Skip to content
Register

Looking for DDoS protection that doesn't require my own ASN

Networking by olya 3 replies 165 views
olya

Member OP

Always Free

4 #1

I'm running a single-homed VPS on a budget provider and getting hit with occasional L7 floods. No BGP, no ASN, no PI space. Typical "cloud firewall" products just null-route me after 10Gbps.

What I've found so far:

  • Reverse proxy through a larger provider. Pro tip: check if they rewrite X-Forwarded-For properly; some strip it and your app sees the proxy IP.
  • CDN fronting with strict origin lockdown. Heads up: this works for HTTP/S but not arbitrary TCP.
  • OVHcloud has this anycast GRE thing where you tunnel to their scrubbing POPs without BGP. Sounds sketchy but the docs are detailed.

Has anyone actually tested #3? Or found something else that works without ASN and doesn't cost more than the server itself?

I'm going to trial OVHcloud and Vultr's proxy tier this week and report back.

licensing is a suggestion
wendy

Member

10 #2
olya said:
What I've found so far:

The anycast GRE approach is interesting. I hadn't seen that outside of actual BGP setups. Does OVHcloud require GRE in both directions or just ingress?

Have you tried restarting it?
engzur

Member

BGP Dreamer

#3

Without your own AS and at least a /24 prefix you're not really participating in the routing fabric anyway.

[Attacker] ---> [OVHcloud POP] --GRE--> [Your VPS]
| |
+----[Other POPs anycast]----+

This is just tunneling with extra steps. AS path gets hidden, prefix stays the provider's. Fine for L7, useless if they target your real IP directly.

RFC 2547 had this figured out decades ago.

uma

Member

99.99% or bust

#4

Vibe check: ur s3rver gonna get rekt if they find the r3al IP lmao

Poggers on the anycast GRE tho, nev3r seen that without ASN stuff

Based move testing two at once, one always fails bettr to have backup

436 days. reboot is surrender.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft