I did, mentioned above. Their protection works but the scrubbing is aggressive. Websockets die, some UDP protocols get mangled, you get an email saying "attack mitigated" and then you spend two hours figuring out what broke.
For HTTP/S it is fine. For anything real-time or gaming, budget for the debugging time.
This is the gap in pieter_rtm's test and I say that with respect. Controlled lab traffic is not shaped like real attack traffic. A SYN flood is easy to filter. A slowloris or a layer 7 mix is where "protection" either works or becomes the problem itself.
Still the best test I have seen on this board. Just noting the limitation.
Member OP
Agreed completely. My test was layer 3/4 only. I do not have a botnet for layer 7 simulation and I am not using public stressers for obvious reasons. The test answers "does the pipe exist" not "does the WAF survive."
Next phase if I find time: scripted slowloris against the same targets, measure TTFB degradation. But that is a different thread.
Member
I find best price for you my friend but I do not find best DDoS protection for you. This thread is very educational.
I have many customers in Turkey asking for "cheap server with strong protection." I send them to Hetzner now — https://www.hetzner.com/cloud. Before I send them to whoever had affiliate commission highest. I am not proud. This thread makes me less not proud.
Vultr with add-on is also good option but $13 total is not "budget" for my customers. Hetzner €4.51 is real budget with real protection.
Converting for my spreadsheet: Hetzner CX11 = €4.51 = ~$6.60 CAD. Vultr smallest + protection = $10 + $10 = $20 CAD. For a Canadian small operator that is the difference between "experiment" and "commitment."
Hetzner's Ashburn location is 70ms from Vancouver. Not amazing but acceptable. I am moving two personal projects there this weekend.
Pieter_rtm: still waiting on those pcaps. No pressure.
