Hacker News Reader

Comment by Thaxll | Hacker News Reader

Pay couple of $ for Cloudflare be done with it.

https://www.cloudflare.com/ddos/

Don't forget to have a fresh IP before doing the move so that your origin is unknown.

I hate that this is the right answer. I hate that I use it too. I hate that I don't have time/cash to explore alternatives.

because alternatives usually cost several thousands $/months..

what has the internet become?

Why not create blacklists (even on a timed basis) with the IPs to block at BGP level? and these blacklists managed by bodies,

- okay they are bodies..., but at least they can be open foundations to which it is not mandatory to join (as in the case of cloudflare)-

available to BGP backbones and routed on a network, castrate the blacklisted traffic?

maybe even at host level be able to make one IP available for normal traffic and possibly one for blacklist traffic using BGP routings to which the blacklist tables are applied?

So if someone becomes part of the bonnet, they are denied all access to the internet

Isn't that good though? Unblock them when they fix their host.

(I am not a lawyer) I don't know how legal it actually is, how enforceable it is, and if the whole marker applies those, but my ISP contract has provisions that says I'm not authorized to invade or damage third parties using their internet service.

That basically exists, look at BGP blackholes. Fairly well supported, and it works at what it does, but it can be too blunt of a tool, because it blackholes by destination, not by source.

Border routers are wired to make forwarding decisions based on destination addresses, and not source addresses, so options are limited. Even if you could blackhole by source/dest pair, the distributed nature of DDoS means thousands of sources, which means thousands of rules/routes, which isn't ideal. Some providers might have some capacity to do smarter filters, but it's limited and not very standardized.

If you're dealing with volumetric DDoS, the simple reality is you need big pipes if you want to accept the traffic. Otherwise, cycle IPs and hope legit traffic finds new IPs faster than abusers do. Run your backend communication over a separate network or at least totally separate IP space, so at least you're not losing management capability while under attack.

DDoS mitigation should be a complimentary business with CDN, becuase the traffic flows are opposite of usual, and CDNs generally connect with symetric connections, so what were they going to do with the inbound bandwidth anyway? But that doesn't mean all CDNs run that line of business.

Doesn't it bring you a tiny bit of concern that this is only current answer people can give?

There are others e.g. ddos-guard, akamai.

How much do they cost? That first one starts at $100/month

Even better, use the excellent Cloudflare Tunnel product to completely shield your origin:

https://www.cloudflare.com/products/tunnel/

I haven’t had a port open to the Internet in well over a year. It’s fast, easy, and even easily supports things like failover (just launch the daemon on multiple machines on the network). Bonus points - setup Zero Trust with their Warp client and get direct access to Cloudflare Tunnel networks and hosts without having to expose them.

Integrates perfectly and smoothly with all of their other products, of course. Going from register/transfer a domain name to full blown CF tunnel, CDN, DDoS, etc comes down to a few minutes of total configuration once you get the hang of it. After that exposing a new service to the internet via Cloudflare tunnel takes 10 seconds - the Zero Trust dashboard takes care of everything, including creating the domain DNS record for the tunnel endpoint.

Free for up to fifty users and what I’ve described here is only scratching the surface.

Cloudflare is really crushing it these days and they’re moving in on everything from AWS to Tailscale. The scale, scope, and tight integration of their products is nearly unmatched. Bonus points for being the cheapest and most performant platform from object storage to functions (Workers). And of course no bandwidth charges on any of this, which can save a tremendous amount of money.

Heck, even Cloudflare free tier is very impressive. That's why it's so widespread.

You can also whitelist the cloudflare IP's and block all other traffic, that way the only traffic hitting your origin is through the proxy.

If under heavy DDOS, it's very likely that your available upstream/downstream bandwidth is already starved, so dropping requests at your public IP level is too late.

good point

If you're under attack now, you should get a new public IP first. Then you can hide behind Cloudflare and drop all unproxied connections. Unless and until you get a new IP, no amount of Cloudflare wizardry can stop all the direct traffic that you're already getting.

If your host's bandwidth is so completely saturated by the attack that no amount of IP switching will help, well, you should find a new host.

but is it far-sighted that to keep the internet as free as possible there are no ways to mitigate a ddos,

and at the same time this freedom is completely lost

when the companies that protect against ddos can be counted on the fingers of one hand?

Yeah. Cloudflare sucks but it's also by far the most effective solution against this type of stuff.

ever since cloudflare went political and started kicking off customers for their opinions, i never touched that service and never will. and i have a very long memory. but alternatives are welcome.

I can't think of a single service that would have held off against censorship anywhere near as long as CF did, that also doesn't suck.

I’m curious which customers you had in mind here. Is it KF?

Reply on news.ycombinator.com