HAZI.ro | Performance drops expected tomorrow for VPSs in Romania

Andrews

@Wicked said:
Can’t be long before Orange kicks you off.

another romanian shit deadpool is coming

FlorinMarian

@stefeman said:

@FlorinMarian said:
The news are pretty bad.

I have opened 3 incidents at Orange in the last 24 hours and in all of them the outcome was unfavorable:

• do you want inbound limitation on UDP to x % of the port? Contact the commercial consultant, accept the offer, pay extra and we deploy you (I don't know the price but I know that any operation with the consultant goes beyond 45 days of waiting).
• you want us to filter your traffic through Arbor? 700 EUR + VAT and the 45 days waiting time
• do you want us to identify your traffic source and block it for your ASN? Not possible.

This thread was opened strictly for the purpose of announcing today's upgrade but it turned into a new stage on which the great gods of the community climbed.

It's frustrating to research over and over again how to stop IP spoofing attacks and after reading a few pages always see the same conclusion: it can't be done.

A quote says that night is a good counselor, let's see what ideas I come up with to get out of this mess.

Thanks to everyone who offered to help me!

Did you really not count this in when you decided to build your own DC?

Yes I've had this in mind but even in the datacenter with Voxility + SSL I still had downtime on the VM on which I kept whmcs a few days.
The difference between then and now is that the target of the attacks is no longer a single IP but the entire subnet.

risharde

Or so you can at least link to your panel for the servers that are unaffected (assuming your ovh server(s))

stefeman

@FlorinMarian said:

@stefeman said:

@FlorinMarian said:
The news are pretty bad.

I have opened 3 incidents at Orange in the last 24 hours and in all of them the outcome was unfavorable:

• do you want inbound limitation on UDP to x % of the port? Contact the commercial consultant, accept the offer, pay extra and we deploy you (I don't know the price but I know that any operation with the consultant goes beyond 45 days of waiting).
• you want us to filter your traffic through Arbor? 700 EUR + VAT and the 45 days waiting time
• do you want us to identify your traffic source and block it for your ASN? Not possible.

This thread was opened strictly for the purpose of announcing today's upgrade but it turned into a new stage on which the great gods of the community climbed.

It's frustrating to research over and over again how to stop IP spoofing attacks and after reading a few pages always see the same conclusion: it can't be done.

A quote says that night is a good counselor, let's see what ideas I come up with to get out of this mess.

Thanks to everyone who offered to help me!

Did you really not count this in when you decided to build your own DC?

Yes I've had this in mind but even in the datacenter with Voxility + SSL I still had downtime on the VM on which I kept whmcs a few days.
The difference between then and now is that the target of the attacks is no longer a single IP but the entire subnet.

Single IP = DoS

Did you have problems with DoS from single IP before when you were in normal datacenter? How can you assume that your own DC with 2.5Gbps link would handle the real one then?

You need to look into BGP Mitigation as stated by others. You could just enable it as automatic. They are from 300€ upwards with various providers such as Colt, Path.net, Voxility, GSL, and so on.

FlorinMarian

@risharde said:
Or so you can at least link to your panel for the servers that are unaffected (assuming your ovh server(s))

I've tried but no luck.
The connection is frequently interrupted and I have no chance to export the data.
Also remote daily backup failed since it was scheduled while attack was running.

tentor

@FlorinMarian said: The difference between then and now is that the target of the attacks is no longer a single IP but the entire subnet.

@HostSlick @AlexBarakov, you both previously asked about carpet-bombing

emgh

@stefeman said: Single IP = DoS

That's about the origin, not the destination

I assume he meant they only downed single IPs before

I might be wrong

emgh

@FlorinMarian said:

@risharde said:
Or so you can at least link to your panel for the servers that are unaffected (assuming your ovh server(s))

I've tried but no luck.
The connection is frequently interrupted and I have no chance to export the data.
Also remote daily backup failed since it was scheduled while attack was running.

Can't you just do it physically?

FlorinMarian

@stefeman said:

@FlorinMarian said:

@stefeman said:

@FlorinMarian said:
The news are pretty bad.

