(2017-01-11, 06:21 PM)eaportela Wrote: Instead of creating another thread on the same subject, I figured I'd ask my question here.
I use Globat.com as my web host, and today I received a threat from a source that they were going to launch a DDoS attack on my forums. There's a chance that this guy might have been bluffing, but other than regularly backing up my forum, how can I implement DDoS protection on my forums? Globat.com wanted to charge me thousands of dollars through their SiteLock services and it seemed a bit much.
I have to admit, I'm new to this and I don't have much knowledge on the subject other than backing up things constantly, which I do. I also host several forums for other friends and I wouldn't want to see them targeted either.
How could I go about this? I would appreciate any and all advice, I'm definitely willing to learn. Thank you.
People who make threats have the generally have the full ability to do this. The most important thing you can do is to have enough protection on your site to block off the attacks and to ensure that they'll try larger attacks and end up getting caught.
For the Minecraft Server you'll need to find a DDoS mitigation provider who has L4 DDoS Protection. If I recall correctly a paid plan with Incapsula (the Business plan, $299/month). However DDoS Protection for websites is a lot cheaper.
Don't use Cloudflare unless you either have a paid plan or further filtering behind it. I would recommend WebDeflect for DDoS Protection, their free plan is great, and their paid plans are low cost, the most expensive plan is just $20/month. Cloudflare alone is very easy to bypass, only a plan with their Web Application Firewall will be effective at mitigating DDoS Attacks (well they have a beta program for rate limiting but you have to be accepted, my site uses it, against support policy so I will not link to it) For smaller layer7 attacks (on a good server under 1m req/s, more if you iptables block the sources) on websites,
One thing to note is that nginx can be configured to block them off without too many issues.
If you don't want to pay huge fees for layer4 protection consider getting a server host who has DDoS Protection a few notable providers are Voxility (expensive), BlazingFast, and OVH.
Let us know if you have further questions
This user has been denied support.
