What are your opinions on TCPShield?

[I_Luv_Cowz]

Hey MC-Market, I'd love to hear all of your guy's opinions on DDoS protection/Proxy services.
The options I've heard are: TCPShield, ProxyPipe, Cloudflare Spectrum, OVH's in-house DDoS protection for game servers.

My analyses of above options:

TCPShield - Good for OVH (since they're hosted in the same datacenter which makes latency lower), however it has recently been making connections unstable & increased latency ever since they revamped their whole system and added all the paid plans.

ProxyPipe - Never used, never really heard of until recently - and the last time it was mentioned on mc-market was in January 2020

Cloudflare Spectrum - Would be amazing and low latency, but bandwidth costs $1/GB + $20/Month for pro plan which is a pretty high rate.

OVH's in-house DDoS protection - This would mean exposing the backend IP and hoping people don't use a botnet. OVH's DDoS filtering is good for 1-50 source IPs, but when someone uses a larger botnet, its essentially useless.

My current setup:
OVH Game server using TCPShield free plan.

Issue with current setup:
Connections are unstable and player's ping often spikes (This doesn't happen without TCPShield).

Would love to hear any suggestions or opinions.

 

[Airee]

You've got a couple things wrong:
- ProxyPipe doesn't exist anymore. They were bought by Cosmic Global Networks, and you can purchase equivalent services via Tebex Shield.
- OVH does NOT fail at mitigating botnet attacks. The caveat with OVH is that they don't filter connections from inside the OVH network. Compromised OVH servers and servers bought via identity theft are the usual suspect for successful DoS attacks against OVH servers. TCPShield resolves this by using a large cluster of OVH servers across multiple datacenters which fail over if one goes out.

TCPShield is excellent.

 

[I_Luv_Cowz]

You've got a couple things wrong:
- ProxyPipe doesn't exist anymore. They were bought by Cosmic Global Networks, and you can purchase equivalent services via Tebex Shield.
- OVH does NOT fail at mitigating botnet attacks. The caveat with OVH is that they don't filter connections from inside the OVH network. Compromised OVH servers and servers bought via identity theft are the usual suspect for successful DoS attacks against OVH servers. TCPShield resolves this by using a large cluster of OVH servers across multiple datacenters which fail over if one goes out.

TCPShield is excellent.

TCPShield is excellent in for protection in theory, its just I have been having latency/network stability issues with it lately.
The purpose of this thread is to see other options and general community consensus.

The different between without TCPShield and with TCPShield latency is pretty significant - thus the reason for me creating this thread.

Edit: Can you possibly link me Tebex shield?

 

[Airee]

TCPShield is excellent in for protection in theory, its just I have been having latency/network stability issues with it lately.
The purpose of this thread is to see other options and general community consensus.

The different between without TCPShield and with TCPShield latency is pretty significant - thus the reason for me creating this thread.

Edit: Can you possibly link me Tebex shield?

https://tebex.io/
You can probably talk to the TCPShield guys. They're always willing to help us with any issue we have (even out of the scope of their services).

 

[Airee]

REDACTED

Your lack of understanding is alarming but not surprising for an owner of a hosting provider.

 

[I_Luv_Cowz]

Again, TLDR; If you are intending on using OVH's infrastructure, I recommend taking the full benefit of their industy-leading infrastructure and purchasing a machine specifically designated to act as your proxy. I can set this up for you with Layer 7 mitigation added.

So, from my understanding, you're saying it is possible to buy a specific OVH dedicated server that has better DDoS infrastructure and set it up to proxy your main server. What type of industry-leading infrastructure do these servers have that most OVH Game/Rise servers do not have? How would these servers be better at mitigating attacks than regular Game/Rise servers?

Edit: After talking to TCPShield staff, I was told that the way TCPShield handles DoS attacks by other OVH servers is contacting OVH engineers and getting internal traffic filtered. In theory, contacting OVH and getting internal traffic filtered should allow you to fully utilize OVH's DDoS protection and not require a proxy service such as TCPShield. Although I was also told that filtering internal traffic is not as easy as OVH flipping a switch - and OVH is not likely to expedite requests to do so.

 

[I_Luv_Cowz]

Allow me to clarify a little bit since I can understand where the confusion is coming from.

