Don't. Ddos will overwhelm any single server, do you really think a 1/10/25Gb interface can handle a small 50Gb/s attack?
What you can do is host a VPS with a company that has ddos protections, but I doubt that is standard, and ddos protection works best from a network operator level not a host one.
That's what I meant. Hosting the VPS at a company with ddos protection. So the VPS can take the hit instead of my home connection.
You could do it that way. You could use something like Cloudflare Tunnels/Zero Trust where you'd get DDoS protection for tunneled hostnames http/https. If you're looking for raw tcp/udp arbitrary ports protection, they have a paid Spectrum protection plan.
I don't know your specific situation, but after all these years of self hosting, I can't say as I've ever experienced a DDoS attack. Not saying they don't happen or that it isn't a concern. I've experienced someone hacking my server, but I was super green back then and undoubtedly didn't have the proper protections in order.
Most of your reputable, well established VPS vendors like Digital Ocean, Linode, Vultr, offer DDoS protections. Some like Hetzner offer multiple tiers of DDoS protection.
Depends on what kind of DDoS OP wants to defend against. Defending against an AI crawler DDoS is entirely possible with a tiny VPS. I've been doing that for the past ~1.5 years on a €4/month CX23 Hetzner VPS.
You cannot stop a DDOS, you can only mitigate one with more capacity. That's why there are only a few big players who can do it.
Canonical itself was unable to stop a DDOS attack and they're distributed. You won't stop a DDOS if that DDOS is meant for you.
If you see my old posts, you'll see that I had this exact concern.
I have since learnt that pulling a DDoS attack is actually quite resource intensive / expensive to the deployer as well, and unless you believe that you are being targeted because of something very valuable you host or that you have a technically inclined enemy who is specifically out to get you, you should be fine. Have a good think about your threat model.
With regard to bots, scrapers and the likes, yes, they are a real pain. That can be tackled with Anubis + BadBotBlocker + Fail2Ban + some custom rate limits.
I assume you are a lot more experienced than me based on the number of things you have listed to have self hosted. I feel a well configured reverse proxy with the tools I suggested will take care of 95% of all your not and scraper related worries.
Wouldn't anubis be effective against DDOS attacks?
No, Anubis creates a throttle to stop ai scrapers from taking down https web resources.
Sure but I would think Anubis would also somewhat stop DDOS attacks since clients need to pass Anubis to access the website and across a DDOS swarm that would use up significant resources.
DDOS attacks do not always happen on https, though. You can overwhelm a system with DNS, NTP, or even just malformed packets. Anubis would do nothing for this.
Why would someone DDoS you?
Been hosting Public Websites and Gameservers since 2020 from my residential connection and never got ddosed in that time
monies
Is there some new kind of DDoS attack that steals Bitcoins instantaneously?
no but you can get paid to ddos someone
Lulz
I'm using a setup similar to what you had in mind: I have a small €4/month VPS as my front, with scrapers taken care of by iocaine (it both blocks them, and firewalls the worst off automatically). That's over 90% of the HTTP(s) traffic never making it past the VPS, greatly reducing the traffic into my home network. My actual servers are behind a WireGuard tunnel.
It does not protect against a non-HTTP DDoS, but that wasn't part of my threat model to begin with. My VPS provider (Hetzner) has DDoS protection even for €4/month servers - that doesn't include the scraper DDoS, but includes other kinds - I have luckily not been a victim of any, so no idea whether it works reliably.
Against the scrapers, a VPS + bot defense + Wireguard works like a charm. Can recommend.
I have a setup similar to this, but not for ddos protection. If I were to get ddossed at a network level, my home connection wouldn't feel much of it, as my VPS quickly gets overloaded. I have been "ddossed" at an application level though, I hate AI web scrapers. Since the entire line from VPS to my home network is 1gbps, that alongside most of my server cpu resources got oversaturated with fake traffic.
(I say ddosed in quotes, because I'm not sure of the intentions of these AI webscrapers. Thousands of requests per second on a server that's usually seeing maybe 5 isn't "normal" traffic either.)
Take a look at towonel. It's relatively new, but very promising. I plan to migrate to it from cloudflare.
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!