Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Built My own L7 anti-DDoS system — looking for suggestions to improve it ! !

tauseeftauseef Member
edited September 22 in General

It’s an L7 HTTP/HTTPS protection layer that sits between Cloudflare and the origin server.

I originally built it for our own infrastructure, mainly to deal with HTTP floods, abusive bots, scrapers, and application-layer attacks.

Right now it includes:

Cookie / JS / interaction challenges
Automatic attack escalation + recovery
Rate limiting
Requests and Bandwidth realtime monitoring per second
Speed limiting rules per (path, extension,domain, subdomain) connection or total
Temporary bans / strike system
Managed bot/client blocklists
Lockdown mode
IP, CIDR, UA and path allowlists
Origin health monitoring
Per-domain caching
Traffic / attack visibility
Bandwidth monitoring
Webhook + email alerts
Protected subdomains

DNS stays behind Cloudflare orange-cloud, while Citadel handles filtering and proxying before traffic reaches the origin.

I’m considering turning it into a public service as well, but it’s still pretty new, so I’m sure there are bugs, edge cases, and attack patterns we haven’t run into yet.

would love to know your thoughts if you constantly deal into this

What would you expect from something like this? What would you change, and what are we missing?

If there’s interest in actually testing it, I can check with the @Mods to make it accessible

«13

Comments

  • Vibe-coded?

    Thanked by 2itzsenu jsg
  • tauseeftauseef Member
    edited September 22

    @forest said:
    Vibe-coded?

    Used AI but I used to sell Anti-DDos pre AI era as well so i know the ins and out
    IDK if it can be said vibe-coded or not, you can try testing it maybe

    Thanked by 1OpaqueRegistrant
  • @tauseef said:

    @forest said:
    Vibe-coded?

    Used AI but I used to sell Anti-DDos pre AI era as well so i know the ins and out
    IDK if it can be said vibe-coded or not, you can try testing it maybe

    Let me translate: "Yes its vibe coded, but trust me bro!"

  • zedzed Veteran

    does it have an ssh client?

  • LeviLevi Veteran

    All it takes is just vibe coded ddos executor.

    I suggest to make it OSS, let us investigate what you have prompted. And after public will find few dozen of critical flaws - reboot app with different name. We already had "omni apps" from few bozzos here.

  • Trying to get all shit in to the forum.
    First want sell a company
    The vibe coded things.
    Whats next?

  • @zed said:
    does it have an ssh client?

    Key Management included

  • cloudblastcloudblast Member, Patron Provider
    edited September 22

    "What it includes" are all user facing features, how it works under the hood?

    Honestly half of the features seems un necessary, a L7 DDoS Protection alternative it's a useful product, but has to work and be performant.

  • Most of what you described (and more) already exists within Cloudflare free and Pro plans.
    And you don't have to maintain any middleware software and hardware. They also do it on their edge anycast network, so bad traffic never hits your origin in the first place.

    Thanked by 2buggedout Obelous
  • @luckypenguin said:
    Most of what you described (and more) already exists within Cloudflare free and Pro plans.
    And you don't have to maintain any middleware software and hardware. They also do it on their edge anycast network, so bad traffic never hits your origin in the first place.

    That's true, but fuck Cloudflare centralizing the entire internet into one big MITM. We need more diversity.

  • @forest said:

    @luckypenguin said:
    Most of what you described (and more) already exists within Cloudflare free and Pro plans.
    And you don't have to maintain any middleware software and hardware. They also do it on their edge anycast network, so bad traffic never hits your origin in the first place.

    That's true, but fuck Cloudflare centralizing the entire internet into one big MITM. We need more diversity.

    I wholly agree. It's a single point of failure

    Thanked by 1buggedout
  • @forest said: Cloudflare centralizing the entire internet into one big MITM. We need more diversity.

    Yes I agree with this, but I'm only pointing that this solution still depends on Cloudflare
    "orange state", so it just adds an extra layer of complexity without any obvious benefit.
    If you put something like this behind OVH, which suck at L7, it would make more sense.

    Thanked by 3tentor forest Obelous
  • stable_geniusstable_genius Member
    edited September 22

    Can't you complicate it a little more? You could add a few more layers on top of each other, more external providers and even more points of failure.

    Hey, add a new vibe copied ssh client, that would make it even greater.

  • @zed said:
    does it have an ssh client?

