3 ms·
I'd consider it mostly protected, because no their servers are not on OVH, just a single box performing front-facing NAT/proxy essentially. The attacker now jus
by treesknees 3y ago
I'd consider it mostly protected, because no their servers are not on OVH, just a single box performing front-facing NAT/proxy essentially. The attacker now just needs to find the "secret" production subnet and attack it directly instead of through the front-facing NAT addresses.
- frakkingcylons 3y agoThat's true. I guess it'd be more accurate to say they're on OVH's network, not necessarily their compute and other infrastructure.
- bombcar 3y agoThat is very easy to mitigate, because you null route the production subnet except for a VPN that only can be reached by the proxy. You can even VPN over a completely different IPv6 route. They could still try to knock your entire datacenter offline but that is much harder.
- treesknees 3y agoThat's not much harder, that's exactly what happened to them in the initial attack. You're still depending on either a "secret" IPv6 network, or your upstream provider performing some source-based routing to only route packets from the VPN connection. I doubt that's available to a simple colo customer.