HAZI.ro | Performance drops expected tomorrow for VPSs in Romania

emgh

@stefeman said:

@FlorinMarian said:

@stefeman said:

@jmaxwell said:
Looks like he wanted a way out from this downward spiral of basement DC and shut down or go back to Ovh so hired some skid for help.

That's just stupid theory. Sarcasm aside, he's genuine DIY guy and definitely would prefer to continue to improve his home DC.

He is just too eccentric on this forum and easily makes enemies due to misunderstanding and/or responding people back on their own levels rather than being overly polite.

Not to mention he has invested so much money on his current setup, moving it back to rented servers in a facility he can't access is probly worse than having to quit.

@HaziFlorinMarian Look into OpenMPTCProuter. This would allow software level WAN bonding with pretty good throughput using conventional ISPs

Also, install some beefy server before the switches as a firewall using pfsense or opnsense

I couldn't have said it better either!

I've been an asshole, and I probly continue being one for memes, but I don't want this to fail on some script kiddie DDoS attack.

His argumentative nature and ”always being right” triggers people

He seems like a really good dude, but it also seems overly easy for him to make enemies

FlorinMarian

A proof for yesterday's upgrade, in case if someone has doubts:

root@hp1:~# iperf3 -c a205.speedtest.wobcom.de -4
Connecting to host a205.speedtest.wobcom.de, port 5201
[  5] local 188.241.240.250 port 56862 connected to 62.176.246.197 port 5201
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec   231 MBytes  1.94 Gbits/sec  418   41.2 MBytes
[  5]   1.00-2.00   sec   414 MBytes  3.47 Gbits/sec  2045   16.3 MBytes
[  5]   2.00-3.00   sec   141 MBytes  1.18 Gbits/sec  17460   6.87 MBytes
[  5]   3.00-4.00   sec   180 MBytes  1.51 Gbits/sec  2718   8.72 MBytes
[  5]   4.00-5.00   sec   239 MBytes  2.00 Gbits/sec  3662   4.87 MBytes
[  5]   5.00-6.00   sec   335 MBytes  2.81 Gbits/sec  2724   2.80 MBytes
[  5]   6.00-7.00   sec   114 MBytes   954 Mbits/sec  3292   13.9 MBytes
[  5]   7.00-8.00   sec   212 MBytes  1.78 Gbits/sec  2467   6.48 MBytes
[  5]   8.00-9.00   sec   314 MBytes  2.63 Gbits/sec  1723   6.21 MBytes
[  5]   9.00-10.00  sec   351 MBytes  2.95 Gbits/sec  2472   3.10 MBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec  2.47 GBytes  2.12 Gbits/sec  38981             sender
[  5]   0.00-10.06  sec  2.45 GBytes  2.09 Gbits/sec                  receiver

iperf Done.
root@hp1:~# iperf3 -c a205.speedtest.wobcom.de -4 -R
Connecting to host a205.speedtest.wobcom.de, port 5201
Reverse mode, remote host a205.speedtest.wobcom.de is sending
[  5] local 188.241.240.250 port 11768 connected to 62.176.246.197 port 5201
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-1.00   sec  67.4 MBytes   566 Mbits/sec
[  5]   1.00-2.00   sec   192 MBytes  1.61 Gbits/sec
[  5]   2.00-3.00   sec   197 MBytes  1.66 Gbits/sec
[  5]   3.00-4.00   sec   105 MBytes   882 Mbits/sec
[  5]   4.00-5.00   sec   151 MBytes  1.27 Gbits/sec
[  5]   5.00-6.02   sec   178 MBytes  1.46 Gbits/sec
[  5]   6.02-7.00   sec   170 MBytes  1.46 Gbits/sec
[  5]   7.00-8.00   sec   187 MBytes  1.57 Gbits/sec
[  5]   8.00-9.00   sec   184 MBytes  1.54 Gbits/sec
[  5]   9.00-10.00  sec   184 MBytes  1.55 Gbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.04  sec  1.62 GBytes  1.39 Gbits/sec  53583             sender
[  5]   0.00-10.00  sec  1.58 GBytes  1.36 Gbits/sec                  receiver

iperf Done.

xrz

@FlorinMarian said: A proof for yesterday's upgrade, in case if someone has doubts:

nice.
also when bigger ddos happens what do you do? still travel everytime 100km to fix that?

