Member
HEX S, 256MB. Like I said, real attack would melt it. The script just announces a blackhole route to the VPS upstream. Works because Time4VPS (https://www.time4vps.com) gives me a /64 and I can null-route individual addresses. For 2Gbps of UDP garbage it was fine. For anything sustained the CPU gives up.
Member
I run small hosting in Hanoi. Upstream scrubbing through Vultr Singapore. Price is okay but the filtering is aggressive. Had a customer running a game server, legitimate traffic got tagged as attack because UDP packet size pattern. Took three tickets to whitelist. Cloud proxy is too expensive for my customers. Most are on $10-15 plans.
They did cry. In all caps. Then they threatened to "expose us on Twitter." I sent them the AUP again and closed the ticket. The $5 plan is KVM with 1 vCPU and 1GB RAM on a node in Los Angeles. What exactly did they think was going to happen.
Member
This matches my experience. I asked RackNerd support directly last year. The answer was "we filter L3/L4, L7 is your responsibility." I keep a Vultr proxy config ready but only activate it when needed. The 18ms hurts but it is better than rewriting the application.
Self-hosting from Lisbon on a Contabo VPS in Nuremberg. Their DDoS protection is basically "we might help if it is big enough." I have been null-routed twice. Both times the attack was under 5Gbps. Now I keep a cheap Vultr instance as a reverse proxy for the important stuff. The rest can die.
Auckland to anywhere is already 150ms minimum. I do not notice another 20ms from a cloud proxy. I run upstream scrubbing through my provider plus Cloudflare always-on for a few public services. The real problem is DNS failover. By the time TTL expires the attack has moved on anyway.
This is drifting into provider-specific support territory. Keep it general or move to the RackNerd thread in Providers.
Member
How do you activate it? DNS flip or BGP announcement? I have been doing DNS but the propagation delay is painful. Considering Anycast but that is another layer of complexity and another bill.
Member
DNS with 60 second TTL. Not great. I have a script that updates the record through Vultr API and purges my origin cache. Still takes 30-90 seconds. For true automatic failover I would need something like Healthchecks.io triggering it, but then you get false positives. There is no clean answer.
Following this. I am on HostHatch Stockholm with their included protection. Never tested it, never needed it. Knock wood.
