Technical overview

flowShield DDoS-Filters are based on x86 comodity hardware using Intel Xeon and AMD EPYC CPUs to process the defined application logic. Network connectivity is done using Intel 10G/40G network cards. Traffic is processed in userspace, using the netmap framework, which provides us with really high packet I/O.

Several posix threads has been implemented to handle incoming and outgoing traffic, statistics, export of flow information, dynamically manage flexible filter rules (flexrules), garbage collection, game-query-cache as well as cli commands. Some parts of flowShield has been written in inline Assembler to address some glibc performance limits.

TTD (Time-To-Detect)

DDoS Attacks are usually detected within 2-10 seconds depending on the size of the attack. This applies also for Carpet Bombing Attacks, which might target whole subnets instead of single hosts.

Flowrules

Flowrules are rules, which get deployed on our flowanalyzer infrastructure, which controls our DDoS-Protection. Flowrules can be utilized to trigger certain types of DDoS-Mitigation stages at specific amounts of traffic. Flowrules can match the following:

• IP-Protocol (e.g. 6 -> TCP)

• Packetsize (0-2000 bytes, range)

• Source-Ports (0-65535, range)

• Dest-Ports (0-65535, range)

• Traffic Rate (either pps/mbits)

While the following actions can be taken:

• Log Event

• Activate Layer4 + Log

• Activate Layer7 + Log

In the future, we might also provide the ability to announce flowspec routes or blackhole ip-addresses.

Flexrules

Flexrules are intended to allow us configuring the ddos-filters dynamically. Flexrules act similar to well known Router ACLs. Flexrules can match the following conditions:

• Source-IP-Range (non CIDR)

• Destination IP-Address

• IP-Protocol

• Source-Port-Range (0-65535)

• Destination-Port-Range (0-65535)

• Packet-Length-Range (0-1500)

• Packet Payload (string, 30 bytes max)

• GeoIP ASN

• GeoIP Country

The following actions are possible:

• Discard

• Accept (Whitelist)

• Ratelimit after X kpps rate (Whitelist)

• Ratelimit until X kpps rate (Discard)

ICMP

Echo-Reply packets are ratelimited to 1500 packets per destination ip-address. Once the ratelimit is reached, echo-reply packets are discarded. Echo-Request packets are ratelimited to 1500 packets per destination ip-address. Once the ratelimit is reached, the filter starts answering echo-request packets with echo-reply, packets will be no longer forwarded to the affected ip-address.

TCP

UDP

Technical details

flowProxy is a modified, well known reverse proxy, using our own program code to validate visitors based on the possibility if they can interact with the page. Coupled with L7-Captcha, our self written high performance captcha generator, we provide a full stack Layer7 DDoS-Protection solution.

flowProxy runs on comodity x86 hardware and uses Intel 10G network cards to provide even enough headroom for pretty large POST floods. Incoming traffic is prefiltered using a netmap application, which blocks repeatedly abusive clients on network level (IP Ban).

Typical layer7 floods ranging between 500 up to 50.000 requests per second. We have several technical implementations in place to filter even larger attacks.

flowProxy redirects traffic transparently on the following ports:

• Port 80 - HTTP

• Port 443 - HTTPS

• Port 8443 - HTTPS

• Port 30000-32000 HTTP/HTTPS - FiveM specific caching / filtering

All requests are sent from the following ranges:

• 160.20.144.8/29

• 45.11.17.32/29

• 185.117.1.32/29

• 109.71.255.32/29

Please make sure to whitelist the above ranges. You can use the X-Forwarded-For header to obtain the visitors real ip-addresses using for example apache mod_remoteip or nginx header mapping.

Customization

Currently we provide the ability to define custom challenges such as automated Javascript AES, Button Click as well as Captcha. Depending on the complexity of layer7 attacks, the best approach might be Captcha authentication.

SSL Certificates

Customers are supposed to upload their own ssl certificate upfront. Otherwise, the default (invalid) certificate is served. Please check our customer area as well as API docs for further information.

FiveM Game Filter

We have implemented a FiveM specific caching/filtering proxy on Port 30000-32000. The filter is intended to reply with cache content or block malicious HTTP floods targeting the HTTP server of FiveM. The FiveM filter also blocks exploits intended to crash the FiveM server.