudflare.com/spectrum/
- buildbuildbuild 3y ago
  Spectrum is cool but priced completely out of reach for most Cloudflare users. I proxy through Fly.io or AWS Global Accelerator when I can’t use Cloudflare for TCP as a hobbyist. (Why only three protocols and such strict limits, years after launching? You won’t cannibalize Spectrum by allowing more hobbyists to use it, you’ll market it for use at scale - like Argo Tunnel’s trycloudflare)
- jonathantf2 3y ago
  I presume they were referring to gameservers run by communities and not by game studios? I run gameservers for events that raise money for charity and we're having more and more of our boxes get hit offline - last time I had a look Spectrum required an enterprise plan for anything other than Minecraft?
lxchase 3y ago
You rent with a provider that uses Magic Transit by CF, Corero appliances, OVH, Psychz, or Path networks.

capableweb 3y ago

Why do you need DDoS protection from Cloudflare if your VPS provider has it anyway? Some people prefer all-in-one solutions, otherwise things like AWS wouldn't exists. Others prefer to spread out their eggs. One is not absolutely right and the other absolute wrong.

jonathantf2 3y ago

Cloudflare doesn't proxy all applications, just HTTPS.

re-thc 3y ago
It can e.g. magic transit. Might cost a lot more and might not work as good, but you can.
- jonathantf2 3y ago
  Correct yes - although having used a provider that used Magic Transit as protection I can safely say it's a terrible option.
  - wilkystyle 3y ago
    > I can safely say it's a terrible option. Can you elaborate?
    - re-thc 3y ago
      It can't block most attacks. This was a few years ago though. Maybe it's better now.
    - jonathantf2 3y ago
      Compared to other mitigation providers there were very few filters, and when you were under attack it just seemed to throttle your whole connection to as low as 50Kbps, meaning players would disconnect.
      - lxchase 3y ago
        Magic Firewall exists now which is pretty powerful a la wire shark filters if I remember correctly. Otherwise MT filters are pretty good now. However I have encountered a few cases where a valid connection may drop depending on how sensitive your application is but pretty rare.
- 3y ago