{"id":159,"date":"2019-11-02T05:13:00","date_gmt":"2019-11-02T10:13:00","guid":{"rendered":"http:\/\/127.0.0.1:8080\/?p=159"},"modified":"2024-01-13T14:04:50","modified_gmt":"2024-01-13T19:04:50","slug":"how-to-use-ovh-as-an-anti-ddos-provider","status":"publish","type":"post","link":"http:\/\/10.42.0.68:8080\/blog\/how-to-use-ovh-as-an-anti-ddos-provider","title":{"rendered":"How to use OVH as an anti-DDOS provider?"},"content":{"rendered":"\n<p>It&#8217;s a very strange use but sometimes, it can save time and money.<\/p>\n\n\n\n<!--more-->\n\n\n\n<h1 class=\"wp-block-heading\">The big picture about the attack<\/h1>\n\n\n\n<p>You&#8217;ve few dedicated servers (not OVH) and you&#8217;ve DDOS attacks.<br>Firstly, you call your provider and pay for anti-DDOS protection but it&#8217;s inaccurate.<br>What can you do?<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">OVH to clean ingress<\/h1>\n\n\n\n<p>It&#8217;s extraordinary, but OVH has 2 anti-DDOS technologies that work very well: Arbor Networks &amp; Tilera.<br>This combo is the most powerful to kill DDOS.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What can we do?<\/h2>\n\n\n\n<p>It&#8217;s a strange but working solution :<\/p>\n\n\n\n<ul>\n<li>We move all DNS entries (toto.domain.tld) to OVH IP<\/li>\n\n\n\n<li>Iptables will route input traffic to your dedicated server (not OVH)<\/li>\n\n\n\n<li>the client receives a reply directly from the dedicated server (not OVH)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Action!<\/h2>\n\n\n\n<p>We need to activate IP Forwarding<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Sysctl<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sysctl -w net.ipv4.ip_forward=1\necho \"net.ipv4_forward=1\" &gt; \/etc\/sysctl.d\/forwarding.conf<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Output<\/h4>\n\n\n\n<p>Now, it&#8217;s time to do MASQUERADING for output traffic<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>iptables -t nat -A POSTROUTING -o eno1 -j MASQUERADE<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Input<\/h3>\n\n\n\n<p>It&#8217;s where we do magic<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>iptables -t nat -A PREROUTING -d IP_OVH -j DNAT --to-destination IP_NOT_OVH<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Persistent<\/h4>\n\n\n\n<p>We need that iptables rules to survive after a reboot<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt-get install iptables-persistent -y<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p>It&#8217;s not a magic solution but can help in some way. In addition, don&#8217;t forget to harden your kernel and other configurations to survive.<\/p>\n\n\n\n<p>You can be interested by : <a href=\"\/migration-to-nftables-from-ipset-and-bogons\/\">Migration to nftables : from ipset and bogons<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>It&#8217;s a very strange use but sometimes, it can save time and money.<\/p>\n","protected":false},"author":1,"featured_media":79,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"saved_in_kubio":false,"footnotes":""},"categories":[9],"tags":[10],"_links":{"self":[{"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/posts\/159"}],"collection":[{"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/comments?post=159"}],"version-history":[{"count":1,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/posts\/159\/revisions"}],"predecessor-version":[{"id":160,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/posts\/159\/revisions\/160"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/media\/79"}],"wp:attachment":[{"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/media?parent=159"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/categories?post=159"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/tags?post=159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}