Overview
ALYPOD protects its network with always-on DDoS mitigation at the edge of our datacenters. This article explains what that protection covers, what it does not, and how to respond if a Pod of yours is being attacked.
What is protected
- Network-layer floods such as UDP, ICMP and SYN floods are filtered before they reach your Pod.
- Volumetric attacks are absorbed and spread across our upstream capacity rather than saturating your Pod's link.
- Mitigation runs automatically; there is no need to enable it for a standard Pod.
Because filtering happens at the edge, an attack that is dropped upstream generally does not count against your Pod's bandwidth allowance.
What is not covered
- Application-layer (layer 7) attacks such as abusive request floods against a web app. These can look like legitimate traffic, so they must be handled by your application or a web application firewall.
- Misconfigured services that a scanner can hammer with normal-looking requests.
If you suspect an attack
- Open the ALYPOD Console and check the Networking graphs for your Pod. A sudden spike in inbound packets or bandwidth is the usual sign.
- Note the source addresses or patterns observed, for example with:
bash
sudo ss -tun state established | head
sudo journalctl -k --since "10 min ago"
- Tighten your own firewall so only required ports are open (see the ufw and firewalld articles).
- For web services, put rate limiting in place at the reverse proxy or use a CDN, and reduce exposed surface by binding internal services to the private network.
- Open a support ticket from account.alypod.com if the traffic is large or sustained so our network team can review the mitigation.
Reducing your exposure
- Expose only the ports you actually need.
- Keep systems patched and software up to date.
- Use strong SSH authentication and consider limiting SSH to your own IP.
Related articles
- [Configuring a firewall with ufw]
- [Monitoring bandwidth usage]
