(untitled)

How can i mitigate ddoses without using cloudflare? In an effective way using nginx or anything, i ve been studying, but i would like some lainons tips for ddos mitigation/server hardening.

honestly, after a point it's basically impossible. i worked for a company that sold ddos mitigation and their "trick" was just having a big enough network with enough caches to soak everything up. it's nothing clever, just lots of servers. that's assuming you're going against someone with a big botnet though. if you just monitor and ban abusive IPs, and structure your backend so people can't call computationally expensive things from an API node, you'll probably be fine.

other than banning ip's, having enough bandwidth, and patching against certain types of dos attacks (slowlorris) you really can't. It's why the attack seems to stand the test of time, easy to pull and hard to mitigate, but it doesn't really do any damage other than mild inconvenience.

>>12125 iptables -I INPUT -i eth0 -p tcp –dport 80 -m state –state NEW -m recent –set –name DEAULT iptables -I INPUT -i eth0 -p tcp –dport 80 -m state –state NEW –m recent –update –seconds 10 –hitcount 8 –rttl –name DEFAULT -j DROP That will ban any IP address that pings you more than 8 times in 10 seconds. Change the settings to better reflect how they are attacking.

>>12146 So this kind of ping limiting helps but how well does it handle larger attacks? I don't know to much about dos/ddos mitigation.

>>12294 The larger the botnet targeting you the weaker it is and of course if they use a different method to ddos you such as an exposed API node that uses a lot of server resources then it won't help at all.

>>12126 This is right. The common DDOS attack just attacks your network bandwidth, cloudflare prevents it because their network bandwidth is really big and has a lot of proxy-nodes over the world. Every proxy node has a cache, that prevents attacker from attacking the bandwidth by downloading large files.

>>12125 I like OpenBSD for servers due to its focus on security and getting DDOSed is a security issue. Check out pf's stateful tracking options. You can also run relayd(8) and distribute the load between multiple computers with health checks and failover. https://www.openbsd.org/faq/pf/filter.html#stateopts