Vds server from ddos attacks. Methods to combat DDoS attacks
A DDoS attack is one of the most common types of Internet fraud, because not all attackers want to steal your money or take over personal information. Some of them are simply interested in interfering with the normal conduct of business and disrupting the normal operation of your website.
A DDoS attack is not a random attack - it is a carefully planned and coordinated set of actions aimed at making your web page inaccessible to users for some time. Research has shown that one third of all website downtime is due to DDoS attacks. This is a real threat to your resource, which can cost your reputation and provoke an outflow of visitors.
And even if your site is hosted on VPS hosting, you also cannot be sure that no one is attacking it. Although not that difficult, it is enough to know and apply some rules. We have prepared several such recommendations, and we hope they will really help you!
What needs to be checked and configured?
If your site is located on a VPS, you can determine the attack level yourself by temporarily disabling the web server and analyzing your logs. Of course, if you feel that protection against DDoS attacks is not your profile and you need practical advice, it is better to contact immediately.
1.Firewall
The first level of protection for your VPS from DDoS attacks is correct setting And active use Firewall. Before installing/configuring it, we advise you to disable all services that you do not use. And in principle, running any other services on the web server where the sites are located is not a very good idea. For this it is better to create .
With Firewall you can close all ports, leaving only HTTP, HTTPS and SSH open. The fact is that visitors' browsers only connect to HTTP or HTTPS ports, so all other connections are not made by real people and should be rejected. We also recommend moving your SSH server to another, more non-standard port. 
Protection against DDoS attacks also includes checking the headers of incoming packets for compliance TCP protocol. Bots often use incorrect packages to exploit vulnerabilities software server and interfere with its normal operation.
2. Protection against HTTP, ICMP, UDO and SYN flood
To protect your VPS from DDoS attacks, it is important to determine what type of attack it is: HTTP, ICMP,-UDO or SYN flood, and depending on this, decide what measures need to be taken.
HTTP flooding is one of the simplest DDoS attacks, caused by an attacker who forces the server to use as many resources as possible to respond to each HTTP request (GET or POST). To prevent HTTP flood, you need a properly configured and optimized web server. When choosing between Apache and Nginx, experts prefer the latter, as it is less resource-intensive and more stable. To avoid interference with the operation of your site, you can also analyze access logs and write an appropriate pattern based on the results. This will allow you to automatically catch bots and ban their requests.
During an ICMP flood, an abnormal message is sent to the server. a large number of ICMP (Internet Control Message Protocol) packets of any type, especially ping. To make your web hosting more reliable, we recommend disabling ping - this way you will hide your machine from Internet bots scanning networks.
An attack that involves repeatedly sending SYN (synchronization) packets to each server port using fake IP addresses is called a SYN flood. To protect your web hosting, you should detect connections in the SYN_RECV state and limit new connections from a specific source for a certain period of time.
You also need to take into account UDP flooding. In this case, the attacker sends great amount UDP (User Datagram Protocol) packets to specific or random ports remote server, scoring network channel. Limiting connections to the DNS server will help protect the server from this type of attack. 
3. Fail2ban
If you want to have a linux vps protected from DDoS attacks, we recommend installing Fail2ban. Typically this utility is not included in basic set, so you'll have to find and install it yourself. Fail2ban comes pre-configured with some filters for web servers out of the box, but it's still better to install them yourself. To provide DDoS protection virtual hosts should be configured so that the logs for all sites are common. This will help protect them with just two filters.
Using Fail2ban, you can also set up SSH server protection so that no one can claim your administrator rights.
It's easier to prevent than to fight
Be that as it may, preventing DDoS attacks is much easier than fighting them. To do this, you need to constantly update the software on the server, install additional patches and modules, and also correctly configure all servers on your VPS. Considering that to the average user it can be difficult to cope with all these tasks, and an advanced person does not always have the time and desire for this, the best solution, as a rule, is the choice to which all these worries can be forwarded. We constantly monitor your system to prevent any difficulties, so with us you are not afraid of any attack on the VPS.
DDoS costs businesses $40,000 per hour.
SUCURI
SUCURI is a specialized cloud solution for protecting a wide variety of websites, including WordPress, Joomla, Drupal, Magento, Microsoft.Net, etc.