Sululu

@stefeman said: I've been an asshole, and I probly continue being one for memes, but I don't want this to fail on some script kiddie DDoS attack.

I agree with you, I will probably never buy a service from florin, but I wish him success. We need to stick up for the little guys

FlorinMarian

@xrz said:

@FlorinMarian said: A proof for yesterday's upgrade, in case if someone has doubts:

nice.
also when bigger ddos happens what do you do? still travel everytime 100km to fix that?

All what I can say is that in-house filters remain in-house filters.

First, I will have to make sure that I have the remote backups so that I can restore any critical customer service, even if in a different location, with a different IP.

By the end of the year, I must definitely reach 10Gbps considering that this offers both a kind of DDoS protection and increased customer satisfaction.

xrz

@FlorinMarian said: By the end of the year, I must definitely reach 10Gbps considering that this offers both a kind of DDoS protection and increased customer satisfaction.

you can make 10Gbit ddos easy these days so thats not any kind of protection but well its also costly so could kinda works... wish you luck!

dbContext

@FlorinMarian said:

All what I can say is that in-house filters remain in-house filters.

Your "in-house filters" did nothing, you require sufficient bandwidth/transit capacity to be able to filter/tank DDoS Attacks larger than your current capacity, 3Gbps can be generated from spinning up a few VMs without amplification.

At the very least, look into BGP communities, both of your transit providers should provide a RTBH community, to nullroute /32 at their edge, which providing it's not a carpet bombing attack, you can keep the majority of your infrastructure online while handling the attack. "DDoS Protection" vs. "DDoS Mitigation".

You should investigate fastnetmon, as it can detect DDoS Attacks, which can then trigger the RTBH on the IP address being attacked.

It's really quite frustrating how much everyone is offering sound advice, and you're seemingly dismissing it. Best of luck.

Levi

@dbContext said: It's really quite frustrating how much everyone is offering sound advice, and you're seemingly dismissing it.

He does not dismiss it. The problem is that he maybe in theory is familiar what is DDoS, but in practice he lacks knowledge to adapt to the situation.

If this incident was only a test (skids love to poke before really attacking) - he is in a lot of trouble. Also, he has no hardware or fat enough network pipe to cope with volumetric attacks.

Total network failure is programmed if no swift decisions are made:

• Network provider will drop him as a client due to abuse;
• Attackers will bleed him by attacking with delays. This is way worse than one, big, long attack because you can't adapt to changing nature;
• Motivation to run side project will rapidly degrade as problems begin to pile up and mental exhaustion hits;
• DDoS may hide worse problem - cracking. If he get's compromised on top of network failure - it is done.

@FlorinMarian do decisive actions now. Right now. Prepare for the next wave as it will definitely hit you again. Good luck to you mate!

xrz

@LeroyJ said: Prepare for the next wave as it will definitely hit you again

everything is fine no worries

emgh

@FlorinMarian said: First, I will have to make sure that I have the remote backups so that I can restore any critical customer service, even if in a different location, with a different IP.

Or just don't host your WHMCS with the client stuff

I mean, a 2 GB Hetzner instance will do, right? If behind Cloudflare of course

xrz

So is it fixed or no? i saw it online now off again

Wicked

I’m waiting for Netflix to pick this up

paroxsitic

@FlorinMarian said:
Also, after solving the situation, it's cheaper to lose all my clients who don't understand that this type of situation cannot be prevented with the budgets that both they and we have, than to charge my monthly bill with another 700$.

I picked hazi because of daily backups, I figured if something happens then at least no data loss.

Will you provide us the ability to access our data? I cannot reliably connect to ssh and download my data.

