851
Welcome to 2025 (content.federation.network)
submitted 1 year ago by to c/memes@lemmy.world
81 comments fedilink hide all child comments
 

Welcome to 2025
@memes@lemmy.world

you are viewing a single comment's thread
view the rest of the comments
[–] 135 points 1 year ago (49 children)

if you can provide me a better way to keep my homelab from getting DDoSed every five minutes then by all means, please share it

  • permalink
  • fedilink
  • source
  • hideshow 49 child comments
    •
  • [–] 59 points 1 year ago* (16 children)

    Just put it behind a wireguard server and don't expose any ports?

    If you absolutely must expose some stuff, get a cheap 3$/mo vps that connects via wireguard to your home and setup a reverse proxy? They almost all come with DDoS protection.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 16 child comments
    •
  • [–] 42 points 1 year ago* (12 children)

    How do I stop a DDOS attack of my website without having port 80 or 443 open, so you can access the website?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 12 child comments
    •
  • [+] -8 points 1 year ago* (11 children)

    Don't expose the website. That's the point. Only connect remotely via wireguard.

    If you must expose the website, I also provided options in my original post.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 69 points 1 year ago* (8 children)

    I think you misunderstood; if I run a publicly accessible website (like a Lemmy instance), those ports need to be opened.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 9 points 1 year ago (2 children)

    A cheap VPS hosting

    https://anubis.techaro.lol/docs/admin/installation/

    as a reverse proxy may work. The VPS will do the work of verifying requests and stopping bad requests from hitting the target resource. Though certainly if the DDoS is a matter of a massive botnet raiding your domain it may not work as well as something like cloudflare

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 year ago (1 child)

    Anubis does not prevent a ddos attack and only shifts the saturation point to your VPS. Anubis is the answer for bots and ai scrappers, not DDoS.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 year ago* (last edited 1 year ago)

    Sure, but to someone running a website out of their house, 100,000 bots trying to hit the site at the same time to scrape it is going to have the same effect. So yes, you're correct, Anubis has nothing to do with stopping a literal DDoS attack, but it does help smaller websites stay alive by avoiding responding to requests from scrapers or one-off malicious agents.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 1 year ago* (4 children)

    Yes, I've addressed this in my original message.

    Get yourself a 3$/month VPS, they almost all come with DDoS protection, and reverse proxy from there. Either restrict the ports on your home network to only that IP, or better yet tunnel all the traffic via Wireguard.

    Obviously if you're hosting a large server this is another matter, but nevertheless almost all serious hosting services offer in house DDoS protection.

    But the comment I was originally replying to specifically refered to homelabs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 8 points 1 year ago* (2 children)

    What would be a good resource to, like, relearn modern networking stuff cuz some of these solutions are totally new ideas to me? I was CISCO and A+ certified way back in 2003; but the only thing I ever really used from those classes and training since then was making cables and setting up smaller, simple networks for home or small businesses. I get the sense a fuckton has changed and this exchange made me want to brush up.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 9 points 1 year ago

    I found just doing it the best for me. Start with proxmox hypervisor on some old pc. Start running a bunch of services. Some documentation mentions "heres how you set it up behind a reverse proxy". "Hmm...whats that" is pretty much how i learned it.

    Then compare with people in the homelab communities who are doing differently and find out why.

  • permalink
  • fedilink
  • source
  • parent
  • [–] [S] 30 points 1 year ago (9 children)

    @DaPorkchop_@lemmy.ml @memes@lemmy.world Is that an actual issue or a hypothetical one? I've never had an attack in 10 years of publicly hosting stuff.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 19 points 1 year ago (1 child)

    As someone else who used to host via an open port, you get random connections all the time. Almost constantly and the request paths make it obvious they are scanning for vulnerabilities. Via cloud flare the number of those requests is much lower, as they have to know at least the DNS to do so, (and can't guess it from a presented SSL cert.)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 12 points 1 year ago

    Yeah, I see random https and other connections all the time blindly scanning for vulnerabilities. Not enough to cause any real problems though. One time I publicly exposed redis or rabbitmq (can't remember which) and didn't set a password, so someone set a password for me :). That's about the worst that's happened to me.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 5 points 1 year ago (6 children)

    It's the reason I set up cloudflare in the first place, so yeah. I was getting SYN flood-ed to the point that my router would just crash almost immediately, and after rebooting it the attack would resume after a minute or two.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] [S] 7 points 1 year ago (3 children)

    @DaPorkchop_@lemmy.ml @memes@lemmy.world Hm weird, I don't see why they would spend their resources attacking random people without any kind of demand. Even at work I've never seen one happening.
    I still believe Cloudflare has most of its customers because of fearmongering tbh.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 7 points 1 year ago (2 children)

    It's a bit like saying "having a password on your account is fearmongering, why would anyone try to access your data".

