Need an Opinion reddit / selfhosted ---------------------------------------------------------------------- boop_xyz · 2023-10-03 17:32 I’ve bought a home lab computer to host game servers and I’m now thinking of returning it because a concern of mine is getting DDOS’ed so I have been researching but wanted to get confirmation from others if it’s feasible and realistic so I bought a VM from BuyVM and a DDOS protected ip, if I setup GRE tunnels and what not, will that protect my network from DDOS attacks without adding too much latency to my servers? If anyone can give me advice or even help me set up security, that’d be amazing ---------------------------------------------------------------------- JumpingCoconutMonkey · 2023-10-03 17:44 Serious question: Who cares enough about your gaming server to want to DDoS you? Does this happen often in real life? ---------------------------------------------------------------------- boop_xyz · 2023-10-03 17:47 This is a common response that I see a lot and I’m not looking for responses like these. I want advice and help not a theoretical question that I can tell myself until I piss a player off and he pays his buddy to DDOS me and I lose my plan with my ISP. I’m trying to be as safe as possible. ---------------------------------------------------------------------- JumpingCoconutMonkey · 2023-10-03 17:51 Valid. The subdomains I run through Cloudflare are proxied, and there is some kind of DDoS mode that you can activate, but I've never had any reason to use it. ---------------------------------------------------------------------- boop_xyz · 2023-10-03 17:52 Is that used for web hosting? ---------------------------------------------------------------------- JumpingCoconutMonkey · 2023-10-03 17:54 I use subdomains for any services I need to be available, and I did have a minecraft server going for a bit. ---------------------------------------------------------------------- boop_xyz · 2023-10-03 17:56 The reason I ask is I’m not sure how to setup cloudflare to work with my game server. I was reading it can add a ton of latency but I’ll see ---------------------------------------------------------------------- Majiir · 2023-10-03 17:57 Thread title: "Need an Opinion" _No, not like that!_ ---------------------------------------------------------------------- boop_xyz · 2023-10-03 17:58 I took his opinion and gave a response to it, ---------------------------------------------------------------------- JumpingCoconutMonkey · 2023-10-03 18:00 Looking into it a bit, game server hosting doesn't seem to work on cloudflares's free tier. I must have not used the proxy when I did mine. Sorry to run you down the wrong path. ---------------------------------------------------------------------- Yoshe1101 · 2023-10-03 18:19 Hi, I’m probably not the most experienced person on this topic but I hope I can help you somehow. The simplest way to avoid DDoS attacks that comes to my mind is configuring an ACL or whitlisting the IPs from where you are connecting or simply connecting to the server using a VPN. If you want to open your sever to the internet not losing performance and not using external solutions you could start by implementing firewall at a server level with iptables(Linux) rules for example, filtering the traffic and applying some rule to prevent the attacks. If you want a dedicated user friendly service you can use to monitor actively DDoS attacks you can use CloudFlare for example, but that would imply to proxy your traffic to hide your source IP and that would affect your performance. I hope this could help! ---------------------------------------------------------------------- Perfect_Designer4885 · 2023-10-03 19:02 Any serious DDoS is highly unlikely because there will be no financial gain for attacking your server. Some firewall rules to block IP addresses from countries where you have no one using it will help, along with dropping malformed packets and some other things that I cannot remember will keep out the script kiddies, fail2ban can also be used to automatically create firewall rules for persistent offenders based on log information like wrong user name and password, or any other event logged by the firewall, server and everything in between. So go for it and good luck ---------------------------------------------------------------------- jerwong · 2023-10-03 19:35 I've worked in environments where we've needed to scale and I've dealt with DDoS before when our customers got targeted. If you're on a residential connection, it's unlikely you could do much to deal with an actual DDoS yourself because you simply don't have the bandwidth regardless of how much hardware you own. DDoS mitigation requires you to work with your peers/ISP to identify and reduce the traffic before it gets to your network. Yes, you can purchase DDoS mitigation services from another provider. You're essentially relying on their resources to protect you. Adding a GRE or any sort of tunnel is going to add latency as well as extra hops to whomever the remote provider is. Honestly, I would just run your servers and not worry about it. If it turns out you're getting DDoS'd, you can deal with it then. ---------------------------------------------------------------------- ecker00 · 2023-10-03 20:11 I spoke with someone running a hosting company, they deal with DDOS all the time and they did say that fame servers usually are the ones which it happens to. But question then is why? It's because you've invited people with bad temper or griefing, they loose a fight and call for mommy's credit card to take down the server with a DDOS service. – I don't know