FlorinMarian

@paroxsitic said:

@FlorinMarian said:
Also, after solving the situation, it's cheaper to lose all my clients who don't understand that this type of situation cannot be prevented with the budgets that both they and we have, than to charge my monthly bill with another 700$.

I picked hazi because of daily backups, I figured if something happens then at least no data loss.

Will you provide us the ability to access our data? I cannot reliably connect to ssh and download my data.

Absolutelly. Talk to @xrz , he's the one who's more capable to stop this at this moment.

xrz

@FlorinMarian said: Absolutelly. Talk to @xrz , he's the one who's more capable to stop this at this moment.

oh me and my magic lol.
ddos stop, and it wont stop right, wish i could, but then no popcorn time, why dont you take this as a challenge and finally accept the truth that you need real anti ddos?

totally_not_banned

@LeroyJ said:

• Attackers will bleed him by attacking with delays. This is way worse than one, big, long attack because you can't adapt to changing nature;

Outside of boredom or [random unexpected distraction] this is highly likely (and from what it seems has already started). To the kids doing this it's amusement after all and giving your target time to breath and a false sense of security simply adds to that amusement. It's sadly very predictable.

xrz

@totally_not_banned said: false sense of security

he should use real anti ddos protection from day one, no matter the cost i think, this is so unnaceptable

FlorinMarian

The website has been successfully migrated to OVH, at least it should no longer suffer from the lack of protection.

totally_not_banned

@xrz said:

@totally_not_banned said: false sense of security

he should use real anti ddos protection from day one, no matter the cost i think, this is so unnaceptable

Well, i can see how skipping the costs during startup is tempting and as long as it works it works, i guess but there should have been at least some kind of backup plan as one can't really expect to never get hit at all. It's not like DDoS is some super exotic and rare event after all.

Levi

@paroxsitic said:

@FlorinMarian said:
Also, after solving the situation, it's cheaper to lose all my clients who don't understand that this type of situation cannot be prevented with the budgets that both they and we have, than to charge my monthly bill with another 700$.

I picked hazi because of daily backups, I figured if something happens then at least no data loss.

Will you provide us the ability to access our data? I cannot reliably connect to ssh and download my data.

Send him hdd and 60€ for fuel (100km drive to home) and another 50€ to send your data back.

Radi

Very funny captcha on hazi.ro - I had doubts I was a robot but the site has finally confirmed them

marian

@FlorinMarian said: I didn't ask you or anyone else here for help, so I don't know how you deduced that I'm asking people for help.

@dbContext said: It's really quite frustrating how much everyone is offering sound advice, and you're seemingly dismissing it. Best of luck.

well... he didn't ask for any help. he has too much pride.

Sululu

@FlorinMarian seems to think he is cheap and therefore anything goes...I have checked your prices, some better structured providers are as cheap as, if not cheaper than, you.

This is why no matter how much I root for you, using you makes no financial sense for me.

Stop thinking you can do as you wish cause you are cheap(er), YOU ARE NOT

Stradale

LowEndStatus

RapToN

@FlorinMarian As a provider, it is your responsibility to ensure that the services offered actually work. Of course, this also includes a functioning network connection and, in my opinion, the price of your services is of no interest.

If it is necessary to zero-route the IPs of individual customers due to attacks, that is perfectly fine, but as a hoster, it is not acceptable for all customers to go down due to a DDoS (Of course that can happen... Bad things happen. But then you should really do EVERYTHING to get it under control as quickly as possible. Regardless of the costs involved).

Just my personal opinion!

yoursunny

@Sululu said:
@FlorinMarian seems to think he is cheap and therefore anything goes...I have checked your prices, some better structured providers are as cheap as if not cheaper than you.

This is why no matter how much I root for you, using you makes no financial sense for me.

