About Ddos

Hello friends!
My website is constantly getting ddos attacks. I bought a waf for 15 dollars a month and it saved me. However, waf issues captcha to each ip address 1 time a day.
This disturbs the users. I aim to make my own ddos protection.
I use Node.js.
express-rate-limit
Interestingly, the package closes access to all users in a ddos attack. Cloudflare is not a solution either. I want to solve it myself for free.
What are your solutions to protect against Layer 7 ddos attacks? I am planning to write a rate limit and ip ban system with redis, but I doubt whether it can protect or not.
I would be very happy if you share your experiences on this subject

zfc said:

Cloudflare is not a solution either.

Click to expand...

That's strange. Did you maybe expose your website hosting IP?

Where do you host your site? If possible, try moving it to one of the bigger hosting companies like Namecheap (They support Node.JS), let them take the heat and handle it.

LilMosey said:

That's strange. Did you maybe expose your website hosting IP?

Click to expand...

My site was constantly down unless I blocked requests from all policies except the country I live in via Cloudflare
I opened captcha, activated the ddos section in the waf settings and set it to high and block level. I made the maximum number of requests that can come in 10 seconds 60. I blocked the ip address one by one by hand, but unfortunately there was no solution.
It did not know my ipv4 address. Resource usage was not high on my server, network usage was not high, but access was going I use aapanel

Try some reputed webhosting company and before purchase make sure about protection of website.

flprocess said:

Where do you host your site? If possible, try moving it to one of the bigger hosting companies like Namecheap (They support Node.JS), let them take the heat and handle it.

Click to expand...

limallo said:

Try some reputed webhosting company and before purchase make sure about protection of website.

Click to expand...

Unfortunately, my project is a high resource consuming project. I don't think they will allow hosting at all, so I have to run it with pm2. Hosting does not allow the use of pm2



I am currently using contabo, the attack does not work with waf, but when I remove waf, my site closes
Unfortunately, it is not possible for me to use hosting. It is a project that consumes a lot of resources and should not use a node app that should work asynchronously. Thank you very much for your suggestion. I will definitely try it in my other projects

zfc said:

Unfortunately, my project is a high resource consuming project. I don't think they will allow hosting at all, so I have to run it with pm2. Hosting does not allow the use of pm2


View attachment 264895
I am currently using contabo, the attack does not work with waf, but when I remove waf, my site closes
Unfortunately, it is not possible for me to use hosting. It is a project that consumes a lot of resources and should not use a node app that should work asynchronously. Thank you very much for your suggestion. I will definitely try it in my other projects

Click to expand...

Contabo has DDoS Protection, have you checked with their support why it's not working?

flprocess said:

Contabo has DDoS Protection, have you checked with their support why it's not working?

Click to expand...

I did not know that, I will contact you immediately, thank you very much. I think for L4 but I hope they also provide it for L7.

Hello, did you find a solution?