I have setup a mining pool for a smaller project that uses Cryptonight variant 1. I have been running into problems with ddos attacks when other people started launching other mining pools.

At first it was layer7 attacks which hammered my webserver and i managed to successfully mitigate them. However attacks are still inbound on my actual pool ports 3333/5555/7777/8888 and my server rejects shares every now and then because of that.

Cloudflare can't help because i would need an enterprise package for that which is way to expensive. Blocking ip's manually is also a no go since source Ip's are spoofed.

I followed this guide to get some more layer4 based protection https://javapipe.com/ddos/blog/iptables-ddos-protection/

However i feel like there is more i can do. Suggestions are very welcome.

  • What hosting provider are you using? Most hosting providers offer DDOS protection paid/free.
    – jtgrassie
    Aug 6, 2018 at 17:18
  • I'm using Vultr.com who null routed me 4 times because of attacks exceeding 10Gbps Aug 8, 2018 at 16:17
  • You using their DDoS vultr.com/ddos ?
    – jtgrassie
    Aug 8, 2018 at 16:41
  • Yes, they just null route when an attack exceeds 10Gbps Aug 9, 2018 at 12:20
  • Just an idea (if you don't want to change provider), setup an EC2 instance on AWS running nginx to proxy to your vultr server(s). AWS has DDoS protection for free (but with limited control) but has no limit to the traffic. Downside is obviously paying for traffic that does go through and the cost of your EC2 proxy. Just an idea that would certainly cost less than CloudFlare enterprise.
    – jtgrassie
    Aug 9, 2018 at 12:33

1 Answer 1


It baffles me why pools attack each other, but that asside, there are other providers that offer DDoS services (sometimes for free) on top of their servers.

As per comment thread above, if you intend to stay with the same hosting company which is capping the protection, one way round this is to make use of another provider as a proxy.

N.b. your linked iptables article is pretty good too. I would use that on the proxy too.

  • 1
    Well my pool was doing 80% of the network hash-rate for a week until the attacks started so that's a pretty obvious incentive. What i ended up doing is backing up useful files and rm -rf ing the server. The support i got from Vultr.com was absolutely terrible. I have alot more interesting providers in my mind, i'm not sure why i ended up going with them in the first place. Anyways thanks for your thoughts about this. Aug 11, 2018 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.