what drives gamers to do it, but it has intention. But if you host a game server for friends and not publicly share it online, there is no reason anyone would discover or want to target your game server. Even if it were to happen, DDOS is a temporary issue which doesn't have any negative impact other than downtime while it's happening. It's like when thousands of people go protesting in the streets, but you are just trying to drive to work, road is blocked. It requires resources to maintain the attack. Don't let that stop you from self hosting. Mitigating DDOS requires datacenter equipment as far as I know. ---------------------------------------------------------------------- lilolalu · 2023-10-03 20:31 How are DDoS attacks used for financial gain? It's not hacking a service but disabling a service... ---------------------------------------------------------------------- WraytheZ · 2023-10-03 20:45 This only works for HTTP/S stuff. Not TCP/UDP games etc ---------------------------------------------------------------------- WraytheZ · 2023-10-03 20:47 Just a pointer. ACLs will do nothing to a DDOS or a DOS. By that point the traffic is already at your door ---------------------------------------------------------------------- thesnizzles · 2023-10-03 20:52 I have a similar setup but instead of Cloudflare GRE I'm using Wireguard point to point connections between my VPS and homelab server. Whether or not it can successfully survive a DDOS attack is yet to be seen (probably not), but if it does crap out I can just kill the VPN and my home internet should be safe. ---------------------------------------------------------------------- netvip3r · 2023-10-03 21:21 I wouldn't worry much about self-hosting your group's private game servers. I would more likely worry about the available bandwidth available to you from a residential connection. If instead you're looking to host a public server, then yea, I would consider a host or vps for their bandwidth. In any case, to DDoS someone takes some trivial effort via non-trivial means. Proper firewall rules and restrictions will do more than half of the job. You can still be DDoS'd as long as you have 'some' service that can be accessed, but to be fair, unless you bring in someone into your network, you're an insignificant needle in a very big haystack. ---------------------------------------------------------------------- naffhouse · 2023-10-03 21:53 To take a competing server offline? No one is going to ddos this guys mine craft server. ---------------------------------------------------------------------- t1nk3rz · 2023-10-03 22:06 Why not just install crowdsec + crowdsec bouncer so it works like a ips to block DDoS attacks,its free. ---------------------------------------------------------------------- JumpingCoconutMonkey · 2023-10-03 22:23 Yep. I did finally realize that. Explains why my Ark server was never publicly accessible.. ---------------------------------------------------------------------- CC-5576-03 · 2023-10-03 23:15 The best protection is a whitelist. Don't let these kinds of people onto your server. If you want to host a public server then use a hosting provider or a vps. ---------------------------------------------------------------------- Wdrussell1 · 2023-10-03 23:16 You won't be DDOSed. No one cares about your server enough to DDOS you. ---------------------------------------------------------------------- angelflames1337 · 2023-10-04 00:07 “I’ve bought PS5, now thinking of returning it for the fear of getting it stolen or robbed.” Thats how ridiculous this sounds. I port forwarded my computer directly to internet to serve minecraft for years and nothing ever happened, and even if something did worst case scenario I just have to restore it from backup. Just make sure machine that got exposed doesnt have way back to your local home stuff in case its compromised. ---------------------------------------------------------------------- noxiouskarn · 2023-10-04 00:53 I run wireguard an only opened one port on my router. To get in my players get sent an encrypted tunnel config file to join the network. And that network is separate from my main network. No one's had issues with latency. As far as being targeted for ddos you can be ddosd playing someone else's server as soon as your static IP is discovered it's like having your address and sending junk mail to your inbox. Easy work for a simple bot net. ---------------------------------------------------------------------- acid_etched · 2023-10-04 01:41 You are not going to get DDOSed. Not to be a dick, but what makes you think the server is going to be popular enough for someone to do that? If it’s just for friends, then you know who will cause problems (and therefore who to not provide the IP with). If it’s public, there’s basically no reason to host it at home. Most people that get banned aren’t going to bother “calling up their ddos buddy” as you put it, they’ll just switch to one of their alt accounts and hop back on. ---------------------------------------------------------------------- lilolalu · 2023-10-04 05:29 I am sure no one will. But DDoS as a means ofeconomic sabotage is equally unlikely. ---------------------------------------------------------------------- kearkan · 2023-10-04 12:00 If you're only opening it to your friends and they pay to DDoS you, you need better friends. I know you don't want to hear it for whatever reason but unless your server gets so big that it starts making news articles and you attract trolls, you won't get DDoS'd. And if you get that big there are multiple other reasons you probably shouldn't be hosting it at home.