Skip to content
Register

Looking for dDoS mitigation that works on sub-$10 VPS

Networking Locked by adam20 24 replies 2.7K views
This thread is locked — new replies are not accepted. (Duplicate — see the earlier thread on this)
adam20

Member OP

Ex-Abuse Desk

#1

Looking for DDoS mitigation that works on sub-€10 VPS. Currently on Contabo's 512MB plan. Getting null-routed within 90 seconds of any spike over 2Gbps. The ticket said "please upgrade to business tier" which is $89. Not happening.

Tried Vultr's free tier as a reverse proxy but their abuse pipeline flagged me for "excessive bandwidth utilization" during a 300Mbps test. The ticket said I was "stress testing their infrastructure." I was testing my own origin.

Requirements: HTTP/S only, don't care about UDP. Need something that survives at least a 5Gbps volumetric without the upstream pulling the rug.

Anyone actually solved this on ramen budget?

reported. resolved. repeat.
StuSpock

Member

NTP fundamentalist

11 #2

Contabo's nullroute is sweet as for their margins, not yours though?

Chur for the ticket story, had similar with OVHcloud once, their abuse bot is proper sensitive aye?

What if you chain the free tiers mate? Oracle into Vultr into your origin? Spread the pain?

AlexWei

Member

Singapore

#3 
HOST: oracle-tier1              Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- 192.0.2.1                0.0%    10    0.4   0.5   0.3   0.8   0.1
  2.|-- 203.0.113.45 (AS31898)   0.0%    10   12.1  14.3  11.9  28.4   4.9
  3.|-- Vultr-edge            0.0%    10   34.2  35.1  33.8  41.2   2.1
  4.|-- origin.Contabo         0.0%    10   56.7  58.4  55.3  67.8   3.7

Peer better. 56ms added. Acceptable for HTTP.

| hop | provider | tier | bandwidth |
|-----|----------|------|-----------|
| 1 | Oracle | always-free | 10TB/mo |
| 2 | Vultr | free | 100GB/mo |
| 3 | Hetzner | trial | 500GB/mo |
| 4 | RackNerd | free static | unmetered |
| 5 | origin | $10 | target |

Five tiers. Each sees 20% of attack volume if attacker doesn't follow redirects. AS31898 scrubs at edge. Not elegant. Functional.

dadlime

Member

stable > testing

#4

I ran a similar stack for a hobby MX (don't ask). The latency is punishing but the architecture has merit. Oracle's free tier is surprisingly stable if you stay under their radar. They haven't automated abuse for bandwidth, only for CPU pegging.

The real trick is DNS failover between chains so you're not single-homed on one free provider's mood. I used three parallel chains with 30-second TTLs. Semicolons matter in BIND config, by the way, and most tutorials get them wrong.

One caveat: Vultr's trial converts to paid silently after 14 days. Set a calendar reminder (like this) or you'll fund someone's yacht.

JA

Member

#5

Five tiers is wild but I respect the chaos

PR

Member

#6

Has anyone tried Cloudflare's free plan for this? I know it's not a VPS but for HTTP/S only it handles the DDoS and you keep your cheap origin.

adam20

Member OP

Ex-Abuse Desk

#7
Pro25 said:
Cloudflare's free plan

TOS Section 2.8: "excessive non-HTML traffic" and they can terminate without notice. For a site that actually gets attacked, they move you to paid fast. Seen it from the desk. https://www.cloudflare.com

reported. resolved. repeat.
Lou1

Member

#8

We use Cloudflare Pro on the SaaS. $20/mo, but that's the whole budget here. The free plan is fine until it isn't, and then you have zero leverage.

StuSpock

Member

NTP fundamentalist

#9
adam20 said:
TOS Section 2.8

Chur, ex-abuse desk dropping the real knowledge aye? What about BunnyCDN then? Pay-as-you-go, no monthly.

AlexWei

Member

Singapore

#10

BunnyCDN is pull-only. For DDoS you need the origin hidden, which means reverse proxy or DNS-only. Their edge is fast but the architecture is wrong for this.

Thread closed

Replies are closed on this thread. Duplicate — see the earlier thread on this.