Protection against DDoS attacks is included in the antivirus and firewall package. In case you need comprehensive protection site, then in this case Website Antivirus is suitable for you, which protects against online threats, including DDoS attacks, and also includes the following services:
- identification and removal of malicious code;
- security control;
- speed optimization;
- Brute force protection;
- protection against zero-day vulnerabilities;
- protection from unwanted bots.
Alibaba
Anti-DDoS Pro from Alibaba will help you protect against DDoS attacks. Anti-DDoS Pro reflects powerful attacks up to 2 Tbps and supports TCP/UDP/HTTP/HTTPS protocols.Anti-DDoS can be used Not only in case of hosting on Alibaba, but also for AWS, Azure, Google Cloud etc.
MYRA
Myra DDoS protection is a fully automated solution for websites, DNS servers, web applications and infrastructure. It is fully compatible with all types of CMS and e-commerce systems.MYRA is headquartered in Germany, so the data is processed in accordance with federal law Germany on data protection.
March 20, 2014 at 5:35 pmHosting provider vs. DDoS attack. REG.RU solution – professional outsourcing
- REG.RU company blog
Recently, REG.RU, together with the DDoS Guard company, presented free automatic protection against DDoS attacks. The protection works automatically and is able to withstand an attack with a speed of more than 100 Gbps, which allows you to avoid shutdowns of servers and websites, and, consequently, loss of customers and profits.
The problem of combating DDoS attacks faces all hosting providers without exception. Classic methods struggles suggest temporary unavailability of the attacked site, but REG.RU and DDoS Guard were able to find ways to solve this problem. But first things first. 
Methods to combat DDoS attacks
Currently, there are several approaches to protecting against DDoS attacks:First approach– use of vendor equipment (Arbor, Cisco, Juniper and others). This approach is typically used when a company is unable to outsource these tasks due to the increased level of information security.
IN in this case We are talking about using ready-made hardware solutions for filtering traffic. At the entrance to the network, a hardware firewall is installed that filters incoming traffic. He uses a certain amount of basic rules, which determines whether to pass traffic further.
The main advantage of this approach is that the equipment has official certification and is guaranteed to cope with certain types attacks. In the specification to hardware solution the maximum volume of the attack is indicated and, if the attack power does not exceed the stated values, all Internet resources will function normally. 
Disadvantages of this approach:
Only one point of presence is available;
The bandwidth protection ceiling is limited by the channel coming from the equipment uplinks;
Relatively low power when dealing with resource exhaustion attacks, which makes it difficult or impossible to dynamically configure routes and distribute the load;
Price professional solutions starts from five figures (for 10 Gbps protection).
Second approach– use of a distributed filter network. This approach is used by industry leaders and looks the most promising.
The essence of this method is to take the attack as close as possible to the place where it is generated. This allows you to optimally use the network infrastructure and not deliver malicious traffic from one point to another, but block it immediately. In the event of a distributed DDoS attack, when traffic is generated in several countries, it will be redirected to optimal routes to the nearest points of presence (POP), will be filtered and only legitimate, useful traffic will reach the recipient.
The most important advantage This type of protection organization is incredibly flexible. Thanks to this, you can balance traffic between points of presence and work with filters in real time, setting them up for protection against current DDoS attack techniques, which are constantly being modified and modernized. IN Lately attackers have become very inventive - often legitimate traffic can only be distinguished from an attacker by having specific experience in the field of protection.
How DDoS Guard works
Currently, the DDoS-Guard company has distributed network with a total capacity of 200 Gbps, allowing you to reliably and quickly check the incoming traffic flow.Main network nodes: 
- Amsterdam, Netherlands;
- Frankfurt, Germany;
- Kyiv, Ukraine;
- Moscow, Russia.
The existing topology allows you to confidently receive large volumes of traffic without creating excessive load on intermediate operators, process local traffic Russia and Ukraine and has significant reserves for expanding the available incoming band. Following the concept of continuous growth, the company is already designing additional points of presence and traffic clearing nodes in North America and Southeast Asia.
The network architecture is designed taking into account possible threats and risks associated with DDoS attacks in three independently redundant layers:
- Routing layer:
The main task is reliable routing of large volumes of traffic, ensuring connectivity with the maximum number of external networks.
