Hacker News Reader

Comment by lossolo | Hacker News Reader

This can protect you from simple DoS attack by some script kiddie, not real DDoS attack. Just use CloudFlare or a provider that have active protections against DDoS attacks. Iptables will NOT help you with any real DDoS attack.

View on HN

A lot of CloudFlare is just iptables

Sure they have bigger "tubes" as well

https://blog.cloudflare.com/how-we-built-spectrum/

https://blog.cloudflare.com/how-to-drop-10-million-packets/

I think you overestimate what iptables can do and for what they are used today. Most of the DDoS filtering is done using XDP, BPF, not iptables. Articles you linked contradict your thesis. In first article they write there about iptables but they use XDP most of the time because it's a better/more efficient solution. In second article they are using iptables for routing, not preventing DDoS.

Bigger tubes is 99.9% of CloudFlare, that's why you can't build a competing business.

You can you build competing Cloudflare business if you are a tier one ISP. Other AntiDDos services exist like for example Akamai and Arbor networks.

https://www.esecurityplanet.com/products/top-ddos-vendors.ht...

Cloudflare also used to use Apache mod_security.

"Cloudflare WAF supports the OWASP ModSecurity Core Rule Set by default" https://www.cloudflare.com/waf/

On host mitigation usually works. Most attacks are small.

Iptables definetly can help with real ddos attacks.

> Iptables definetly can help with real ddos attacks.

Maybe we have different definitions of real DDoS attacks. What you mean is probably DoS attack, not DDoS (distributed).

If you have 1 gigabit pipe I can DoS (from one machine) you with 10 gigabit machine with ease and iptables will not help you at all.

Is there any other provider besides CloudFlare for DoS/DDoS protection?

Not free (actually, quite expensive imo), but one of my clients used Qrator. Don't know if it is any better or worse than CF.

OVH servers include a pretty efficient DDoS protection. It was the only option for hosting my online game servers that didn't cost tens of thousands.

Any of the CDN providers (eg Akamai) offer this. Cloud providers as well

Akamai has Prolexic...it is what kept GitHub up.

If you run your own BGP routers you can use Voxility, Incapsula or a number of similar services.

There are many others for example Imperva, Akamai and Verisign.

Reply on news.ycombinator.com