Alternatives to cloudflare WAF and access reddit / selfhosted ---------------------------------------------------------------------- ggvicknotfound · 2023-11-23 15:34 Hello! I’m kinda new self hosting things and was target to a ddos attack a few days ago. It completely melted my cheap vps sadly and nginx proxy manager did nothing to help against it. I switched to cloudflare a day ago and like it but I’m just not sure I completely trust them with my data, but it looks like my only option right now. I really like the robust WAF features and cloudflare access makes it very easy and painless to access my private services. I’m definitely ready to switch from cloudflare thought due to privacy concerns. I’m wondering if there is a self hosted alternative to cloudflare that can do the same things. I would prefer something with a gui so it can be very simple for me to fully set up on my server instead of sitting in a terminal for hours not knowing what to do. Thanks in advance! ---------------------------------------------------------------------- StefanMcL-Pulseway2 · 2023-11-23 16:03 Sorry to hear about the DDos attack! Looking for a open-source alternative that has similar range to Cloudfare is a bit tough butt maybe take a look at ModSecurity, it's open-source, cross platform WAF and it can be used with a bunch of other web servers like Apache and Nginx. You might also want to look into Pfsense, it's an open source firewall router that has other features like VPN, it can also be used to set up a WAF ---------------------------------------------------------------------- ggvicknotfound · 2023-11-23 16:44 Oh wow thank you! I will definitely look into that! ---------------------------------------------------------------------- hslatman · 2023-11-23 17:43 Have a look at CrowdSec: https://www.crowdsec.net/. It’s not a full WAF solution, but does offer the capability to block IPs automatically based on local log analysis and scenarios, as well as IPs sourced from the community. They refer to it as a “multi-player fail2ban”, and is suitable to fend of DDoS attacks. ---------------------------------------------------------------------- Deadlydragon218 · 2023-11-24 02:43 CrowdSec by itself can not truly fend off a DDoS attack. DDoS attacks exhaust your network infrastructure with immense amounts of bandwidth. Doesnt matter if you block the traffic or not the traffic is still being sent to your network using up bandwidth. Large scale DDoS attacks exhaust physical infrastructure and require some heavy duty kit to mitigate and a large network pipe. ---------------------------------------------------------------------- hslatman · 2023-11-24 08:01 I don’t disagree; it all depends on the kind and size of the DDoS. But on a VPS, owned and operated by a random person on the internet, you probably don’t get the worlds biggest L3/4 DDoS attack targeted at you, generally speaking. CrowdSec allows you to block off IPs earlier in the stack than the application layer, so I still think it’s an option to consider. ---------------------------------------------------------------------- Deadlydragon218 · 2023-11-24 22:33 Thats true, but amplification attacks do exist. Which do allow for lower barrier to entry DDoS attacks. The internet is a fun and dangerous place gotta love it lol