Hacker News Reader

Comment by netcoyote | Hacker News Reader

One of the things I'm immensely curious about is how you handle security/networking/firewalls when working with Hetzner or other bare metal providers? It seems they don't provide network gear for firewalls and to protect against DDOS attacks?

Do you just use iptables? Or do you build out more complex solutions like software routers running on Linux/BSD?

I work in online gaming, and we're constantly seeing attacks on our infra.

View on HN

Hey! I also make games and we solved the issue by doing stateless ACLs on the border switches and having a really fat pipe.

You can add a magic header to traffic and drop anything that doesn’t contain the header.

Since this is done in hardware it operates at line speed. In our case 100GBit/s.

This seems such a good trick. We could even do it at cloudflare rule level I guess.

If you have zero-cost internal network costs, I'd consider adding another server in front of the primary servers to act as a reverse-proxy and/or firewall. Basically, you'd use that server as a firewall and then pass only the good traffic onwards to your game servers, which are probably bigger and more expensive.

If there isn't a possibility for internal-networking (free), then I'd probably use the included iptables for a firewall on each machine. You should honestly have this running on the game servers anyway, if only to restrict communication to between the reverse-proxy and game server.

Hetzner has some built in DDOS protection but you should add your own:

https://www.hetzner.com/unternehmen/ddos-schutz

Reply on news.ycombinator.com