    Yes it ssh into all servers on planet !!

  • less features, more breaking it. if it survives LET trying to kill it, then you’ve got a product.

  • yoursunnyyoursunny Member, IPv6 Advocate

    @zed said:
    does it have an ssh client?

    Can it send mail and join IRC chats?

    Thanked by 1jsg
  • Haha a friend & I vibecoded a similar project recently as a fun side project. Pretty cool what LLMs can do! Ofc probably shouldn't be relied on for production, but still cool :)

  • suyadi92suyadi92 Member
    edited September 22

    Edit: Sorry wrong thread

  • @Gravely said:

    @tauseef said:

    @forest said:
    Vibe-coded?

    Used AI but I used to sell Anti-DDos pre AI era as well so i know the ins and out
    IDK if it can be said vibe-coded or not, you can try testing it maybe

    Let me translate: "Yes its vibe coded, but trust me bro!"

    “Trust me bro” is good satire but If you want proof, try to take it down, I’ll give access if it dies you can then rant about it

  • @Levi said:
    All it takes is just vibe coded ddos executor.

    I suggest to make it OSS, let us investigate what you have prompted. And after public will find few dozen of critical flaws - reboot app with different name. We already had "omni apps" from few bozzos here.

    Right but instead of OSS I’m more interested in people trying to break the live path than reading prompts. If you find real flaws, post them. that’s more useful for me to work on it even better

  • @tauseef said: I used to sell Anti-DDos

    Do you have any proof to back that up?

  • @ascicode said:
    Trying to get all shit in to the forum.
    First want sell a company
    The vibe coded things.
    Whats next?

    never seen a guy so obsessed, you tried to rant over the business sell
    and got nuked with answers , here you trying again and will happen same, don't behave like a obsessed ex

    if you are really that good then go bar to bar with knowledge

  • @cloudblast said:
    "What it includes" are all user facing features, how it works under the hood?

    Honestly half of the features seems un necessary, a L7 DDoS Protection alternative it's a useful product, but has to work and be performant.

    Under the hood it’s a Go reverse proxy in front of origin: challenge ladder (cookie → JS → interact), rate limits, Auto escalate/heal, allow/block lists, then pass clean traffic. CF stays orange-cloud so volumetric junk dies at the edge; This is for L7 that still gets through
    Agree a lot of “feature list” is noise if the core can’t hold under load. Performance and not melting the origin are the bar

  • @luckypenguin said:
    Most of what you described (and more) already exists within Cloudflare free and Pro plans.
    And you don't have to maintain any middleware software and hardware. They also do it on their edge anycast network, so bad traffic never hits your origin in the first place.

    True that CF Free/Pro covers a lot. I’m not trying to replace CF as anycast. I’m trying to stop HTTP floods / bots / scrapers that still hit origin when CF alone isn’t enough for that site, especially when you want stricter challenges and per ext,path,subdomain speed limits (per connection/total)

  • @itzsenu said:
    less features, more breaking it. if it survives LET trying to kill it, then you’ve got a product.

    I actually want it, would make my product better and can prove all wrong
    some are just trying to oversmart just cause they learned few terms in this niche

  • @x0x0x said:

    @tauseef said: I used to sell Anti-DDos

    Do you have any proof to back that up?

    what kinda proof you want, happy to do that as well

  • @tauseef said:

    @x0x0x said:

    @tauseef said: I used to sell Anti-DDos

    Do you have any proof to back that up?

    what kinda proof you want, happy to do that as well

    Which company was that done under?

  • @x0x0x said:

    @tauseef said:

    @x0x0x said:

    @tauseef said: I used to sell Anti-DDos

    Do you have any proof to back that up?

    what kinda proof you want, happy to do that as well

    Which company was that done under?

    eFlame hosting

    https://hostadvice.com/hosting-company/eflame-hosting-reviews/#user-reviews

    A user of service itself bought the business from me

  • LeviLevi Veteran

    @tauseef said:

    @x0x0x said:

    @tauseef said:

    @x0x0x said:

    @tauseef said: I used to sell Anti-DDos

    Do you have any proof to back that up?

    what kinda proof you want, happy to do that as well

    Which company was that done under?

    eFlame hosting

    https://hostadvice.com/hosting-company/eflame-hosting-reviews/#user-reviews

    A user of service itself bought the business from me

    Wait, are you Punjabi man?

Sign In or Register to comment.