3 ms·

Pay couple of $ for Cloudflare be done with it. https://www.cloudflare.com/ddos/ https://www.cloudflare.com/ddos/ Don't forget to have a fresh IP before doing

by Thaxll 3y ago

Pay couple of $ for Cloudflare be done with it. https://www.cloudflare.com/ddos/ https://www.cloudflare.com/ddos/ Don't forget to have a fresh IP before doing the move so that your origin is unknown.

fvv 3y ago
but is it far-sighted that to keep the internet as free as possible there are no ways to mitigate a ddos, and at the same time this freedom is completely lost when the companies that protect against ddos can be counted on the fingers of one hand?
djbusby 3y ago
I hate that this is the right answer. I hate that I use it too. I hate that I don't have time/cash to explore alternatives.
- fvv 3y ago
  because alternatives usually cost several thousands $/months.. what has the internet become? Why not create blacklists (even on a timed basis) with the IPs to block at BGP level? and these blacklists managed by bodies, - okay they are bodies..., but at least they can be open foundations to which it is not mandatory to join (as in the case of cloudflare)- available to BGP backbones and routed on a network, castrate the blacklisted traffic? maybe even at host level be able to make one IP available for normal traffic and possibly one for blacklist traffic using BGP routings to which the blacklist tables are applied?
  - hoffs 3y ago
    So if someone becomes part of the bonnet, they are denied all access to the internet
    - remram 3y ago
      Isn't that good though? Unblock them when they fix their host.
    - ElectricalUnion 3y ago
      (I am not a lawyer) I don't know how legal it actually is, how enforceable it is, and if the whole marker applies those, but my ISP contract has provisions that says I'm not authorized to invade or damage third parties using their internet service.
  - toast0 3y ago
    That basically exists, look at BGP blackholes. Fairly well supported, and it works at what it does, but it can be too blunt of a tool, because it blackholes by destination, not by source. Border routers are wired to make forwarding decisions based on destination addresses, and not source addresses, so options are limited. Even if you could blackhole by source/dest pair, the distributed nature of DDoS means thousands of sources, which means thousands of rules/routes, which isn't ideal. Some providers might have some capacity to do smarter filters, but it's limited and not very standardized. If you're dealing with volumetric DDoS, the simple reality is you need big pipes if you want to accept the traffic. Otherwise, cycle IPs and hope legit traffic finds new IPs faster than abusers do. Run your backend communication over a separate network or at least totally separate IP space, so at least you're not losing management capability while under attack. DDoS mitigation should be a complimentary business with CDN, becuase the traffic flows are opposite of usual, and CDNs generally connect with symetric connections, so what were they going to do with the inbound bandwidth anyway? But that doesn't mean all CDNs run that line of business.
rglullis 3y ago
Doesn't it bring you a tiny bit of concern that this is only current answer people can give?
- rjh29 3y ago
  There are others e.g. ddos-guard, akamai.
  - remram 3y ago
    How much do they cost? That first one starts at $100/month
marginalia_nu 3y ago
Yeah. Cloudflare sucks but it's also by far the most effective solution against this type of stuff.
pjc50 3y ago
Heck, even Cloudflare free tier is very impressive. That's why it's so widespread.
hknmtt 3y ago
ever since cloudflare went political and started kicking off customers for their opinions, i never touched that service and never will. and i have a very long memory. but alternatives are welcome.
- tekla 3y ago
  I can't think of a single service that would have held off against censorship anywhere near as long as CF did, that also doesn't suck.
- joenot443 3y ago
  I’m curious which customers you had in mind here. Is it KF?
JohnMakin 3y ago
You can also whitelist the cloudflare IP's and block all other traffic, that way the only traffic hitting your origin is through the proxy.
- ElectricalUnion 3y ago
  If under heavy DDOS, it's very likely that your available upstream/downstream bandwidth is already starved, so dropping requests at your public IP level is too late.
  - JohnMakin 3y ago
    good point
  - kijin 3y ago
    If you're under attack now, you should get a new public IP first. Then you can hide behind Cloudflare and drop all unproxied connections. Unless and until you get a new IP, no amount of Cloudflare wizardry can stop all the direct traffic that you're already getting. If your host's bandwidth is so completely saturated by the attack that no amount of IP switching will help, well, you should find a new host.
kkielhofner 3y ago
Even better, use the excellent Cloudflare Tunnel product to completely shield your origin: https://www.cloudflare.com/products/tunnel/ https://www.cloudflare.com/products/tunnel/ I haven’t had a port open to the Internet in well over a year. It’s fast, easy, and even easily supports things like failover (just launch the daemon on multiple machines on the network). Bonus points - setup Zero Trust with their Warp client and get direct access to Cloudflare Tunnel networks and hosts without having to expose them. Integrates perfectly and smoothly with all of their other products, of course. Going from register/transfer a domain name to full blown CF tunnel, CDN, DDoS, etc comes down to a few minutes of total configuration once you get the hang of it. After that exposing a new service to the internet via Cloudflare tunnel takes 10 seconds - the Zero Trust dashboard takes care of everything, including creating the domain DNS record for the tunnel endpoint. Free for up to fifty users and what I’ve described here is only scratching the surface. Cloudflare is really crushing it these days and they’re moving in on everything from AWS to Tailscale. The scale, scope, and tight integration of their products is nearly unmatched. Bonus points for being the cheapest and most performant platform from object storage to functions (Workers). And of course no bandwidth charges on any of this, which can save a tremendous amount of money.

