DDoS Protection With IPtables

Re:DDoS Protection With IPtables by lossolo on Sunday June 02, 2019 @10:05AM (#20075515)

This can protect you from simple DoS attack by some script kiddie, not real DDoS attack. Just use CloudFlare or a provider that have active protections against DDoS attacks. Iptables will NOT help you with any real DDoS attack.

[ Parent | on HN ]

Re:DDoS Protection With IPtables by mustardo on Sunday June 02, 2019 @10:31AM (#20075675)

A lot of CloudFlare is just iptables

Sure they have bigger "tubes" as well

https://blog.cloudflare.com/how-we-built-spectrum/

https://blog.cloudflare.com/how-to-drop-10-million-packets/

[ Parent | on HN ]

Re:DDoS Protection With IPtables by lossolo on Sunday June 02, 2019 @11:09AM (#20075930)

I think you overestimate what iptables can do and for what they are used today. Most of the DDoS filtering is done using XDP, BPF, not iptables. Articles you linked contradict your thesis. In first article they write there about iptables but they use XDP most of the time because it's a better/more efficient solution. In second article they are using iptables for routing, not preventing DDoS.

[ Parent | on HN ]

Re:DDoS Protection With IPtables by acd on Sunday June 02, 2019 @05:10PM (#20078225)

Cloudflare also used to use Apache mod_security.

"Cloudflare WAF supports the OWASP ModSecurity Core Rule Set by default" https://www.cloudflare.com/waf/

[ Parent | on HN ]

Re:DDoS Protection With IPtables by ycgeu on Sunday June 02, 2019 @01:09PM (#20076633)

Bigger tubes is 99.9% of CloudFlare, that's why you can't build a competing business.

[ Parent | on HN ]

Re:DDoS Protection With IPtables by acd on Sunday June 02, 2019 @05:19PM (#20078278)

You can you build competing Cloudflare business if you are a tier one ISP. Other AntiDDos services exist like for example Akamai and Arbor networks.

https://www.esecurityplanet.com/products/top-ddos-vendors.ht...

[ Parent | on HN ]

Re:DDoS Protection With IPtables by NightlyDev on Sunday June 02, 2019 @10:50AM (#20075781)

On host mitigation usually works. Most attacks are small.

Iptables definetly can help with real ddos attacks.

[ Parent | on HN ]

Re:DDoS Protection With IPtables by lossolo on Sunday June 02, 2019 @11:14AM (#20075966)

> Iptables definetly can help with real ddos attacks.

Maybe we have different definitions of real DDoS attacks. What you mean is probably DoS attack, not DDoS (distributed).

If you have 1 gigabit pipe I can DoS (from one machine) you with 10 gigabit machine with ease and iptables will not help you at all.

[ Parent | on HN ]

Re:DDoS Protection With IPtables by RobertRoberts on Sunday June 02, 2019 @10:29AM (#20075662)

Is there any other provider besides CloudFlare for DoS/DDoS protection?

[ Parent | on HN ]

Re:DDoS Protection With IPtables by Gluten on Sunday June 02, 2019 @10:50AM (#20075783)

OVH servers include a pretty efficient DDoS protection. It was the only option for hosting my online game servers that didn't cost tens of thousands.

[ Parent | on HN ]

Re:DDoS Protection With IPtables by Edmond on Sunday June 02, 2019 @11:26AM (#20076043)

Akamai has Prolexic...it is what kept GitHub up.

[ Parent | on HN ]

Re:DDoS Protection With IPtables by bearburger on Sunday June 02, 2019 @10:49AM (#20075778)

Not free (actually, quite expensive imo), but one of my clients used Qrator. Don't know if it is any better or worse than CF.

[ Parent | on HN ]

Re:DDoS Protection With IPtables by andrenth on Sunday June 02, 2019 @01:42PM (#20076863)

If you run your own BGP routers you can use Voxility, Incapsula or a number of similar services.

[ Parent | on HN ]

Re:DDoS Protection With IPtables by ce4 on Sunday June 02, 2019 @10:59AM (#20075857)

Any of the CDN providers (eg Akamai) offer this. Cloud providers as well

[ Parent | on HN ]

Re:DDoS Protection With IPtables by acd on Sunday June 02, 2019 @05:20PM (#20078286)

There are many others for example Imperva, Akamai and Verisign.

[ Parent | on HN ]