5 ms·
They’re on OVH now and should have protection from it by virtue of being on their network now. > However, we found that OVH’s anti-DDoS protections were likely
by frakkingcylons 3y ago
They’re on OVH now and should have protection from it by virtue of being on their network now.
> However, we found that OVH’s anti-DDoS protections were likely suitable: they are effective, and their cost is amortized across all OVH users, and therefore of marginal cost to us. To this end the network solution we deployed involved setting up an OVH box to NAT traffic through OVH’s DDoS-resistant network and direct it to our (secret) production subnet in AMS; this met our needs for end-to-end encryption as well as service over arbitrary TCP protocols.
- treesknees 3y agoI'd consider it mostly protected, because no their servers are not on OVH, just a single box performing front-facing NAT/proxy essentially. The attacker now just needs to find the "secret" production subnet and attack it directly instead of through the front-facing NAT addresses.
- frakkingcylons 3y agoThat's true. I guess it'd be more accurate to say they're on OVH's network, not necessarily their compute and other infrastructure.
- bombcar 3y agoThat is very easy to mitigate, because you null route the production subnet except for a VPN that only can be reached by the proxy. You can even VPN over a completely different IPv6 route. They could still try to knock your entire datacenter offline but that is much harder.
- treesknees 3y agoThat's not much harder, that's exactly what happened to them in the initial attack. You're still depending on either a "secret" IPv6 network, or your upstream provider performing some source-based routing to only route packets from the VPN connection. I doubt that's available to a simple colo customer.