if you can provide me a better way to keep my homelab from getting DDoSed every five minutes then by all means, please share it
Just put it behind a wireguard server and don’t expose any ports?
If you absolutely must expose some stuff, get a cheap 3$/mo vps that connects via wireguard to your home and setup a reverse proxy? They almost all come with DDoS protection.
Conservatives will get really upset once they realize you are changing genders
What’s a good VPS provider for privacy enthusiasts?
I use Hetzner. Its fine. Boring/10 would use it again I guess?
@DaPorkchop_@lemmy.ml @memes@lemmy.world Is that an actual issue or a hypothetical one? I’ve never had an attack in 10 years of publicly hosting stuff.
As someone else who used to host via an open port, you get random connections all the time. Almost constantly and the request paths make it obvious they are scanning for vulnerabilities. Via cloud flare the number of those requests is much lower, as they have to know at least the DNS to do so, (and can’t guess it from a presented SSL cert.)
Yeah, I see random https and other connections all the time blindly scanning for vulnerabilities. Not enough to cause any real problems though. One time I publicly exposed redis or rabbitmq (can’t remember which) and didn’t set a password, so someone set a password for me :). That’s about the worst that’s happened to me.
It’s the reason I set up cloudflare in the first place, so yeah. I was getting SYN flood-ed to the point that my router would just crash almost immediately, and after rebooting it the attack would resume after a minute or two.
@DaPorkchop_@lemmy.ml @memes@lemmy.world Hm weird, I don’t see why they would spend their resources attacking random people without any kind of demand. Even at work I’ve never seen one happening.
I still believe Cloudflare has most of its customers because of fearmongering tbh.It’s a bit like saying “having a password on your account is fearmongering, why would anyone try to access your data”.
It’s only fearmongering until you get attacked, and it’s already too late when you do. Better to be proactive.
@Alaknar@sopuli.xyz @memes@lemmy.world Being proactive doesn’t mean you have to hide your personal service behind a billion dollar company. That is precisely the kind of overreaction triggered by fearmongering. If you don’t know how to secure access points or harden configurations, no service will be able to do it for you as if by magic. Not to mention your responsibility towards your users, who may not want to be tracked by a third-party company without their knowledge every time they visit your site (or half of the internet by now).
If you don’t know how to secure access points or harden configurations, no service will be able to do it for you as if by magic
That’s the point. Cloudflare does this as if by magic.
Not to mention your responsibility towards your users, who may not want to be tracked by a third-party company
Cloudflare doesn’t track your users.
As a sidenote - am I reading you correctly? Your main issue with Cloudflare is “they’re large”? Like, if they were “two dudes in a basement” and provided the same quality product as they do now, you’d be happy to use their service?
Get a router that has flood protection? This is like… Extremely basic network protection.
OpenWRT has had configurable syn-flood protection (enabled by default) since like 2010.
Even if the SYN packets were being ignored, the connection would still be unusable if there’s enough incoming traffic for most legitimate packets to get dropped. And as mentioned in other comments, the router in question is a shitty ISP router which can’t be replaced (although I do have a much fancier router with OpenWRT running behind that).
You don’t need Cloudflare.
That doesn’t help against a SYN flood.
From what I understand elsewhere in the thread, I believe that’s just a matter of router configuration.
Awesome project, but that’s just one of many features CF offers. Most people I suspect rely on tunnels more than bot protection.
Is you homelab getting ddosed constantly?
I had had it for years and never ever got ddosed.
Are you sure it’s actually ddos and not just the typical bots scanning for vulnerabilities? Which are easy defended for by keeping updated.
It’s weird as a DDOS is not something that’s just happens, it’s a targeted attack. It’s a rare occurrence that someone decided to attack a homelab.
I spent multiple days getting SYN flooded to the point my router would crash and reboot over and over, and it stopped the moment I set up cloudflare and asked my ISP to change my IP. This was the instance which pushed me over the edge, but there had been smaller attacks lasting a few minutes each for years leading up to this.
What kind of router to you have? A good router should not crash from any amount WAN traffic. But yes, if you host anything you will get scanned even harder than usual.