I have opened 3 incidents at Orange in the last 24 hours and in all of them the outcome was unfavorable:

• do you want inbound limitation on UDP to x % of the port? Contact the commercial consultant, accept the offer, pay extra and we deploy you (I don't know the price but I know that any operation with the consultant goes beyond 45 days of waiting).
• you want us to filter your traffic through Arbor? 700 EUR + VAT and the 45 days waiting time
• do you want us to identify your traffic source and block it for your ASN? Not possible.

This thread was opened strictly for the purpose of announcing today's upgrade but it turned into a new stage on which the great gods of the community climbed.

It's frustrating to research over and over again how to stop IP spoofing attacks and after reading a few pages always see the same conclusion: it can't be done.

A quote says that night is a good counselor, let's see what ideas I come up with to get out of this mess.

Thanks to everyone who offered to help me!

Did you really not count this in when you decided to build your own DC?

Yes I've had this in mind but even in the datacenter with Voxility + SSL I still had downtime on the VM on which I kept whmcs a few days.
The difference between then and now is that the target of the attacks is no longer a single IP but the entire subnet.

Single IP = DoS

Did you have problems with DoS from single IP before when you were in normal datacenter? How can you assume that your own DC with 2.5Gbps link would handle the real one then?

You need to look into BGP Mitigation as stated by others. You could just enable it as automatic. They are from 300€ upwards with various providers such as Colt, Path.net, Voxility, GSL, and so on.

Single IP as destination, source IP was like today, spoofed

Last time I've checked with Path.net they had something like 500$ ex. VAT discounted and for a limited amount of traffic.
Worst case scenario is to migrate all services at OVH (at least temporary).

emgh

@FlorinMarian said: Worst case scenario is to migrate all services at OVH (at least temporary)

Ough

tentor

@FlorinMarian said: The connection is frequently interrupted and I have no chance to export the data.

Given that your servers are literally at your home, can't you export the database to the flash drive and upload it from your laptop over residential line?

Kris

DDoS mitigation. Contact Path.net, GSL, Voxility, whoever. Contact me if you need to speak to Path ASAP, I have a contact there.

They have a friendly team who likely will help you set it up. Honestly, if you knew how to GRE tunnel from OVH, you'll be able to save your ASN and IPs getting setup ASAP with a LOA sent over.

This isn't something that's going to go away since they've seen they can push over your stack so easily.

risharde

@FlorinMarian said:

@risharde said:
Or so you can at least link to your panel for the servers that are unaffected (assuming your ovh server(s))

I've tried but no luck.
The connection is frequently interrupted and I have no chance to export the data.
Also remote daily backup failed since it was scheduled while attack was running.

Ahh darn Murphy has been exceptionally unkind to you as is sort of expected by Murphy

Good luck - definitely going to have to consider DDoS protection can't see any other way out of this

FlorinMarian

@tentor said:

@FlorinMarian said: The connection is frequently interrupted and I have no chance to export the data.

Given that your servers are literally at your home, can't you export the database to the flash drive and upload it from your laptop over residential line?

I'm not living there anymore.
Just this evening I've moved 100km away from home.

risharde

@emgh said:

@FlorinMarian said:

@risharde said:
Or so you can at least link to your panel for the servers that are unaffected (assuming your ovh server(s))

I've tried but no luck.
The connection is frequently interrupted and I have no chance to export the data.
Also remote daily backup failed since it was scheduled while attack was running.

Can't you just do it physically?

This just came to my mind, indeed why not physically pull it off the server?

tentor

@FlorinMarian said:

@tentor said:

@FlorinMarian said: The connection is frequently interrupted and I have no chance to export the data.

Given that your servers are literally at your home, can't you export the database to the flash drive and upload it from your laptop over residential line?

I'm not living there anymore.
Just this evening I've moved 100km away from home.

What a timing

emgh

Also, not that it helps in any way but imagine being the pathetic skid ddos'ing a small providers home line through orange

Like, on a scale 10-10, how miserable do you have to be

emgh

@FlorinMarian said: Just this evening I've moved 100km away from home.

