Budget DDoS filtering — what actually works under $10/mo?

This is what I worry. For web maybe ok but for my client game server this is dead

I try DNS failover with two Contabo VPS, Nuremberg and Singapore. TTL 60 second. When I shutdown Nuremberg test, still get connection to dead IP from some user after 8 minute. Mobile network especially bad, they cache DNS very long

Maybe better to use something like Cloudflare load balancer? But $5 per month just for LB, on top of origin cost. At this point total is $15-20, not budget anymore

@FlowSana you say 100 concurrent websocket per IP on Cloudflare free. Is this per connecting client IP or per origin server IP? Big difference for me

Per connecting client IP. The limit is on the eyeball side, not your origin. So 100 different users each with one socket.io connection is fine. One user opening 101 tabs hits the wall.

For your game server: if it is UDP-based (most are), Cloudflare does not proxy UDP on free tier at all. You would need Spectrum at $1/GB or move to TCP-based transport.

Re DNS failover: the mobile cache problem is real. I have seen Indonesian Telkomsel cache A records for 30 minutes regardless of TTL. Anycast is the only real fix, which brings us back to GeorgeNmp's point about economics.

Practical cheap hybrid: put your web frontend on Cloudflare, game server on cheap VPS with OVHcloud Game DDoS protection (included with some SYS dedis, not VPS — see https://www.ovhcloud.com/en/vps/). But SYS dedi starts at €30, so again not under $10.

Just measured again: SGN scrubber is in Equinix SG1, VXLAN endpoint is there. Your +12ms is probably last mile to VNPT or FPT backhaul, not our tunnel. From my Montreal test to SG1 direct is 238ms, via VXLAN scrubber is 241ms. So +3ms for encapsulation, rest is your upstream.

That said, we are not selling this as gaming infrastructure. 900 Mbps threshold is low because we are buying clean pipe from upstream, not building our own scrubbing fabric. At $8 I am not sure what people expect. Real anycast scrubbing at volume costs more than the VPS itself.

@GeorgeNmp you are right that single POP is SPOF. Working on second tunnel to Los Angeles but InterServer only has Secaucus and LA, both on same coast for trans-Pacific. Not ideal.

Following this thread with interest

I run a small Mumble server for friends on a Hetzner CX11 in Falkenstein — https://www.hetzner.com/cloud. Had one incident: UDP amplification hit me, 1.2 Gbps according to their graph. No nullroute, just filtered. Server stayed up, voice quality degraded for maybe 20 seconds then clean.

So Hetzner's "basic" scrubbing does work sometimes? Or I got lucky because Falkenstein has more capacity than Nuremberg? I have no anycast, no CDN, just firewall rules olespete-style.

Also @prague1983 what kind of CCTV botnet traffic do you see? I get a lot of 53413/UDP (Netis router backdoor) but not CCTV specifically.

Same in DE, especially Hikvision and Dahua deployed by small businesses who never changed default password. The Mirai variants never died, they just got quieter.

Re Hetzner: Falkenstein vs Nuremberg capacity is not public, but I can tell you their scrubbing is sFlow-based with local mitigation first, then upstream trigger. Small attacks often die in the edge ACLs without ever hitting the "Shield" threshold. Your 1.2 Gbps probably got handled by their edge router's built-in policer, not the full scrubbing pipeline.

I have seen Hetzner nullroute at 2.1 Gbps in Nuremberg but 3.8 Gbps in Helsinki. Inconsistent because different upstream blends. This is the problem with "included" protection: no SLA, no transparency.

OVHcloud Game is TCP-only for the optimized profiles. UDP game traffic falls back to standard Arbor scrubbing, which is better than nothing but not the same as their "per-packet-optimized" marketing implies. I tested this with a Quake 3 server in 2022, got packet loss on UDP during a 5 Gbps mix.

900 Mbps is low but perspective from Argentina: our international transit is expensive. Local VPS providers offer "DDoS protection" that is literally just a 100 Mbps port and hope the attack is smaller than that. I have seen "protected" plans that nullroute at 200 Mbps.

At least InterServer is honest about what they built. Many local providers here just lie.

For budget: I use Cloudflare + BuyVM $2/mo slice in Las Vegas for personal VPN. Never had issue because Cloudflare absorbs everything on the web side, and VPN is not a target. If I needed real protection for UDP I would look at M247 or something European, but again not under $10.

This thread keeps saying "not under $10" like a mantra. Maybe the real answer is: under $10, hide your IP and pray.

Basically. But "hide your IP" is a whole discipline people skip.

Real checklist for sub-$10 survival:

• Origin IP not in any certificate transparency log. Check crt.sh monthly.
• No email from origin IP. Mailgun, Postmark, anything but your own /32.
• No git push from origin. CI/CD runners exist for a reason.
• Nginx real_ip module configured so you actually see attacker IPs, not Cloudflare's, for rate limiting.
• Fail2ban parsing Cloudflare's CF-Connecting-IP, not TCP source.

I have cleaned up after people who did 4 of 5 and got burned on the last one. The $0 security layer is operational discipline, not product.

@olespete wait that's me. Anyway.

This is a lot to absorb

So if I understand: for my socket.io project on RackNerd, cheapest viable path is Cloudflare free + nginx rate limiting + pray nobody finds my origin IP. And if they do, RackNerd has no real protection, I just get nullrouted or suspended.

Is there ANY provider under $10 that includes actual scrubbing with no nullroute? Like even 1 Gbps guaranteed? Or is that physically impossible at this price

Also @FlowSana you mentioned HetrixTools $5 — is that for monitoring or do they also do failover? Their website confuses me

No. Not with a meaningful SLA. The economics do not work.

Scrubbing center capex: Arbor TMS or equivalent starts at $100K per unit. You need at least two for redundancy. Then cross-connects at IXPs, transit contracts with scrubbing clauses, engineers to write and maintain signatures. Amortized over customers, the provider needs maybe $30-50/mo per protected IP to break even at small scale.

What you get under $10 is statistical multiplexing and hope. Some providers are better at the hope than others.

HetrixTools: monitoring + DNS failover in their $5 plan. They ping your server, flip A record if down. Same TTL problems as any DNS failover. UptimeRobot does similar for free but fewer locations.

I am late to this but want to add: backups

If you are running on $5-10 VPS with no real DDoS protection, your disaster recovery is your actual protection. I keep:

• Daily rsync to Hetzner Storage Box (€3/mo for 100GB)
• Terraform config to spin up replacement at Contabo or wherever in ~10 minutes
• DNS TTL at 300 seconds normally, can drop to 60 if I need to migrate

So if RackNerd or whoever nullroutes me, I am back online elsewhere before most users notice. Not "protection" but "resilience." Different thing, same result for users.

This assumes your data fits in 100GB and your app is stateless enough to migrate. Mine is. Yours may not be.

@minh1987 for game server with stateful connections this does not help, sorry.