I have setup a mining pool for a smaller project that uses Cryptonight variant 1. I have been running into problems with ddos attacks when other people started launching other mining pools.

At first it was layer7 attacks which hammered my webserver and i managed to successfully mitigate them. However attacks are still inbound on my actual pool ports 3333/5555/7777/8888 and my server rejects shares every now and then because of that.

Cloudflare can't help because i would need an enterprise package for that which is way to expensive. Blocking ip's manually is also a no go since source Ip's are spoofed.

I followed this guide to get some more layer4 based protection https://javapipe.com/ddos/blog/iptables-ddos-protection/

However i feel like there is more i can do. Suggestions are very welcome.

  • What hosting provider are you using? Most hosting providers offer DDOS protection paid/free. – jtgrassie Aug 6 '18 at 17:18
  • I'm using Vultr.com who null routed me 4 times because of attacks exceeding 10Gbps – Archer Sterling Aug 8 '18 at 16:17
  • You using their DDoS vultr.com/ddos ? – jtgrassie Aug 8 '18 at 16:41
  • Yes, they just null route when an attack exceeds 10Gbps – Archer Sterling Aug 9 '18 at 12:20
  • Just an idea (if you don't want to change provider), setup an EC2 instance on AWS running nginx to proxy to your vultr server(s). AWS has DDoS protection for free (but with limited control) but has no limit to the traffic. Downside is obviously paying for traffic that does go through and the cost of your EC2 proxy. Just an idea that would certainly cost less than CloudFlare enterprise. – jtgrassie Aug 9 '18 at 12:33

It baffles me why pools attack each other, but that asside, there are other providers that offer DDoS services (sometimes for free) on top of their servers.

As per comment thread above, if you intend to stay with the same hosting company which is capping the protection, one way round this is to make use of another provider as a proxy.

N.b. your linked iptables article is pretty good too. I would use that on the proxy too.

| improve this answer | |
  • 1
    Well my pool was doing 80% of the network hash-rate for a week until the attacks started so that's a pretty obvious incentive. What i ended up doing is backing up useful files and rm -rf ing the server. The support i got from Vultr.com was absolutely terrible. I have alot more interesting providers in my mind, i'm not sure why i ended up going with them in the first place. Anyways thanks for your thoughts about this. – Archer Sterling Aug 11 '18 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.