OVH's DDoS Protection - Alpha/Beta Stage

Discussion in 'Server & Community Management' started by Spxify, Jun 26, 2013.

  1. Hello,

    Yesterday evening I have read a tweet of Oles from OVH, referring to their explanation of the DDoS protection and the future of their anti-ddos system (from now on called VAC).

    VAC is currently in alpha stage (only available in RBX) and does have a lot of false positives (as joehot200 said, correct me if I'm wrong), however, it is already better than being nullrouted. The system will detect a DDoS-attack and put your IP(s) behind the VAC-protection and the mitigation starts.

    They are planning on fully releasing a redundant system in September, which will mean a increase of 0.5 EUR to 10 EUR for existing and future services. Your best bet is to read the thread yourself, as I just found out they posted a English version today, besides, my french isn't that good as it used to be.


    I myself am eager to try it out and curious about the costs of the PRO version.
    • Informative x 9
    • Like x 2
    • Agree x 1
    • Disagree x 1
    • Useful x 1
  2. Thank you for letting us know, very informative.
    • Agree Agree x 1
  3. jtaylor69

    jtaylor69 Retired Moderator

    Had the vacuum applied to myself last month.
    It does have quite a lot of false positives, however many players were just happy to have the server up.
    • Disagree Disagree x 1
  4. LiLChris

    LiLChris Retired Moderator

    If this comes to BHS center, only way I would try it is if they offer to give me a free IP in case of failure. :p

    For now going to stick to the service I use.
    • Agree Agree x 1
    • Disagree Disagree x 1
  5. IIRC, almost all the OVH services come with multiple IPs?
    • Disagree Disagree x 1
  6. Default is 1 IPv4 and a /64 of IPv6.

    It is cheap though for another IPv4 ("IP Failover"), so not really a huge issue LiLChris. £0.90 + VAT for 1 month, though whether that would still be routed through them or not I don't know.
  7. Lol, though it may not seem much, ovh is giving you 18,446,744,073,709,551,617 ip addresses that should suffice LiLChris
    • Agree Agree x 1
    • Disagree Disagree x 1
  8. What... I have 1 main IPv4 that was allocated at purchase and 3 more IPv4 failovers that could be used for anything I wanted. So, I got 4 free IPv4s when I got my server.
    • Disagree Disagree x 1
  9. Are you actually using these IP Failovers included in the price?

    Can you actually see what IPs you have been allocated? In the control panel if you go to the IP Failover section (Dedicated servers > Services > IP Fail-over), it will show 3 IPs in that list if you have them. Otherwise it will just show the "Order an IP Fail-Over" link.

    For us, we have 2 IP Failover that we ordered @ £0.90 (+VAT) each.

    My understanding of the phrasing (from product description) "3 IPs maximum" is that we can't order more than 3 Failovers per Dedi?
    • Disagree Disagree x 1
  10. Maybe he he is with us, and you are using uk etc. otherwise, that doesn't make sense as an ipv6 /64 subnet is like a qatrillion IP's.
  11. I think we are both talking about IPv4.

    I am from the UK which is the product description I am talking about.

    The US site has a different wording "IPv4: 1, IPv4 Fail-Over: 3, IPv6: /64" no mention of maximum. If you then purchase extended features ($20/month) you can get free IPv4 address with a $1 setup fee.
    • Disagree Disagree x 1

  12. I am rather confident that with the PRO option enabled (unless too expensive) the false-positives will be a lot less, as you'll be able to tweak the configuration quite a bit yourself. Besides, as you said, many players will be happy to still have the server up instead of having it down or nullrouted for a day or longer. :)
  13. I have allocated three separate IPs, and I have one spare that I can allocate. It hasn't costed me anything, and I can still get another one for free if I want.
    • Like Like x 1
    • Disagree Disagree x 1
  14. how many pps and mbps protect the basic protection of ovh ?
  15. None, their VAC is not the basic/default option outside of their French datacenter(and even within I believe it's still an adon option). Also, I don't think there is a hard limit OVH puts on their protection. I think it's just one massive 160gbps shield of protection infront of all their VAC customers.
    • Disagree Disagree x 1
  16. There are different datacenters that offer such feature, a "big shared shield". I'm not sure how it's going to protect a huge network of servers. Wouldn't they be mad if you tank 5Gbps 1 hour straight?

    If you don't know how those appliances works (eg. by applying ACL's), how are you going to manage them correctly? If they ever provide that service it MUST be in an user-friendly way.
    • Disagree Disagree x 1
  17. Possibly, but who knows. They say when they roll out the system to all their datacenters, each will have 3 VAC units that can clean a total of 460gbps. That's a lot of traffic, considering the largest ever reported DDoS on the Internet was like ~250gbps.
    • Disagree Disagree x 1
  18. I doubt that they will be connected loadbalanced, each unit could only provide a specified amount of clean throughput. They would enable one device per "sector" in their datacenter, I guess
    • Disagree Disagree x 1
  19. Each unit will clean the traffic closest to the unit, let's say 25% of the traffic comes from USA then the BHS VAC will clean 25% and RBX/SBG will clean 75%. Knowing OVH, it will be user friendpy and besides that... they have pre-configured settings (such as websites, gaming, etc).

    They chose to increase the prices a tiny bit to avoid having to put a limit on protection capacity. The shield is only activated when you actually get DDoS'd, until then you won't be put behind the VAC system.
    • Disagree Disagree x 1
  20. Ash


    Yea they did say they would have setup configs for people.
    Also OVH is huge, considering 2 bucks per dedi plus all other service's. This could end up giving OVH millions of dollars a month, that should be enough to handle all the traffic should it not?
    • Agree Agree x 1
    • Disagree Disagree x 1