At this level, reliable and efficient routers are used. The maximum design capacity of each traffic processing node is 1400 Gbit/s, capabilities rapid expansion without switching to 100GbE ports and changing the existing connectivity topology with external networks - 440 Gbit/s.
- Redundant cluster batch processing(batch processing layer):
The main task is distributed traffic inspection at levels 3-4 of the OSI model under conditions of ultra-high packet loads and total incoming flow volumes of 100-200 Gbit/s at each point of presence.
This layer consists of several (2-5, depending on the point of presence) mutually redundant devices that check packet traffic using DPI methods. The algorithms used were developed directly by DDoS Guard engineers.
It is necessary to pay special attention to the fact that traffic checking and routing to the end user occurs directly at the receiving point, which reduces delays to a minimum and creates additional features reservations.
- Redundant application layer request processing cluster (application layer):
The main task is to implement methods for checking requests at levels 5+ of the OSI model - HTTP, HTTPs, DNS, SMTP, and so on. HTTPs traffic is also decrypted, verified, and encrypted here.
The layer is backed up regardless of batch processing and routing and does not lose functionality until all nodes fail completely.
Examples of successfully repelled attacks in the form of channel loading graphs:
A few words about BGP integration of REG.RU and DDoS Guard
REG.RU is the first Russian hosting provider to provide protection against DDoS attacks free of charge and automatically.
From a technological point of view, REG.RU client protection is as follows:
REG.RU allocates an address space in which risky clients accumulate.
Having main BGP sessions with backbone operators, REG.RU additionally establishes BGP sessions with DDoS Guard and, in the event of an attack, announces the network that needs protection.
Subsequently, all traffic that goes to REG.RU goes through a cascade of filters and is delivered in filtered form.
On the DDoS Guard side, protection works constantly, in real time, while all junk traffic is blocked in a fully automatic mode.
Delivery of traffic along optimal routes guarantees low delays for end user.
Now, as part of the partnership between REG.RU and DDoS Guard, protection against attacks like
ICMP flood, TCP SYN flood, TCP-malformed, UDP flood, DNS query flood. In the near future we plan to support protection against HTTP/HTTPS flood attacks.
This service is built on the basis of DDoS protected Dedicated 3 configuration servers. Tariff plans differ only in the amount of resources allocated to the site. Protection is implemented based on mainline DDoS filters and Web Applications Firewall of our own design.
If you are constantly subject to DDoS attacks, but your project is low-budget for purchasing a server with DDoS protection, hosting with us will be the best solution for your website.
| Hosting 1 | Hosting 2 | Hosting 3 | |
|---|---|---|---|
| Disk space | 1.5 Gb | 2.5 Gb | 4 Gb |
| Dedicated IP address | |||
| Filtering HTTPS traffic | |||
| Domains | 1 | 2 | 3 |
| Subdomains | 2 | 5 | 10 |
| MySQL database | 1 | 2 | 5 |
| PHP versions of your choice (5.2, 5.3, 5.4) | |||
| Database backup every three hours | on request | on request | |
| Backup files once a day | |||
| Email support | |||
| Price | 75$ | 150$ | 250$ |
| buy | buy | buy |
VDS/VPS with protection against DDOS attacks
This service is based on DDoS protected Dedicated 4 configuration servers. We have presented a wide selection of tariff plans and configurations. Any OS and set of applications is available with each server. We also include our premium technical support and full server administration for FREE.
If you are constantly subject to DDoS attacks, but your project is low budget for purchasing a server with DDoS protection, VPS will be the best choice for you.
| VPS 1 | VPS 2 | VPS 3 | |
|---|---|---|---|
| CPU Intel Xeon E5-2670 | 2 Core | 4 Core | 8 Core |
| RAM | 4 Gb | 8 Gb | 16 Gb |
| HDD | 50 Gb | 100 Gb | 250 Gb |
| Virtualization | LXC | LXC | LXC |
| Channel (Unlimited) | 100 | 100 | 100 |
| 10 Gb/s | 15 Gb/s | 20 Gb/s | |
| DDoS protection level (packets) | 10 million PPS | 15 million PPS | 20 million PPS |
| WAF (web applications firewall) | 2 domain | 4 domain | 6 domain |
| Server administration | |||
| Backup files once a day | |||
| Email support | |||
| 24/7 telephone support | |||
| Price | 150$ | 250$ | 350$ |
| buy | buy | buy |
Dedicated server with protection against DDOS attacks
Maximum flexibility and protection, any software and hardware solutions in the High-Load area are available when ordering our dedicated servers.
