Setup cloudflare, I believe the free tier includes ddos protection. Then setup your ingress to only allow cloudflare IPs, either with iptables or even better if your vps supports it with a network policy.
this post was submitted on 13 Jul 2023
6 points (100.0% liked)
Self Hosted - Self-hosting your services.
11447 readers
16 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules
- No harassment
- crossposts from c/Open Source & c/docker & related may be allowed, depending on context
- Video Promoting is allowed if is within the topic.
- No spamming.
- Stay friendly.
- Follow the lemmy.ml instance rules.
- Tag your post. (Read under)
Important
Beginning of January 1st 2024 this rule WILL be enforced. Posts that are not tagged will be warned and if not fixed within 24h then removed!
- Lemmy doesn't have tags yet, so mark it with [Question], [Help], [Project], [Other], [Promoting] or other you may think is appropriate.
Cross-posting
- [email protected] is allowed!
- [email protected] is allowed!
- [email protected] is allowed!
- [email protected] is allowed if topic has to do with selfhosting.
- [email protected] is allowed!
If you see a rule-breaker please DM the mods!
founded 3 years ago
MODERATORS
I appreciate the tip but as a privacy minded self-hoster I try to avoid companies like cloudflare. Surely there has to be a way to diy DDoS protection?
A 2 gigabit event isn't big enough to be considered a real attack, a service like cloudflare can sink a 2 terrabit attack every day of the week.
Building a DDoS protection service ( that isn't just black holing traffic ) starts with having enough bandwidth to throw away the attack volume plus keep your desired traffic working and have a bit of overhead to work your mitigation strategies.
What this means is to DIY a useful service you start by buying a couple of terrabits of bandwith in 'small' chunks of a hundred gigabits or so in most peering locations around the globe and then you build a proxy layer like cloudflare on top of it with a team of smart dudes to automate outsmarting the bad guys.
I don't like cloudflare either, but the barriers to entry in this industry are epic.
@brownmustardminion pfsense + incoming geo IP control (allow only from certain regions)
I imagine that’s essentially what I’ve accomplished with Traefik already. The question I have is if Geoblocking does much to mitigate a DDoS. I know for sure it’s at least useful to block third world scammers and bots from running hacking scripts against my server.
@brownmustardminion DDoS usually involves attacks from multiple geographical locations simultaneously. You will eliminate a large threat surface by restricting which countries are allowed for incoming. Of course this won't prevent targeted attacks from hackers who know you and want revenge and can setup bots in a single location but these are rare. Most attempts are by script kiddies.
Can you go IPv6 only with dynamic dns + recycling ip every day? My raspberry pi doesn't get bot traffic. I have 22, 80, 443 and a few other ports open on public ipv6 address.
Blocking doesn't really help with DDOS, since the traffic is still hitting the server and from the standpoint of the VPS provider it doesn't look much different.
Some VPS providers offer DDOS protection as an addon, but just moving to a different provider might solve it. If you're just hosting stuff for friends/family it doesn't seem like there would be much reason to DDOS your IP, unless the IP was recycled from something before that people are still attacking.
I’ve had the IP for a couple of years so I can rule that out. The only thing different than usual is I recently added a backup server to the VPS network. I’ve been doing a remote backup from one server through the VPS to the backup server over the past week. It’s a 4TB backup averaging 4MBps.
My guess is that the VPS provider’s algorithm is bungling the bandwidth calculations, possibly refreshing the bandwidth amount incorrectly which to the black hole detector appears as a sudden spike in bandwidth rather than a steady flow.
I’m going to keep running the backup and compare how long after the backup starts that I get a black hole trigger. If it’s relatively consistent then that might be the problem.
I'd say switch vps providers, one with proper DDoS protection.
blocking regions can help but once the pipe is full there's nothing much you can do from your side.