• HTTP attack
  
• SYN attack
  
• NTP attack
  
• SSH brute force
  
• ICMP attack
  
• Minecraft's sever attack (I am not joking, they flood the sever with ad-hoc simulated login requests)
  
• ect...
  

• To use SSH you need to access via the real IP address, CDN can't forward SSH.
  
• When you want to host a game server you need to publish your real ip, CDN can't forward game traffic.
  
• Free CDN services are limited, for example they cover only the 3rd level domain, if you need some nested domain you are naked.
  
• Service such as mail servers, torrents are ignored by CDN, you are naked.
  

• Shutdown whatever is not necessary at that moment;
  
• DON'T REJECT THE TRAFFIC, you let it be dropped with a HUGE timeout, so you can slow down the criminal
  
• Be sure to use a CDN service which provides minimal protection
  

• Hardware firewall
  
• Blackhole where redirect criminals' traffic
  
• Proper IP filtering systems
  

(06-29-2020, 01:42 PM)chanalku91 Wrote: DDOS Protection, a protection from distributed Denial Of Service attacks!
This protection is very important if you are running a server, because if there is a DOS / DDOS attack, this system protects your server from the negative effects of this DDOS attack!

I have 1 VPS with DDOS protection, but sometimes it's not effective!

I have experienced this many times at least 5 times a week!
The way I complete this attack is,
1. Using VPS with large bandwidth with high port speed!
2. If a DDOS attack occurs, I usually analyze the attack and then block the attacker's IP!
But if the attack uses Proxy / Botnet I have prepared a Weapon that makes the attack go down significantly!
I only allow Non-Anonymity Traffic from Indonesia!
3. If the DDOS attack continues, I usually contact the VPS provider to notify them to investigate this attack as soon as possible!

1. Regarding this, an user can't do nothing, the bandwith is fixed and it depends on the "contract" you signed with your provider, maybe you can ask for an increase of bandwith but nothing more;
   
2. I tried shutting down the VPS, but the traffic still reached the provider's network and caused problems, well the VPS was uncovered by any protection and they detected an abnormal traffic;
   
3. This is the only thing that I experience working so far;
   

(06-29-2020, 02:06 PM)LightDestory Wrote: My first experience lasted for an entire week and literally killed my little raspberry, I was hosting a little public service using a dedicated network. It was very massive and various, it was not a simple type. That time I was not aware of the exposing IP problem, so it likely scared me a lot. After that I read a lot of article regarding attacks and mitigations, but never had the chance to try them during an on-going attack.

My latest experience lasted for an entire month! I tried so much to handle and contain the attack but it has been all useless. Nothing I could do from my end helped to stop them.
Regarding your points, I have some questions:

1. Regarding this, an user can't do nothing, the bandwith is fixed and it depends on the "contract" you signed with your provider, maybe you can ask for an increase of bandwith but nothing more;
   
2. I tried shutting down the VPS, but the traffic still reached the provider's network and caused problems, well the VPS was uncovered by any protection and they detected an abnormal traffic;
   
3. This is the only thing that I experience working so far;
   

(06-29-2020, 12:47 PM)LightDestory Wrote: As the title says, what do you think about anti-DDos protection?
Does your VPS (standard paid plan or sponsored) have it?
Did you ever experience an attack? How did you handle it?

These are simple questions that, if you own a VPS, you will face someday. There is nothing to hide, I have experience it, at least 3 time with different systems.
As for my experience I can say that publishing your RAW IP address on the big internet is very dangerous.
These are a lot of attacks that can target you:

• HTTP attack
  
• SYN attack
  
• NTP attack
  
• SSH brute force
  
• ICMP attack
  
• Minecraft's sever attack (I am not joking, they flood the sever with ad-hoc simulated login requests)
  
• ect...
  

The criminals just need your IP address, with simple software such as NMAP they can scan your entire port set and know what are you using.

When it will happen?
Well there isn't a specific moment, as soon as you publish something on the WEB you are in danger. There are services such as CDN that helps you hiding your real IP address but there are some exceptions:

• To use SSH you need to access via the real IP address, CDN can't forward SSH.
  
• When you want to host a game server you need to publish your real ip, CDN can't forward game traffic.
  
• Free CDN services are limited, for example they cover only the 3rd level domain, if you need some nested domain you are naked.
  
• Service such as mail servers, torrents are ignored by CDN, you are naked.
  

What you can do to protect yourself?
You can only prevent the leak of your IP address. If it has leaked and an attack is performed there are very few chance that you, as a VPS's provider customer, can handle it. You can shutdown your VPS but the traffic will always reach your provider's network.
Speaking of what action you can do:

• Shutdown whatever is not necessary at that moment;
  
• DON'T REJECT THE TRAFFIC, you let it be dropped with a HUGE timeout, so you can slow down the criminal
  
• Be sure to use a CDN service which provides minimal protection
  

All I have said util now is useful when your own a VPS without a anti-ddos protection, when you have such protection mostly of the attack will be handled by experts and proper hardware thanks to the providers, we are speaking of:

• Hardware firewall
  
• Blackhole where redirect criminals' traffic
  
• Proper IP filtering systems
  

So, let's end this little talk: after reading such things and how easy is to get targeted, what do you think? Should anti-ddos protection be a must-have for every VPS? Should be a paid or included service?

I am just a user, I am not aware of how complex is to setup such protection on providers'end. I am very curious, so if any provider read this, let us know what mean to setup a anti-ddos protection!