A shitty ISP-supplied modem/router which I have to use :|
Where are you? I bet there’s at least a few local ISPs that would allow you to use a user-supplied router.
There are better ISPs around, but my parents (who are the ones paying for it) don’t want to switch providers because… reasons? At any rate it isn’t happening any time soon, but once I move out I’ll finally be able to switch to Init7 and be done with it all :)
Maybe you can enable bridge mode on it? Then you could run something like opnsense behind it.
It’s only got a DMZ mode where I can configure it to forward all incoming traffic to my own router running behind it, but even in that mode it still has to NAT all the packets. IPv6 traffic seems to get forwarded along without much (if any) additional processing, but for hosting stuff publicly I would obviously need to expose IPv4 as well.
Anubis:3
Host your own cloud worthy anti DDOS solution with fail2ban /s
deleted by creator
fail2ban is good for preventing spam and DDOS on authenticated endpoints, but it’s harder to prevent attacks on public endpoints against a botnet or even a lazy proxy chain spam, which is why cloudflare adds some cookies and a buffer to handle a wave of new connections and maintain an address rank to drop any bad clients.
Although that being said, cloudflare can be bypassed via other timing tricks and even just using a specific request chain to get fresh cf cookies to avoid getting blocked.
There was a pretty bad CVE a while back I vaguely recall
deleted by creator
i dont understand why people hate cloudflare so much. Do they see the cloudflare logo when a server is down and assume its CFs fault?
Crowdsec+pangolin maybe? I would actually like to hear people’s thoughts on this.
If you didn’t piss off one of the big bot groups, then you have likely a configuration issue.
I deadass got a cloudflare error after reopening this post:
Don’t forget your SSL certificate to prevent man-in-the-middle attacks. 🤪
Don’t forget to have the SSL certificate supplied and managed by Cloudflare, of course 🤫
mTLS would solve your entire man in the middle problems.
cloudflare ddos protection is cetralization?
About 20% of global traffic is routed through Cloudflare so unfortunately Cloudflare is very much a massive case of centralization.
A Cloudflare outage would affect a huge number of websites and services and they have some degree of control over the way you host your and use their services.
Yeah, did people forget the last big Cloudflare outage already? A good chunk of all big services went down simultaneously. Discord, Amazon, Twitter and even the PS and Xbox consoles networks lmao.
How long before a website not behind something Cloudflare is considered suspicious or unwanted
Source? Or is this just fearmongering?
It’s definitely speculation, but I’d say it’s warranted.
The same thing applies when trying to sign up for a service without a big-name email address.
Isn’t it pretty easy to just disable cloudflare?
Yes, use a competitor at least.
Though I’m not a big fan of centralization, I use cloudflare. Their DDoS protection is unmatched, they have scraping protection, and just in case they decide to screw their users over, switching to another service is trivial.
deleted by creator
I mean I don’t really have a choice because i don’t see a better way to put my home server on a url because I live in a dorm and can’t port forward or get a static ip
If you don’t have a static IP, how did you get a domain?
That’s what they’re saying. They’re dependent on cloudflare who offer a DNS service that routes traffic to one of their static ips, down a tunnel initiated by the server without an IP address.
I’d like to know how to create a tunnel; do you have the docs? I need to host my home server and noip isn’t working for me.
Sure they’re here
I use cloudflares tunneling service cloud flared which allowes me to have the service running on my home server and then cloudflare will automatically make the subdomains point towards the ip
This is what I use: https://github.com/fosrl/pangolin
Creates a wireguard connection from your home server to a vps, which then exposes it to the public using a traefik reverse proxy.
I unfortunately use cloudflare. They apparently charge the same price they pay for domain names.
What better options do we have? I really want to know.
Removed by mod
I use Cloudflare Turnstile because hosting without it is just begging for bots to join my service.
Alright who actually ARE cloudflare? I’m seeing them on every website but idk who they are
Yeah well if it weren’t for all of the LLM bots and scrapers in general and of course all the Russian and Chinese hackers (they may mostly be script kitties, but they’re still annoying), we wouldn’t need cloud flare. But they do exist so we don’t really have a choice.