    It's only fearmongering until you get attacked, and it's already too late when you do. Better to be proactive.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] [S] 6 points 1 year ago (1 child)

    @Alaknar@sopuli.xyz @memes@lemmy.world Being proactive doesn't mean you have to hide your personal service behind a billion dollar company. That is precisely the kind of overreaction triggered by fearmongering. If you don't know how to secure access points or harden configurations, no service will be able to do it for you as if by magic. Not to mention your responsibility towards your users, who may not want to be tracked by a third-party company without their knowledge every time they visit your site (or half of the internet by now).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 year ago

    If you don’t know how to secure access points or harden configurations, no service will be able to do it for you as if by magic

    That's the point. Cloudflare does this as if by magic.

    Not to mention your responsibility towards your users, who may not want to be tracked by a third-party company

    Cloudflare doesn't track your users.

    As a sidenote - am I reading you correctly? Your main issue with Cloudflare is "they're large"? Like, if they were "two dudes in a basement" and provided the same quality product as they do now, you'd be happy to use their service?

  • permalink
  • fedilink
  • source
  • parent
  • [–] 6 points 1 year ago (1 child)

    Get a router that has flood protection? This is like.. Extremely basic network protection.

    OpenWRT has had configurable syn-flood protection (enabled by default) since like 2010.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 1 year ago

    Even if the SYN packets were being ignored, the connection would still be unusable if there's enough incoming traffic for most legitimate packets to get dropped. And as mentioned in other comments, the router in question is a shitty ISP router which can't be replaced (although I do have a much fancier router with OpenWRT running behind that).

  • permalink
  • fedilink
  • source
  • parent
  • [–] 15 points 1 year ago* (7 children)

    Is you homelab getting ddosed constantly?

    I had had it for years and never ever got ddosed.

    Are you sure it's actually ddos and not just the typical bots scanning for vulnerabilities? Which are easy defended for by keeping updated.

    It's weird as a DDOS is not something that's just happens, it's a targeted attack. It's a rare occurrence that someone decided to attack a homelab.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 9 points 1 year ago (6 children)

    I spent multiple days getting SYN flooded to the point my router would crash and reboot over and over, and it stopped the moment I set up cloudflare and asked my ISP to change my IP. This was the instance which pushed me over the edge, but there had been smaller attacks lasting a few minutes each for years leading up to this.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 11 points 1 year ago (5 children)

    What kind of router to you have? A good router should not crash from any amount WAN traffic. But yes, if you host anything you will get scanned even harder than usual.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 3 points 1 year ago (4 children)

    A shitty ISP-supplied modem/router which I have to use :|

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 1 year ago (1 child)

    Where are you? I bet there's at least a few local ISPs that would allow you to use a user-supplied router.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 1 year ago

    There are better ISPs around, but my parents (who are the ones paying for it) don't want to switch providers because... reasons? At any rate it isn't happening any time soon, but once I move out I'll finally be able to switch to Init7 and be done with it all :)

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 1 year ago (1 child)

    Maybe you can enable bridge mode on it? Then you could run something like opnsense behind it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 year ago

    It's only got a DMZ mode where I can configure it to forward all incoming traffic to my own router running behind it, but even in that mode it still has to NAT all the packets. IPv6 traffic seems to get forwarded along without much (if any) additional processing, but for hosting stuff publicly I would obviously need to expose IPv4 as well.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 15 points 1 year ago (3 children)

    https://anubis.techaro.lol/

    You don't need Cloudflare.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 11 points 1 year ago (4 children)

    Host your own cloud worthy anti DDOS solution with fail2ban /s

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [+] 3 points 1 year ago* (last edited 8 months ago) (3 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 1 year ago

    fail2ban is good for preventing spam and DDOS on authenticated endpoints, but it's harder to prevent attacks on public endpoints against a botnet or even a lazy proxy chain spam, which is why cloudflare adds some cookies and a buffer to handle a wave of new connections and maintain an address rank to drop any bad clients.

    Although that being said, cloudflare can be bypassed via other timing tricks and even just using a specific request chain to get fresh cf cookies to avoid getting blocked.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 5 points 1 year ago

    Could you shell out for a decent firewall? It should be able to protect against majority of ddos attacks unless someone is paying for something big.

    But it really is fine to use cloudflare if you want the ddos protection. I wouldnt feel bad at all.

  • permalink
  • fedilink
  • source
  • parent