Is it possible to fully disable ddos protection, that triggered by vpn connection?
#Is it possible to fully disable ddos protection, that triggered by vpn connection?
keen matrix
silver horizon
No
Use TCP VPN or another tunneling protocol on top of your UDP VPN
VAC might cut some UDP VPNs when you are under attack if the connection speed exceeds X mbps
keen matrix
VAC might cut some UDP VPNs when you are under attack if the connection speed ex...
and it is not possible to somehow whitelist clients?
silver horizon
You can whitelist with allow rule, but VAC can likewise override your rules to protect the network.
If your VPN traffic looks similar enough to the attack, it can cut it.
You can use traffic control to limit each client to 30 Mbps during attacks if you must run UDP VPN on a server that gets Bombarded with ddos
keen matrix
for UDP it shows "UDP" for tcp + tls it shows "FRAGMENT
odd scroll
If your server is a dedicated one, and your usage trigger our system, we can adjust our filter to better suit your needs.
But do not use a VPS as a VPN service.
silver horizon
^ Yeah, forgot this one
If its dedicated server, open support ticket and ask for adjustment
They can apply various levels on control over the backend anti-ddos decisions
keen matrix
If your server is a dedicated one, and your usage trigger our system, we can ad...
it is used as hosting and devbox, all developers need to use VPN
silver horizon
Why dont you run TCP vpn though if its just dev access?
odd scroll
I understand, is it a dedicated server?
If yes, do a PCAP file, and send it in a ticket to our support.
keen matrix
I understand, is it a dedicated server?
If yes, do a PCAP file, and send it in a...
VPS
odd scroll
Why dont you run TCP vpn though if its just dev access?
good point, as this will not trigger our system as much
odd scroll
VPS
Then our system will continue to block your server, as the treshold can't be changed on the VPS.
silver horizon
If you have VPS, change VPN protocol to TCP or limit your UDP VPN speeds during ddos attack
No way around it
keen matrix
If you have VPS, change VPN protocol to TCP or limit your UDP VPN speeds during ...
but TCP marking with "FRAGMENT"
odd scroll
but TCP marking with "FRAGMENT"
our filter are quite agressive, if you are unable to rate limit your usage, I would recomend looking to a dedicated server.
silver horizon
Its UDP fragment which is being listed in your security center
Not TCP fragment
VPN is also fragmented UDP most of the times, so thats why it can also get filtered at certain tresholds
Your options are:
- Rate limit your vpn with traffic control to 20-30 Mbps per client if you must use UDP VPN
- Change vpn protocol to TCP
- Get a dedicated server instead which can be adjusted for you
keen matrix
I guess clients should be notified about this issue on "order" page
silver horizon
for UDP it shows "UDP" for tcp + tls it shows "FRAGMENT
Generally attackers use both TCP and UDP at same time to attack. Hence you have various of stuff showing up here.
keen matrix
Generally attackers use both TCP and UDP at same time to attack. Hence you have ...
But still can't understand why ddos protection is not optional
silver horizon
I guess clients should be notified about this issue on "order" page
Its same everywhere, assuming the service even stays up during attack.
silver horizon
But still can't understand why ddos protection is not optional
There is optional alternative. Its called null route
Would you prefer that? Plenty people offer it during attacks for their customers.
xD
keen matrix
I'd prefer to disable it at all
silver horizon
The server would lose internet during attacks then sir
keen matrix
As i remember it was optional some time ago.
odd scroll
But still can't understand why ddos protection is not optional
The DDoS protection is in place to protect you, but also our other clients on the same host and in our infrastructure.
In reality, we do mention the limitation, in our term of condition.
The limitation is in place as your server share the physical connection with other VPS.
silver horizon
Generic udp openvpn does not trigger VAC no matter how much traffic you push through
Same with wireguard
You need to use some pretty custom stuff for VAC to get triggered if there are no attacks ongoing against you
The above limitations apply when you are under active attack
keen matrix
wireguard works fine but not available for part of the required devices
silver horizon
Which devices does wireguard not work with?
silver horizon
Your setup is way too custom
You need to understand that, you can't expect stuff like that to work out of box in the cheapest hosting option of third party company
OVHCloud tests their stuff for various use cases, including VPNs
If you wish to make stuff like this work, theres gonna be workarounds involved
This is not limited to ovhcloud
keen matrix
client ip whitelist or summary of 1gb connection was expected actually