Self Hosted - Self-hosting your services.

11419 readers

1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules

No harassment
crossposts from c/Open Source & c/docker & related may be allowed, depending on context
Video Promoting is allowed if is within the topic.
No spamming.
Stay friendly.
Follow the lemmy.ml instance rules.
Tag your post. (Read under)

Important

Beginning of January 1st 2024 this rule WILL be enforced. Posts that are not tagged will be warned and if not fixed within 24h then removed!

Lemmy doesn't have tags yet, so mark it with [Question], [Help], [Project], [Other], [Promoting] or other you may think is appropriate.

Cross-posting

[email protected] is allowed!
[email protected] is allowed!
[email protected] is allowed!
[email protected] is allowed if topic has to do with selfhosting.
[email protected] is allowed!

If you see a rule-breaker please DM the mods!

founded 3 years ago

MODERATORS

[email protected]

[Question] Preventing DDoS (lemmy.ml)

submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]

10 comments fedilink hide all child comments

I self host all of my services but utilize a VPS as a gateway for access. Primarily to allow access to a media server and file storage for friends and family.

Recently I’ve been shut down by my VPS provider on multiple occasions because they claim my server was DDoS’d at 2gigabits/s. I don’t see any evidence of this in my logs.

Regardless, I set up Traefik proxy to geoblock any IPs outside of my country. Literally a few mins after doing so and confirming via VPN that it was working I got shut down and received an email that my network was severed temporarily due to a DDoS Blackhole event.

The questionable nature of their detection system aside, it’s got me wondering…does ip blocking actually help mitigate DDoS attacks?

The server still needs to process the incoming connection before it filters it, so I’m assuming the attack is still accomplishing it’s intent which is to overload the server. Can somebody more knowledgeable provide some insight?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 5 points 1 year ago (1 children)

Blocking doesn't really help with DDOS, since the traffic is still hitting the server and from the standpoint of the VPS provider it doesn't look much different.

Some VPS providers offer DDOS protection as an addon, but just moving to a different provider might solve it. If you're just hosting stuff for friends/family it doesn't seem like there would be much reason to DDOS your IP, unless the IP was recycled from something before that people are still attacking.

[–] [email protected] 1 points 1 year ago

I’ve had the IP for a couple of years so I can rule that out. The only thing different than usual is I recently added a backup server to the VPS network. I’ve been doing a remote backup from one server through the VPS to the backup server over the past week. It’s a 4TB backup averaging 4MBps.

My guess is that the VPS provider’s algorithm is bungling the bandwidth calculations, possibly refreshing the bandwidth amount incorrectly which to the black hole detector appears as a sudden spike in bandwidth rather than a steady flow.

I’m going to keep running the backup and compare how long after the backup starts that I get a black hole trigger. If it’s relatively consistent then that might be the problem.