Advice on protection against DDoS attacks on my server

[Miru]

Hey! I sometimes host a TF2 server for a streamer, and was recently a victim of a DDoS attack. I use my own internet, for more control over the server, and it didn't go very well. I would like information on DDoS protection providers, and/or information that can help with preventing/weaknening these attacks.

My knowledge of networking is still relatively small so if you give some complex information, please elaborate.

I am posting this here because the reddit requires you to use reddit alot, and the tf2 forums are... something.

EDIT: since someone replied i'm guessing this has been picked up by a search engine, if you want to be *mostly* free from ddos attacks, use -enablefakeip in server launch parameters (on the srcds shortcut), and grab the IP from console after it opens. your server won't show up in the list, but you can tell people to connect using the console, using an IP that won't get you ddosed (HOPEFULLY MAYBE IDK IT WORKS SO FAR)

also don't fall for the lowering maxrate forum post, if people start crashing from your server due to some random network message, increase your sv_maxrate

[Judgmental Amaterasu]

I'm assuming you're hosting the server as a dedicated server using your computer? There are ddos protection services available but they won't be free. I'm sure there's someone around here more tech savy than I am with network protection though who may chime in.

[Iceira]

The new DoS attack should do this themself block them that cant login or keep hammer the Door,

The worst put you on the ignore after first wrong try, not the first time a person miss type something and you need to know do not get 3 fails in a row with in the time slot, again we are over in option how trigger happy do you want it to be.

You might want a router to do it, ( some are advance and other are not )

im not sure why you write here, steam in it self , do not have have it, but i get it , its a forum. about a game that filter user by it. (this is security) and should be there with them that deal with it.

maybe even game own forum if its in the app. ( or server dedicated app )
& Try see it as stick info to the app or hardware that use it, so next person can find it better.

[Miru]

Автор сообщения: |<- Iceira ->|

The new DoS attack should do this themself block them that cant login or keep hammer the Door,

The worst put you on the ignore after first wrong try, not the first time a person miss type something and you need to know do not get 3 fails in a row with in the time slot, again we are over in option how trigger happy do you want it to be.

You might want a router to do it, ( some are advance and other are not )

im not sure why you write here, steam in it self , do not have have it, but i get it , its a forum. about a game that filter user by it. (this is security) and should be there with them that deal with it.

maybe even game own forum if its in the app. ( or server dedicated app )
& Try see it as stick info to the app or hardware that use it, so next person can find it better.

Hey! Nice to see that you're trying to help! Just an issue, could you rephrase it a bit better? Not to be harsh, but it's pretty hard to understand what you're saying.

[Iceira]

Sure see it a a options some is to basic , other is better to use more room for failed input by user if this is Login/pw wrong entry input.

and the point is dont tell user you did not do it correctly. ( same as dont show or tell or give info on it ) maybe this is part of what user dont get.

why will i tell you that your pw is wrong , ( did i not just told you the username was right and something is here. )

so now you get it, dont show dont tell dont give , either you have the right info to get in or you dont.

then all this is said , DoS is just a cleaver script or worst piece of crap , depend on how simple they are, some block at ip and never remove a blocked ip-adr, and not all isp use same ip to same user, thats the part with static as same ip-adr, so as you see ,its not that simple.

dos attack definition
https://en.wikipedia.org/wiki/Denial-of-service_attack
and they keep update or expand new ways in what it should do.

so then ppl say DoS attack then its not that simple even then word itself say it all.

[Iceira]

ohh forgot always test your own web or game service from browser or remote location do it work as it should. ( maybe best advice ) you wont read anywhere ( because all think ofc it do. and thats not always the case. )


ps.
Dont assume most people on earth is knowing what all that is about, you need experience in it educated or have huge network understandting, not even i know half it , but ask your self this what Fat chance is there that you ever get hands on it or have seen such attack from the inside, or even get information about it. ( so i bet its so few ppl on earth that actual have seen it, you need to work with it to even call it common, not even sure common is the right word for it part of job maybe. )

same DoS service
mass attack and single user attack , ppl might want to see the huge diffrence here.

well gl with it.

[Miru]

Автор сообщения: |<- Iceira ->|

ohh forgot always test your own web or game service from browser or remote location do it work as it should. ( maybe best advice ) you wont read anywhere ( because all think ofc it do. and thats not always the case. )


ps.
Dont assume most people on earth is knowing what all that is about, you need experience in it educated or have huge network understandting, not even i know half it , but ask your self this what Fat chance is there that you ever get hands on it or have seen such attack from the inside, or even get information about it. ( so i bet its so few ppl on earth that actual have seen it, you need to work with it to even call it common, not even sure common is the right word for it part of job maybe. )

same DoS service
mass attack and single user attack , ppl might want to see the huge diffrence here.

well gl with it.

Hey, I understand you're trying to help, but from what information i'm gathering, you don't know much about networking, and alot of the advice isn't actually helpful, thanks!

[Iceira]

Find the informations yourself , im not sure you are skill enough to get it , ask that app or dedicated server right place , there is no option in steam settings with it so ask that game devs or support.

[[HPP] Executive Plamp]

Even most hosting/game server providers have inadequate DDoS protection for gaming traffic.

The fact is, effective DDoS protection isn't cheap.


Typically connections via ISP to home do not have a huge amount of available bandwidth, and little to no flexibility to burst / scale up. This is something you cannot fix, so you have to do reverse-proxy and have your protections/cleaning/scrubbing up at the reverse-proxy. If you don't perform any reverse-proxy, or have your public IP (of home network) leak, they can simply attack it as it is the easiest to disrupt. Even if you drop all the traffic at your edge (modem/router) the pipe to the ISP is full of bogus traffic and thus attack is still effective.


There are so many challenges with DDoS and non-scaling services. (ie, a most game servers cannot be split over 10 different nodes.)

First - can you identify what is good or bad traffic? If an attacker performs a replay attack, do you have a method to determine this?

Second, can you scale your scrubbing capacity to handle large attacks? Can you buffer microburst attacks?


I would suggest identifying how much you are willing to spend for game server + protection, and then go from there finding a suitable solution.

[Sammuel]

use a vpn, it prevents you from getting ddos'd, but it won't help you if you are already getting ddos'd, remember that

[Miru]

hey this was from months YEARS ago, I learned just to use -enablefakeip ok bye pls no necro