Personal manager, 24/7 phone support, full cycle system administration your server, IT consulting on any issues. We have a lot of experience. Order our service and your business will reach a new, high-quality level!
| Dedicated 1 | Dedicated 2 | Dedicated 3 | Dedicated 4 | |
|---|---|---|---|---|
| CPU Intel Xeon E5-2670 | Intel E5-2687W 8 Core | Intel E5-2470V2 10 Core | Intel E7-8870V2 15Core | Xeon E5-2670 32 Core |
| RAM | 8 Gb | 16 Gb | 32 Gb | 64 Gb |
| HDD - SATA (RAID 1) | 2 x 1TB | 2 x 1TB | 2 x 2TB | 2 x 2TB+128GbSSD |
| Virtualization | KVM | KVM | KVM | KVM |
| Channel (Unlimited) | 1000 | 1000 | 1000 | 1000 |
| DDoS protection level (traffic) | 20 Gb/s | 50 Gb/s | 100 Gb/s | 150 Gb/s |
| DDoS protection level (packets) | 150 million PPS | 150 million PPS | 150 million PPS | 150 million PPS |
| WAF (web applications firewall) | 5 domain | 10 domain | 15 domain | 20 domain |
| Server administration | ||||
| Backup files once a day | ||||
| Email support | ||||
| 24/7 telephone support | ||||
| Personal manager | ||||
| Price | 450$ | 550$ | 750$ | 1500$ |
| buy | buy | buy | buy |
DDoS Protection of Game Projects
We provide reliable DDoS protection for all gaming platforms - MineCraft, GTA, CounterStrike, etc. Our Web system Applications Firewall allows you to filter any attacks on any applications on any TCP\UDP ports.
The gaming business is built on the trust of players, think about the future, don’t let your players leave for competitors, make your server more secure now.
| Game 1 | Game 2 | Game 3 | |
|---|---|---|---|
| Legitimate traffic | 100 Mb/s | 250 Mb/s | 1000 Mb/s |
| WAF (web applications firewall) | |||
| Filtering HTTPS traffic | |||
| Dedicated /29 network | |||
| Filtering ports (UDP/TCP) | 2 | 6 | 32 |
| Customized solutions | |||
| Email support | |||
| 24/7 telephone support | |||
| Personal manager | |||
| Price | 150$ | 250$ | 750$ |
| buy | buy | buy |
Remote DDoS protection
Remote protection based on the principle of traffic proxying is the most quick option protection against any type of DDoS attacks today.
With a presence in the largest IXPs, you won't notice any difference in speed using our Web Applications Firewall. Although, of course, you will notice that DDOS attacks will no longer bother you.
| Tunnel 1 | Tunnel 2 | Tunnel 3 | Tunnel 4 | |
|---|---|---|---|---|
| Attendance per day | 5000 | 15 000 | 30 000 | Unlimited |
| Number of domains | 1 | 1 | 3 | 10 |
| Port speed (mb/s) | 50 | 125 | 500 | 1000 |
| SSL filtering | ||||
| Customized solutions | ||||
| Email support | ||||
| 24/7 telephone support | ||||
| Personal manager | Price | 50$ | 125$ | 250$ | 550$ |
| buy | buy | buy | buy |
DDoS protection and support for High-Load projects
If you value peace of mind and time, we will take care of all your worries. Your online business will be in good hands under 24/7 professional supervision.
We are ready to take on all the tasks of supporting your online infrastructure. Our team will cover the entire range of tasks to ensure the functioning of an Internet business of any complexity.
All you have to do is enjoy communicating with clients and promote websites.
CLUSTER package
Development and technical support complex systems load balancing between a group of servers.
- Analysis of the work of an existing customer project and design of a data distribution and interaction scheme.
- Selecting the optimal hardware platform and ISP.
- Installation and configuration of all necessary software for a High Load project.
- Building a load balancing system between 2 or more servers
- Work with customer programmers to optimize the CMS project.
