Skip to content
Register

Successfully defended against my first DDoS on budget hosting

Reviews Locked by harbourops 13 replies 2.8K views
This thread is locked — new replies are not accepted. (Duplicate — see the earlier thread on this)
harbourops

Member OP

3 #1

On July 7, 2025, Hetzner successfully mitigated a sustained volumetric attack against a client deployment without service degradation. The event peaked at 187 Gbps / 52 Mpps.

Our protection layer performed as follows:

  • Automatic detection at 3-second threshold
  • Scrubbing activated with zero manual intervention
  • Clean traffic forwarded over existing GRE tunnel
  • No null-routing or upstream blackholing occurred
  • Client remained unaware during peak

The deployment in question:

  • Single VCPU, 2 GB RAM
  • 1 TB monthly transfer
  • Standard DDoS protection included at no additional cost

I do not advertise scrubbing capacity publicly. The protection exceeded my own internal expectations for this price tier. Configuration details available upon request for verified clients.

I'm a customer running about thirty client sites out of Amsterdam.

nate_pad

Member

5 #2

Wow thats amazing!! Sorry total noob here but how do you even set up GRE tunnel?? I thought that was only for big companies. Also what is Mpps sorry if dumb question

lee_mcr

Member

#3

187gbps on a 1tb transfer plan? Thats a steal if the protection is actually included. Whats the deal on overages though. Seen "free" ddos protection that bills $2 per gb scrubbed. No trial I hope?

Honey badger don't care... about downtime
FyreJun

Member

#4

Let us consider how many providers would have null-routed the IP within seconds. I apologize if my observation is unwelcome, but the lack of client awareness during the event speaks to engineering discipline. I am sorry for existing, yet I wished to express admiration.

LichunLars

Member

#5

What hardware runs the scrubbing layer? Curious about pps per core

1ms or I don't want it
harbourops

Member OP

#6
nate_pad said:
How do you even set up GRE tunnel??

GRE is just a tunnel protocol. Hetzner gives you a clean endpoint IP, you configure the tunnel on your side with any Linux box that supports it. I use a small VM as the tunnel endpoint, then forward clean traffic to the actual application server. Not exotic at all.

lee_mcr said:
Whats the deal on overages though.

No overage billing for scrubbed traffic. The 1 TB is your clean egress. Attack volume does not count against it. I would have mentioned otherwise.

LichunLars said:
What hardware runs the scrubbing layer?

I do not have visibility into that. I am a customer, not staff. What I can tell you is the detection-to-scrubbing latency was under three seconds consistently across the event window.

lee_mcr

Member

#7
harbourops said:
No overage billing for scrubbed traffic.

This is the part that matters. OVH used to bill scrubbed on some plans, though I think they stopped. Vultr definitely still has overage on transfer even if their "DDoS protection" kicks in. Good to know Hetzner draws the line cleanly.

Honey badger don't care... about downtime
LichunLars

Member

#8
harbourops said:
I do not have visibility into that

Fair. Was hoping someone had dug into published specs. Their Helsinki DC is close enough that I see ~16ms to the scrubbing path, which is fine for my use case. Was mostly curious if anyone had benchmarked pps before committing a game server project.

1ms or I don't want it
blubhyper

Member

type-2 trauma

#9

Nested virtualization trauma here too. Hetzner's cloud VMs are KVM-based so nested works if you enable it, but I would not run a GRE tunnel endpoint inside a nested VM unless you enjoy pain. Bare metal or at least first-level VM for the tunnel, always.

type-1 or go home
zoekyo

Member

Less Is More

#10

One small server, one quiet mind. Until someone decides your quiet mind needs 187 Gbps of attention.

rm -rf / --no-preserve-root ☯

Thread closed

Replies are closed on this thread. Duplicate — see the earlier thread on this.