Budget DDoS filtering — what actually works under $10/mo?

Been testing cheap mitigation options for a small KVM VPS running a personal site. Here's what actually holds up based on my logs:

• Free tier / $0: Cloudflare proxy handles volumetric attacks up to ~50 Gbps on their free plan, but layer 7 still hits your origin. Any CDN with anycast will absorb reflection/amplification.
• €3-5: Some providers (Contabo, OVHcloud) include basic scrubbing at 1 Gbps. Usually single POP, no anycast. Good for UDP floods, useless against slowloris.
• €7-10: Hetzner's €7-10 tier claims 3 Gbps with BGP-based nullrouting. Actual test: 2.1 Gbps UDP mix, 0% loss. 3.4 Gbps, they nullroute your IP for 15 min.

Reality check: under $10 you're not getting real anycast scrubbing. You're getting overprovisioning or a shared 10 Gbps pipe that the provider hopes doesn't fill.

What has actually worked for you

First thing: why is your origin IP even reachable?

If they can hit the VPS directly they bypass whatever CDN you slapped on top. Basic opsec.

My checklist for ANY budget setup:

• Firewall everything except 443 and 80, drop ICMP at edge
• fail2ban on ssh with aggressive mode, custom filters for nginx 444s
• Origin IP never in DNS history, use separate box for mail so no MX leaks
• Tarpit for scanners, rate limit per /24 at application layer

I watched a guy get owned because his "protected" IP was in a GitHub commit from 2019. The attack was only 800 Mbps but it didn't matter because it went straight to the box!

CDN helps but it's not a magic shield. WAF rules, bot fight mode, all of it. Layer 7 will walk through free tiers like paper if your app is chatty.

Hey folks

So full transparency here — we got caught with our pants down on this last month

InterServer's $8 plan was basically just a 2 Gbps commit on a 10 Gbps shared uplink with some basic sFlow sampling to trigger rtbh. Super stoked to announce we actually built real scrubbing now but for like 3 weeks customers were getting nullrouted at 1.8 Gbps because our trigger was too hairy

Fixed it, lowered threshold to 900 Mbps with 5 min sustained before drop, added VXLAN tunnel to actual cleaning POP. Still not real anycast but better than "hope the pipe doesn't fill"

If you're shopping cheap: ask the provider EXACTLY what happens at 1 Gbps, 2 Gbps, 5 Gbps. "unmetered protection" usually means "we'll email you and pray"

My bad to anyone who got kicked. Hit my DM if you were one of em.

Marcus, respect for the transparency, but VXLAN tunnel to a single scrubbing POP is not "fixed" — it's centralized backhaul with a single point of failure. True anycast requires multiple upstream announcements with consistent routing policy, which at $8/month is economically infeasible.

To clarify for the thread: there are three distinct mechanisms being conflated here.

• Overprovisioning: provider buys 10 Gbps, sells 100x 100 Mbps. Works until correlated attacks. Not mitigation, statistical multiplexing.
• Remote triggered black hole (RTBH): BGP community 64512:666 (or your upstream's equivalent) drops traffic at peer edge. Preserves transit but kills reachability. Zero cost to implement, zero benefit to customer.
• Scrubbing center: traffic diverted via BGP (typically prepend or community string to attract to clean prefix), washed, re-injected. Requires AS with multiple transit

Sorry if this is a dumb question!

@GeorgeNmp you said cloudflare is the only good free option — what about if I need websocket support? My little project uses socket.io and I heard the free plan has a 100 second timeout or something

Also is there any provider that lets you pay like $5 extra for actual anycast or is that just not a thing until you hit like $50/mo

Im on a 2 core KVM with 4GB ram from RackNerd (https://www.racknerd.com), disk is pretty slow (like 400 MB/s) but it works for my app. Just scared of getting randomly nuked by some script kiddie

1. Cloudflare free tier: WebSocket proxy supported since 2022, but 100 concurrent connections per IP, 100 second idle timeout. Socket.io falls back to long-polling gracefully in most configurations (engine.io 6.x+).

2. True anycast pricing: OVHcloud offers anycast IP at €18/mo as add-on to compute, not $5. GreenCloudVPS's "Edge" starts at $35. The gap exists because anycast requires /24 minimum announcement, ASN fees, and cross-connects at multiple IXPs.

3. For your RackNerd 2C/4GB setup, practical steps:

• Place nginx 1.24+ with `limit_req_zone` in front of your app, 10r/s burst
• `iptables -A INPUT -p tcp --syn -m limit --limit 1/second --limit-burst 3` for basic SYN flood hardening
• Monitor with `ss -tan state syn-recv` and alert if >100

4. Backup plan: keep a cold standby at a second provider, update DNS with 60s TTL if primary nullrouted. RTO under 5 minutes achievable.

In my country we see lot of UDP amplification from compromised CCTV

3 Gbps is common now, even small botnet can generate. My friend use Hostinger $6 plan, got nullrouted twice in one month. Support say "attack too big for our filter" but no detail what size

Question: is possible to use two cheap VPS in different country with DNS failover? Not anycast, just health check switch. Would this handle 3 Gbps if one goes down, or DNS cache problem make it useless

Also @marcus_qc you say VXLAN tunnel — this add latency how much? In my test to your Singapore POP from Vietnam get +12ms, acceptable for web but not for game server

Compromised CCTV is a huge problem here too, I see 3 Gbps regularly

900 Mbps threshold still seems low for "real" scrubbing

Yes, but with caveats. DNS failover is not instant. TTL matters.

Typical resolver behavior: Google Public DNS honors your TTL down to about 30 seconds below that it caches anyway. Many residential ISPs ignore TTL entirely and cache for 5-15 minutes. During an attack you have a window where dead IP is still served.

Better than pure DNS: use a cheap monitoring node (UptimeRobot free tier, HetrixTools $5) to flip records, but expect 2-10 minutes of bleedover. For true continuity you need application-layer retry, which socket.io does not give you without session affinity.

VXLAN encapsulation adds ~8-20 microseconds in hardware, but the path lengthens because you hairpin through a scrubbing POP. Singapore to Vietnam via VXLAN to Singapore is same city so +12ms sounds like their tunnel endpoint is not in Singapore, or they queue at the scrubber. Ask for traceroutes.