- Backup to an external server and data recovery
| 2 Servers | 300$ per month |
| 3 Servers | 400$ per month |
| 5 Servers | 550$ per month |
Full Responsibility Package
Development and technical support of complex HighLoad solutions for major internet projects
- Together with the customer’s technical staff, selecting technologies and programming languages for project development.
- Designing a data interaction diagram
- DBMS design
- Construction of hardware infrastructure (selection of servers, selection of ISP, installation of OS and software)
- Setting up a load balancing and data synchronization system.
- Analysis of the site's performance under workload and making the necessary changes to the structure of the application.
- Documenting the work plan
- Monitoring the main parameters of the server (CPU, RAM, LOAD, NETWORK, HDD)
- Solving any problem situations related to server performance 24/7
- Backup and recovery of information
- Communication with ISP technical staff on all problematic issues.
The price includes only services technical support
buySecure VDS uses a cluster of servers running OpenStack. Thanks to dynamic distribution resources between physical servers provided correct work service even if problems arise on individual machines. For data, a storage network is used on SSD drives managed by ceph, which eliminates the loss of information when individual media or servers fail. Direct virtualization is provided by the KVM hypervisor. Due to the use of high-performance servers, large bandwidth interfaces, as well as filtering systems, maximum uptime is achieved
All traffic directed to VDS is processed by a protection system at layers 3-4 of the OSI model, which provides protection against DDoS attacks aimed at channel overflow and resource exhaustion.
When using VDS to host websites, the client can also connect HTTP protection/ HTTPS traffic, which will provide analysis and processing of anomalous requests to the web server, as well as a full range of services for optimizing and delivering web traffic.
Possibilities
Technological capabilities of the service:
Constant protection against all known types of DDoS attacks
Personal IP address
VDS Power Management
Possibility of changing the operating system
Wide choose operating systems to install
Access to the server terminal directly from personal account
Using SSD drives for all VDS
10 Gbit/s channel with unlimited traffic
Ability to change server hardware configuration without losing data
Connecting the service within three minutes
Possibilities for processing, optimizing and delivering web traffic:
Analysis and processing of HTTP/HTTPS web traffic
Caching and Delivery static content(CDN)
Web Application Firewall (WAF)
Providing a free certificate from Let's Encrypt
Managing white and black lists for domains
Subdomain protection
HTTP/2 and TLS 1.3 support
View query analytics in real time
Placing records on secure DNS servers
Service management via personal account and API
Who is it suitable for?
A DDoS-GUARD protected VDS is ideal for growing projects that no longer have enough resources provided by hosting. In such situations, we recommend moving to VDS from already installed panel site management. And with further growth of the project, our clients will be able to order an increase computing resources VDS as needed - without transferring or losing data.
VDS from DDoS-GUARD can be used for any services that require location in a secure, fault-tolerant infrastructure. The client receives complete freedom in the server software configuration and the ability fine tuning server in accordance with its requirements. This service is ideal for professionals who wish to gain maximum control over operating system to perform non-standard tasks.
Benefits for the client
Ability to select an operating system and install any software
Ability to select a server control panel
Quick change VDS characteristics without data loss
Huge selection free options to speed up access to websites hosted on VDS
All necessary tools to manage, protect and speed up the site in your personal account
Online analytics of visits and requests in your personal account
No costs for maintaining the infrastructure used by the project
No traffic restrictions
How to order and activate the service?
You can order a service directly on the website or from your personal account using the “Add service” item. After ordering, within a few minutes you are provided with access to a completely ready-made VDS via SSH or RDP, depending on the operating system.
VDS comes with a pre-installed operating system of your choice and one public IP address. The client can use automatic installation server control panel. If you need to install additional software, allocate IP addresses or change an existing address, or if you have any questions, you can contact our support team.
Select tariff
Two lines of tariffs for VDS are available to our clients: Light and Prime.
VDS Light is suitable for hosting small projects, the placement of which does not require significant resources.
VDS Prime is suitable for resource-intensive projects and allows you to achieve maximum performance, as well as protect an unlimited number of domains.
If you have any questions when choosing tariff plan, placing an order or setting up a service, the client can contact our support specialists using the “Support” section, available in his personal account.