DDoS basics and mitigation options

Quick answer: A DDoS (Distributed Denial of Service) attack floods your server or its uplink from many sources at once so real users can't get through. Cloud2Y offers DDoS protection as a configurable option when ordering (and it can be discussed for running services via ticket). If you're under attack right now: collect timestamps and symptoms and contact support immediately.

Overview

Attacks come in three broad classes: volumetric (saturate bandwidth with junk traffic), protocol (exhaust connection tables with SYN floods and the like) and application-layer (look like real HTTP requests but overwhelm the app). Defense differs per class — which is why "just block the IPs" rarely works: there are thousands of them.

Before you start

• Assess your risk profile honestly: game servers, e-commerce in competitive niches and anything political attract attacks far more often than a portfolio site.
• Know your normal traffic profile (vnstat, monitoring) — you can't spot abnormal without a baseline.

Step-by-step guide

1. At order time: select the DDoS-protection option in the configurable options if your project is at risk — protecting from day one beats retrofitting mid-attack.
2. Layer your own defenses: a CDN/proxy in front of websites hides the origin IP and absorbs application-layer noise; rate limiting (nginx limit_req, fail2ban) blunts small floods.
3. Don't leak the origin: once behind a proxy, the server should only accept web traffic from the proxy's ranges — a leaked IP makes the proxy useless.
4. If attacked: note the start time, symptoms (port dead? site slow? SSH fine?), any patterns; run ss -s and check vnstat -h; then open a ticket right away with the details — response options depend on attack type and your protection level.
5. Afterwards: review what was hit and adjust — enable protection, add the proxy layer, tune rate limits.

Common issues

• Every outage blamed on DDoS: most "attacks" turn out to be a runaway bot, a viral post, or an app bug — check logs and connection counts before concluding.
• Blocking IPs one by one during a real flood: futile at scale; upstream filtering is what helps.
• Buying protection but exposing the origin IP in DNS history, mail headers or subdomains.

When to contact support

During any suspected attack — immediately, with timestamps and symptoms. Also open a ticket to discuss protection options, capacities and pricing for your specific service and location; specifics vary and are confirmed per configuration, not from a generic table.

Frequently asked questions

Does Cloud2Y offer DDoS protection?

Yes, as a configurable option at order time; for running services open a ticket to discuss options for your configuration and location.

What should I do during an attack?

Note the start time and symptoms, check connection counts and traffic (ss -s, vnstat -h), and contact support immediately with the details.

Will a CDN protect me?

A CDN or proxy absorbs much application-layer noise and hides your origin IP — but only if the origin accepts traffic exclusively from the proxy and the IP never leaks.

Related articles

• Allowed and prohibited network use
• Cloud2Y network overview
• How to report network issues to support
• How to contact Cloud2Y support

Need a hand? Contact Cloud2Y support →