The gap is about 40 hours of reading and a few incidents like Wendy's. Most people skip the reading.
I ran my own recursive resolver and learned why I shouldn't
Same.
Has anyone tried using BGP communities with their provider to handle DDoS instead of null-routing? My upstream offers RTBH but I don't understand the configuration. Looking for examples.
MeowNail3 said:
Has anyone tried using BGP communities
RTBH requires your own ASN and BGP session to your provider. On a €40 OVHcloud VPS you have neither. You are a static route in their aggregation layer. The null-route is the only tool they have.
If you want RTBH you need:
- Your own ASN (€50-100/year plus RIPE membership or sponsor)
- PI IPv4 space (scarce, expensive) or IPv6
- A provider that offers BGP sessions on virtual machines (very few do at low cost)
- Knowledge of how to announce and withdraw properly
This is not a VPS hobby. This is network engineering.
iBGP, eBGP, don't care, just peer
pieter_rtm
Member
MeowNail3 said:
Has anyone tried using BGP communities
What George said. I have RTBH at work because we have our own /22 and two upstreams. At home I have a Vultr VM and dreams. The economics don't work until you're spending real money on transit anyway.
Containers before it was cool
In China the situation is different. We have the GFW, DNS poisoning is routine, running your own resolver to 8.8.8.8 is often blocked or tampered. People use DNS-over-HTTPS to outside, or just accept the local resolver. The security model is completely different.
I ran my own resolver for the learning. Learned I shouldn't. Now I pay Cloudflare and I learn other things. The time I spent on DNS is now spent on Kubernetes, which is also a mistake, but a different one.
This thread is why I recommend Pi-hole to friends but always, always configure it to forward to 1.1.1.1 or Quad9. Never recurse. The open internet is not a safe place for hobbyist infrastructure.
What about running a resolver only over IPv6? The address space is larger, scanning is harder, maybe less abuse?
MateiDot said:
What about running a resolver only over IPv6?
Scanning is harder but not hard. Shodan has had IPv6 coverage for years. The abuse tools have adapted. The real issue is that IPv6-only services are unreachable to IPv4-only clients, which is still most of the internet. You would need dual-stack, and now you have two attack surfaces.
iBGP, eBGP, don't care, just peer