100km by car isn't too much

risharde

@FlorinMarian said:

@tentor said:

@FlorinMarian said: The connection is frequently interrupted and I have no chance to export the data.

Given that your servers are literally at your home, can't you export the database to the flash drive and upload it from your laptop over residential line?

I'm not living there anymore.
Just this evening I've moved 100km away from home.

That's not like a 2 hours drive? Not trying to make you look bad, just wondering what else you could do at this point

stefeman

@FlorinMarian said:

@stefeman said:

@FlorinMarian said:

@stefeman said:

@FlorinMarian said:
The news are pretty bad.

I have opened 3 incidents at Orange in the last 24 hours and in all of them the outcome was unfavorable:

• do you want inbound limitation on UDP to x % of the port? Contact the commercial consultant, accept the offer, pay extra and we deploy you (I don't know the price but I know that any operation with the consultant goes beyond 45 days of waiting).
• you want us to filter your traffic through Arbor? 700 EUR + VAT and the 45 days waiting time
• do you want us to identify your traffic source and block it for your ASN? Not possible.

This thread was opened strictly for the purpose of announcing today's upgrade but it turned into a new stage on which the great gods of the community climbed.

It's frustrating to research over and over again how to stop IP spoofing attacks and after reading a few pages always see the same conclusion: it can't be done.

A quote says that night is a good counselor, let's see what ideas I come up with to get out of this mess.

Thanks to everyone who offered to help me!

Did you really not count this in when you decided to build your own DC?

Yes I've had this in mind but even in the datacenter with Voxility + SSL I still had downtime on the VM on which I kept whmcs a few days.
The difference between then and now is that the target of the attacks is no longer a single IP but the entire subnet.

Single IP = DoS

Did you have problems with DoS from single IP before when you were in normal datacenter? How can you assume that your own DC with 2.5Gbps link would handle the real one then?

You need to look into BGP Mitigation as stated by others. You could just enable it as automatic. They are from 300€ upwards with various providers such as Colt, Path.net, Voxility, GSL, and so on.

Worst case scenario is to migrate all services at OVH (at least temporary).

Fucking RIP

Kris

@FlorinMarian said: Single IP as destination, source IP was like today, spoofed

Last time I've checked with Path.net they had something like 500$ ex. VAT discounted and for a limited amount of traffic.

Uh, one IP was being hit? So you send a /32 nullroute upstream if it's one IP being targeted. Even Orange should do that free.

Path is worth every cent, and remember, you're paying for filtered clean traffic, which with your Romanian providers you likely don't go over.

Could get a 3.2Tbps attack but that's not counted towards real bandwidth.

Maybe OVH is your best bet if you can't afford BGP filtering. But really, only one IP was* targeted today and Orange or yourself haven't thought to sinkhole it?

risharde

@stefeman said:

@FlorinMarian said:

@stefeman said:

@FlorinMarian said:

@stefeman said:

@FlorinMarian said:
The news are pretty bad.

I have opened 3 incidents at Orange in the last 24 hours and in all of them the outcome was unfavorable:

• do you want inbound limitation on UDP to x % of the port? Contact the commercial consultant, accept the offer, pay extra and we deploy you (I don't know the price but I know that any operation with the consultant goes beyond 45 days of waiting).
• you want us to filter your traffic through Arbor? 700 EUR + VAT and the 45 days waiting time
• do you want us to identify your traffic source and block it for your ASN? Not possible.

This thread was opened strictly for the purpose of announcing today's upgrade but it turned into a new stage on which the great gods of the community climbed.

It's frustrating to research over and over again how to stop IP spoofing attacks and after reading a few pages always see the same conclusion: it can't be done.

A quote says that night is a good counselor, let's see what ideas I come up with to get out of this mess.

Thanks to everyone who offered to help me!

Did you really not count this in when you decided to build your own DC?

Yes I've had this in mind but even in the datacenter with Voxility + SSL I still had downtime on the VM on which I kept whmcs a few days.
The difference between then and now is that the target of the attacks is no longer a single IP but the entire subnet.