by Thaxll 3y ago

Pay couple of $ for Cloudflare be done with it. https://www.cloudflare.com/ddos/ https://www.cloudflare.com/ddos/ Don't forget to have a fresh IP before doing the move so that your origin is unknown.

fvv 3y ago

but is it far-sighted that to keep the internet as free as possible there are no ways to mitigate a ddos, and at the same time this freedom is completely lost when the companies that protect against ddos can be counted on the fingers of one hand?

djbusby 3y ago

I hate that this is the right answer. I hate that I use it too. I hate that I don't have time/cash to explore alternatives.

fvv 3y ago
because alternatives usually cost several thousands $/months.. what has the internet become? Why not create blacklists (even on a timed basis) with the IPs to block at BGP level? and these blacklists managed by bodies, - okay they are bodies..., but at least they can be open foundations to which it is not mandatory to join (as in the case of cloudflare)- available to BGP backbones and routed on a network, castrate the blacklisted traffic? maybe even at host level be able to make one IP available for normal traffic and possibly one for blacklist traffic using BGP routings to which the blacklist tables are applied?
- hoffs 3y ago
  So if someone becomes part of the bonnet, they are denied all access to the internet
  - remram 3y ago
    Isn't that good though? Unblock them when they fix their host.
  - ElectricalUnion 3y ago
    (I am not a lawyer) I don't know how legal it actually is, how enforceable it is, and if the whole marker applies those, but my ISP contract has provisions that says I'm not authorized to invade or damage third parties using their internet service.
- toast0 3y ago
  That basically exists, look at BGP blackholes. Fairly well supported, and it works at what it does, but it can be too blunt of a tool, because it blackholes by destination, not by source. Border routers are wired to make forwarding decisions based on destination addresses, and not source addresses, so options are limited. Even if you could blackhole by source/dest pair, the distributed nature of DDoS means thousands of sources, which means thousands of rules/routes, which isn't ideal. Some providers might have some capacity to do smarter filters, but it's limited and not very standardized. If you're dealing with volumetric DDoS, the simple reality is you need big pipes if you want to accept the traffic. Otherwise, cycle IPs and hope legit traffic finds new IPs faster than abusers do. Run your backend communication over a separate network or at least totally separate IP space, so at least you're not losing management capability while under attack. DDoS mitigation should be a complimentary business with CDN, becuase the traffic flows are opposite of usual, and CDNs generally connect with symetric connections, so what were they going to do with the inbound bandwidth anyway? But that doesn't mean all CDNs run that line of business.

rglullis 3y ago

Doesn't it bring you a tiny bit of concern that this is only current answer people can give?

rjh29 3y ago
There are others e.g. ddos-guard, akamai.
- remram 3y ago
  How much do they cost? That first one starts at $100/month

marginalia_nu 3y ago

Yeah. Cloudflare sucks but it's also by far the most effective solution against this type of stuff.

pjc50 3y ago

Heck, even Cloudflare free tier is very impressive. That's why it's so widespread.

hknmtt 3y ago

ever since cloudflare went political and started kicking off customers for their opinions, i never touched that service and never will. and i have a very long memory. but alternatives are welcome.

tekla 3y ago
I can't think of a single service that would have held off against censorship anywhere near as long as CF did, that also doesn't suck.
joenot443 3y ago
I’m curious which customers you had in mind here. Is it KF?

JohnMakin 3y ago

You can also whitelist the cloudflare IP's and block all other traffic, that way the only traffic hitting your origin is through the proxy.

ElectricalUnion 3y ago
If under heavy DDOS, it's very likely that your available upstream/downstream bandwidth is already starved, so dropping requests at your public IP level is too late.
- JohnMakin 3y ago
  good point
- kijin 3y ago
  If you're under attack now, you should get a new public IP first. Then you can hide behind Cloudflare and drop all unproxied connections. Unless and until you get a new IP, no amount of Cloudflare wizardry can stop all the direct traffic that you're already getting. If your host's bandwidth is so completely saturated by the attack that no amount of IP switching will help, well, you should find a new host.

kkielhofner 3y ago

Even better, use the excellent Cloudflare Tunnel product to completely shield your origin: https://www.cloudflare.com/products/tunnel/ https://www.cloudflare.com/products/tunnel/ I haven’t had a port open to the Internet in well over a year. It’s fast, easy, and even easily supports things like failover (just launch the daemon on multiple machines on the network). Bonus points - setup Zero Trust with their Warp client and get direct access to Cloudflare Tunnel networks and hosts without having to expose them. Integrates perfectly and smoothly with all of their other products, of course. Going from register/transfer a domain name to full blown CF tunnel, CDN, DDoS, etc comes down to a few minutes of total configuration once you get the hang of it. After that exposing a new service to the internet via Cloudflare tunnel takes 10 seconds - the Zero Trust dashboard takes care of everything, including creating the domain DNS record for the tunnel endpoint. Free for up to fifty users and what I’ve described here is only scratching the surface. Cloudflare is really crushing it these days and they’re moving in on everything from AWS to Tailscale. The scale, scope, and tight integration of their products is nearly unmatched. Bonus points for being the cheapest and most performant platform from object storage to functions (Workers). And of course no bandwidth charges on any of this, which can save a tremendous amount of money.