Stop thinking you can do as you wish cause you are cheap(er), YOU ARE NOT

4GB plan IPv4+IPv6 comparison:

• BroHost (RO): 2x E5-2680v4, 120GB SSD, unmetered on 1Gbps port shared by hundreds of customers, €67.44/year (active offer)
• AS203363 (GB): 2x E5-2690v4, 50GB SSD, 3TB in+out with 160Gbps DDoS protection, £25 » €29.04/year (active offer)
• AS206075 (NL): 1x EPYC 7702P, 100GB NVMe, 8TB in+out, €30/year (ended, normal price €60/year)
• Scaleway PLAY2-NANO (PL): 2x EPYC 7543, 10GB block storage, unmetered 200Mbps, €281.90/year

Bro is cheaper than Scaleway.

risharde

@yoursunny said:

@Sululu said:
@FlorinMarian seems to think he is cheap and therefore anything goes...I have checked your prices, some better structured providers are as cheap as if not cheaper than you.

This is why no matter how much I root for you, using you makes no financial sense for me.

Stop thinking you can do as you wish cause you are cheap(er), YOU ARE NOT

4GB plan IPv4+IPv6 comparison:

• BroHost (RO): 2x E5-2680v4, 120GB SSD, unmetered on 1Gbps port shared by hundreds of customers, €67.44/year (active offer)
• AS203363 (GB): 2x E5-2690v4, 50GB SSD, 3TB in+out with 160Gbps DDoS protection, £25 » €29.04/year (active offer)
• AS206075 (NL): 1x EPYC 7702P, 100GB NVMe, 8TB in+out, €30/year (ended, normal price €60/year)
• Scaleway PLAY2-NANO (PL): 2x EPYC 7543, 10GB block storage, unmetered 200Mbps, €281.90/year

Bro is cheaper than Scaleway.

Doc, I think what the poster was referring to was that there are other providers in similar region that is cheaper than him, but you're the doc so I could be wrong.

Tingull

BroHost (RO): 2x E5-2680v4, 120GB SSD, unmetered on 1Gbps port shared by hundreds of customers, €67.44/year (active offer).

Lmao shared buy hundreds why on earth would anyone bother knowing that. Anyway the price of some of them you might as well pay a little more and get a small kimsufi which is dedicated, or if not get a instance from hetzner you will get way better speeds.

Also the way i see some of you speak about customers like they don't matter is very bad, i am glad at least florin is not speaking that way, what has happened to his DC could happen to any small start up, hay i lost servers on ovh years back when they was new too, but at least he is trying to sort something out, there is always gonna be a ass who wants to mess up your business, but hopefully frorin learns from this.

Me myself as a customer say you should for now move your clients effected to ovh until you sort some kind of ddos protection out as this person will do it again knowing how much crap they cause.

FlorinMarian

@RapToN said:
@FlorinMarian As a provider, it is your responsibility to ensure that the services offered actually work. Of course, this also includes a functioning network connection and, in my opinion, the price of your services is of no interest.

If it is necessary to zero-route the IPs of individual customers due to attacks, that is perfectly fine, but as a hoster, it is not acceptable for all customers to go down due to a DDoS (Of course that can happen... Bad things happen. But then you should really do EVERYTHING to get it under control as quickly as possible. Regardless of the costs involved).

Just my personal opinion!

I'm sorry, but your message clearly shows what others don't want to understand either.
You have a DDoS attack with IP spoofing on multiple protocols and the attacks target all subnets and IPs that you announce from a certain location. Who do you give nullroute to?

totally_not_banned

@FlorinMarian said:

@RapToN said:
@FlorinMarian As a provider, it is your responsibility to ensure that the services offered actually work. Of course, this also includes a functioning network connection and, in my opinion, the price of your services is of no interest.

If it is necessary to zero-route the IPs of individual customers due to attacks, that is perfectly fine, but as a hoster, it is not acceptable for all customers to go down due to a DDoS (Of course that can happen... Bad things happen. But then you should really do EVERYTHING to get it under control as quickly as possible. Regardless of the costs involved).

Just my personal opinion!

I'm sorry, but your message clearly shows what others don't want to understand either.
You have a DDoS attack with IP spoofing on multiple protocols and the attacks target all subnets and IPs that you announce from a certain location. Who do you give nullroute to?

People understand that. He just said that doing so is OK if it's necessary but being generally unavailable is not.