#Some Cloudflare-style Live DDoS Mitigation Features

1 messages · Page 1 of 1 (latest)

royal dirge
#

Cloudflare has a "custom WAF rules" feature where you can add granular firewall rules around URL paths, IP addresses, etc. These are similar to Bunny's edge rules, but when you add a rule you also get a special near-live logging output of what traffic the rule is catching.

A key is that you can put in place a no-op rule that allows all traffic in order to super easily inspect traffic on a certain path, which I've used to mitigate some extra tricky DDoS attempts where they find specific endpoints that hit our DB hard and send small amounts of traffic at them (higher level protections like rate limits are not very useful here). Once you find the bad traffic, you can block it by IP/path, or add a Managed Challenge page to ensure only humans can get through. Finally, once you've added these blocks, you can see a graph of how much traffic they're blocking which is wildly helpful to know that you've successfully blocked the attackers.

Sorry for the long prologue... Any plans for Bunny to implement these kinds of advanced features with extra near-live logging?

stuck wigeon