Urgent Firewall Setup for DDoS Mitigation, OVH [Paid]

Status
This thread has been locked.
A

Albert481

Feedback score
0
Posts
44
Reactions
4
Resources
0
Hi! My server has been faced with DDoS attacks which saturate our bandwidth. We have the OVH Game-64, comes with the GAME firewall.

I would require some advice/solution on how to secure our network and solve this issue once and for all.

Some other information:
- Using 2 OVH bare metal (Game-64 and Rise-2)
- TCPShield not an option since we're based in Asia/Singapore
- Unsure of which firewall settings to use


Current Firewall:
image.png


Current Game Firewall:
image.png



Contact me on Albert#0691. Only looking for experienced network engineers dealing with Large servers.


Update #1
- Narrowed down issue to DNS.
https://paste.gg/p/anonymous/f203fbfd036b4a1ea08dc8406e2a08b9
https://paste.gg/p/anonymous/a1525ac88543408c8f6cedbd072587c3

Update #1
- Followed this guide but the /etc/resolv.conf is not updating.
https://docs.ovh.com/sg/en/public-cloud/change-instance-dns-servers/
 
Last edited:
Click to expand...
PebbleHost
High performance, consistent uptime and fast support. Minecraft hosting that just works.
Troaxx

Troaxx

Feedback score
1
Posts
149
Reactions
24
Resources
0
Albert481 said:
Hi! My server has been faced with DDoS attacks which saturate our bandwidth. We have the OVH Game-64, comes with the GAME firewall.

I would require some advice/solution on how to secure our network and solve this issue once and for all.

Some other information:
- Using 2 OVH bare metal (Game-64 and Rise-2)
- TCPShield not an option since we're based in Asia/Singapore
- Unsure of which firewall setting to use

Current Firewall:
image.png


Current Game Firewall:
image.png



Contact me on Albert#0691. Only looking for experienced network engineers dealing with Large servers.
Click to expand...

Unrelated but I'd like to know since I'm from Singapore too, why can't you use TCPShield?
 
Arik

Arik

System Admin
Supreme
Feedback score
67
Posts
1,304
Reactions
654
Resources
0
Troaxx said:
Unrelated but I'd like to know since I'm from Singapore too, why can't you use TCPShield?
Click to expand...
TCPShield doesn't cover those locations. Although technically you can use TCPShield, your not going to get great latency.
 
Feedback

Feedback

Supreme
Feedback score
7
Posts
72
Reactions
68
Resources
0
If you're using Bungee, change all your ports & do this for each port.
1.2.3.4 = backend address
1234 = port(s)
Code: 
iptables -I INPUT ! -s 1.2.3.4 --dport 1234 -j DROP
 
Last edited:
A

Albert481

Feedback score
0
Posts
44
Reactions
4
Resources
0
Feedback said:
If you're using Bungee, change all your ports & do this for each port.
1.2.3.4 = backend address
1234 = port(s)
Code: 
iptables -I INPUT ! -s 1.2.3.4 --dport 1234 -j DROP
Click to expand...
Our network is already secured and accessible by bungee. The firewall setup I am requesting is to help with DDoS mitigation.
 
Status
This thread has been locked.
Top