Budget DDoS filtering — what actually works under $10/mo?

Chicago perspective: I have racked actual scrubbing gear. The power draw alone for a single TMS-3000 is 2.5kW. At retail colo rates that's $300-500/month just in electricity and space before you bought the box or the transit.

So yeah, nobody is eating that cost for your $8 VPS. What they are doing is buying upstream protection on a shared commit and hoping attacks are uncorrelated. When they correlate, everyone gets nullrouted.

OVHcloud can do cheap protection because they own the pipe and the gear and the building. Vertical integration. But even their VPS protection is "best effort" compared to dedicated server plans.

RackNerd does not own anything. They lease from ColoCrossing and others. So their protection is whatever ColoCrossing offers, which is basically nullroute or upgrade to dedicated.

This thread is way over my head technically but I run a bakery with a WordPress site on Hostinger $3 plan

Got an email last month: "your account received unusual traffic and was temporarily limited." Site down for 6 hours. No details on traffic size. Support said "upgrade to Business plan for better security."

I did not upgrade. Moved DNS to Cloudflare free — https://www.cloudflare.com — installed Wordfence, blocked every country except US and Canada. Probably lost some tourist customers but site stays up.

Is this "protection"? No. Is it good enough for a bakery? Yes. My threat model is not organized attack, just random wordpress scanners and maybe someone who hates my sourdough.

For people in this thread with actual attackers: you need actual budget. For small business with no enemies: Cloudflare + common sense is probably fine.

Partially true. RackNerd also has presence in Psychz Los Angeles and some others. But yes, no owned infrastructure means no controlled protection path.

Frankfurt ops perspective: we see a lot of "DDoS protected" VPS that is actually just ColoCrossing's Staminus-based filtering or Psychz's in-house scrubbing. Both are better than nothing but neither gives you a guarantee. Staminus had that... incident... years ago, and their filtering reputation never fully recovered.

At my day job we use Hetzner for non-critical, OVHcloud for critical, and anything that actually matters gets Cloudflare Enterprise or Fastly. The gap between "included" and "contracted" protection is larger than the price gap suggests.

@danfra you tested their DDoS protection at 2.1 Gbps. Did you try their new "DDoS Protection" branding? Curious if anything changed or just marketing.

Same backend, new frontend. I tested in June: 2.3 Gbps UDP mix, handled. 3.1 Gbps, nullroute 12 minutes. Slightly better than my old Shield test but probably just different attack profile and time of day, not infrastructure change.

Their "new" feature is automatic re-announcement after nullroute expires. Used to require ticket. Now it's self-service in robot. Small win for automation, not capacity.

One thing that did change: they added a "permanent mitigation" toggle in the console. Forces all traffic through scrubber always-on. Adds ~2-3ms latency but avoids the sFlow detection delay. Good for known targets, overkill for random personal site.

Thank you all for detail. Very clear now

I think for my situation: game server cannot use Cloudflare free (UDP), DNS failover too slow for session state, cheap VPS "protection" is just marketing. So either accept risk or increase budget to OVHcloud Game dedi or similar

For web services: Cloudflare free + hidden origin + nginx hardening is actually quite strong for $0 extra

@SiteRita your backup strategy is smart. I do similar for web but game server state is harder. Maybe I look into Redis replication or something for session persistence, then DNS failover becomes viable

@frankfurt_ops do you know if OVHcloud Game protection works for custom UDP ports or only their listed games? I run a small Vietnamese game not on any standard list

OVHcloud Game firewall profiles are pre-configured for specific games (Counter-Strike, Minecraft, etc.) with protocol-specific optimizations. For custom UDP applications you get their "default" profile, which is standard Arbor/TMS scrubbing without game-specific tweaks. Better than nothing, but not the "optimized" path.

You can request custom profile creation via ticket if you have enough volume to justify their engineering time. Unlikely for single small server.

Real talk: if your game is commercially important, $30-50 for proper protection is not crazy. If it is hobby, hidden IP + small community + accept downtime is the rational budget choice. The $10 constraint is doing a lot of work in this thread that maybe should not be there.