4 ms·
Assuming this is an API and not a website, my approach would be (other than just paying cloudflare to handle it). Application servers that aren't listed on DNS
by StevenWaterman 3y ago
Assuming this is an API and not a website, my approach would be (other than just paying cloudflare to handle it).
Application servers that aren't listed on DNS and their IPs kept secret. A _lot_ of proxy servers that take requests, check the auth, and forward the valid requests to the application servers. For invalid requests, just let them time out.
If checking the auth is expensive enough to cause problems, require some proof-of-work in the request too, and only check the auth if the PoW is there.
In other words, keep all the DDOS traffic off the application servers. Have sacrificial proxies. Make it cheap to handle the DDOS traffic and expensive to generate the DDOS traffic. And then just process the traffic. Spread the proxies across multiple cloud providers if you need to - but ideally ones with free ingress.
- pjc50 3y agoThat's "building your own cloudflare". > Make it cheap to handle the DDOS traffic and expensive to generate the DDOS traffic The traffic is from compromised devices, so it's very cheap.
- 0xEFF 3y agoEven so, the suggestion is a good one. Modern proxies have gotten much better at handling auth and processing the traffic as the GP describes. Service meshes have these features built in now when a few years ago we had to roll our own solutions with haproxy or nginx.
- StevenWaterman 3y agoIf you can make it take 10x as long to send a request, the DDOS attack becomes 1/10 the size.
- pjc50 3y agoOnly for some categories - SYN floods aren't limited by responses at all.
- dewey 3y agoThat sounds fun for an engineer but if it’s a business then you should focus on your core business and not trying to become a anti-ddos service.
- hknmtt 3y agosacrificial proxies make sense although they would all have to be essentially located in the same local network as the target server to avoid routing traffic over different geozones and essentially function like a more advanced firewall. still, it is possible solution and not even expensive.