Single IP = DoS

Did you have problems with DoS from single IP before when you were in normal datacenter? How can you assume that your own DC with 2.5Gbps link would handle the real one then?

You need to look into BGP Mitigation as stated by others. You could just enable it as automatic. They are from 300€ upwards with various providers such as Colt, Path.net, Voxility, GSL, and so on.

Worst case scenario is to migrate all services at OVH (at least temporary).

Fucking RIP

Specifics please if you don't mind sharing, I know you have a good reason for saying this (no sarcasm here) - is it because the DDoS protection wouldn't be able to handle it or the poor service at OVH (eg support response times) or something even more scary?

Kris

@FlorinMarian said: I'm not living there anymore. Just this evening I've moved 100km away from home.

K, I'm out.

Best of luck.

Wicked

@FlorinMarian said:

@tentor said:

@FlorinMarian said: The connection is frequently interrupted and I have no chance to export the data.

Given that your servers are literally at your home, can't you export the database to the flash drive and upload it from your laptop over residential line?

I'm not living there anymore.
Just this evening I've moved 100km away from home.

Ask your neighbour

SirNeo

Turn off the power until Monday. The attacker will stop DDoS and as a bonus you will do cost reduction not using power

SwordfishBE

Just use this card, always works!

Send the attack back.

Levi

So, business goes down the drain? Can we hazi.rip ? Any skid or competitor can down you. And attacks are not even that expensive. 5Gbps -15Gbs can be launched from any casual "booter" for a few hundred bucks.

emgh

@risharde said:

@stefeman said:

@FlorinMarian said:

@stefeman said:

@FlorinMarian said:

@stefeman said:

@FlorinMarian said:
The news are pretty bad.

I have opened 3 incidents at Orange in the last 24 hours and in all of them the outcome was unfavorable:

• do you want inbound limitation on UDP to x % of the port? Contact the commercial consultant, accept the offer, pay extra and we deploy you (I don't know the price but I know that any operation with the consultant goes beyond 45 days of waiting).
• you want us to filter your traffic through Arbor? 700 EUR + VAT and the 45 days waiting time
• do you want us to identify your traffic source and block it for your ASN? Not possible.

This thread was opened strictly for the purpose of announcing today's upgrade but it turned into a new stage on which the great gods of the community climbed.

It's frustrating to research over and over again how to stop IP spoofing attacks and after reading a few pages always see the same conclusion: it can't be done.

A quote says that night is a good counselor, let's see what ideas I come up with to get out of this mess.

Thanks to everyone who offered to help me!

Did you really not count this in when you decided to build your own DC?

Yes I've had this in mind but even in the datacenter with Voxility + SSL I still had downtime on the VM on which I kept whmcs a few days.
The difference between then and now is that the target of the attacks is no longer a single IP but the entire subnet.

Single IP = DoS

Did you have problems with DoS from single IP before when you were in normal datacenter? How can you assume that your own DC with 2.5Gbps link would handle the real one then?

You need to look into BGP Mitigation as stated by others. You could just enable it as automatic. They are from 300€ upwards with various providers such as Colt, Path.net, Voxility, GSL, and so on.

Worst case scenario is to migrate all services at OVH (at least temporary).

Fucking RIP

Specifics please if you don't mind sharing, I know you have a good reason for saying this (no sarcasm here) - is it because the DDoS protection wouldn't be able to handle it or the poor service at OVH (eg support response times) or something even more scary?

He means that it’s RIP having to migrate to OVH after having spent A LOT on a home datacenter for ONE stupid DDoS

fluffernutter

@LeroyJ said:
So, business goes down the drain? Can we hazi.rip ? Any skid or competitor can down you. And attacks are not even that expensive. 5Gbps -15Gbs can be launched from any casual "booter" for a few hundred bucks.

Try a few dozen, it's actually laughable that he didn't foresee this being an issue. At least with Voxility he had some degree of protection.

emgh

@Kris said:

@FlorinMarian said: I'm not living there anymore. Just this evening I've moved 100km away from home.

K, I'm out.

Best of luck.

Yeah, had he just got into the car when he started spending time in this thread instead, he’d be done now