Yes. You can achieve the same thing ProxyPipe, TCPShield, whatever you call it now does. You may achieve this by using a dedicated server from OVH. What I am saying is OVH is industry-leading in this sector and as a result, because your infrastructure already exists on OVH's network, would be the most reasonable and cost-effective option while maintaining the micromanaging aspect that you seem to need regarding the latency issues that TCPShield has presented to you.

The chances of them being able to contact OVH engineers is highly improbable. I just don't see how they could have direct contact with the engineers. I know people who have millions of dollars flow through OVH and they don't have that level of access to their support department. I just don't see TCPShield being that large.

You can mitigate the issue of other OVH servers not being filtered by OVH by filtering it yourself. Their entire IP blocks are available in a neat list that I can compile for you. You may block these using OVH's WAF or you can achieve it with IPTables/FirewallD/UFW on the proxied server.

It would be better because you'll be proxying everything over an intermediary device that can benefit still from OVH's infrastructure and their dedicated hardware that does the scrubbing, along with designating that additional server to deal with the malicious traffic and achieve some level of deep-level scrubbing yourself. In doing this, it'll also conceal your ip address from most forms of attacks by emulating what cloudflare does. It will stand in front of your server, and as such, this server will respond to pings, etc, and THEN pass the request to the destination. Your servers primary address will never be able to be uncovered without some serious exploits of plugins installed on the source server or something of the sort, if done properly.

You do not need OVH engineers to block traffic to your server. If you are that concerned, you can purchase a plan from me and I can set this up for you along with a hardware firewall to manage the internal OVH traffic issue so that it's completely invisible to your server.

Blocking IPs with UFW isn't as powerful as filtering & null routing malicious traffic at a network level (For example, setting up UFW to block all ports doesn't replace the need for a network level Anti-DDoS). The traffic still hits your server - using bandwidth & cpu power. I understand that a proxy would conceal your main IP address however it would be just as bad if the proxy server got taken offline as it would your main server. The proxy server couldn't really have any better DDoS mitigation than the main server and could get DDoSed offline just as easily as the main the server could.

What do you mean by manage internal OVH traffic issue so it's completely invisible to my server?

 

[I_Luv_Cowz]

Yes, exactly. It will still use CPU time and CPU cycles. That's why I offered a hardware firewall to offload this. The point is that you don't need OVH engineers to do this.

The same can be said about TCPShield - you can achieve null routing by purchasing several failover IP addresses and disconnecting them as needed. This is effectively a null route. You'll be using this for your proxy and for your server behind the proxy. This becomes even more powerful when combined with OVH's vrack.

How would you achieve a hardware level null route? Say you have a 1GBPS port, if there is a 1GBPS attack, even if you firewall all of that traffic, it would still saturate your bandwidth. Using a failover IP wouldn't do much since they could easily find the new IP address - and attack that as well.

I can't seem to wrap my head around the idea that you can null route at a hardware level... I would appreciate a more in-depth explanation.

 

[Stefatorus]

OVH Game should be able to prevent DDoS Attacks (Layer 7 is not mitigated) on it's own, so there is no purpose in using TCPShield.
You can implement a layer 7 firewall to handle botting attacks yourself.

I've appended two guides I've made for further reading:
https://www.spigotmc.org/threads/guide-properly-firewalling-your-server-against-ddos.485645/
https://blog.entryrise.com/looking-into-minecraft-denial-of-service-ckdt3sjuw00ie9ss1go0f71mj

 

[I_Luv_Cowz]

OVH Game should be able to prevent DDoS Attacks (Layer 7 is not mitigated) on it's own, so there is no purpose in using TCPShield.
You can implement a layer 7 firewall to handle botting attacks yourself.

I've appended two guides I've made for further reading:
https://www.spigotmc.org/threads/guide-properly-firewalling-your-server-against-ddos.485645/
https://blog.entryrise.com/looking-into-minecraft-denial-of-service-ckdt3sjuw00ie9ss1go0f71mj

No OVH filters or mitigates internal traffic within the OVH network... Which is the issue we've been talking about for the past few responses, your response isn't very helpful.

 

[Zero]

Just to make sure, some people mentioned latency issues with TCPShield. However, I believe this only affects users of the standard (free) plan or when your traffic limit has been exceeded. TCPShield Enterprise has never failed to deliver in my opinion. Of course you wont get the best connection, stability etc. with a free plan.