๐ฆ๐๐ ๐จ๐๐๐ง๐๐ ๐ ๐๐๐ผ๐ฆ ๐๐ง๐ง๐๐๐ ๐๐๐๐๐ก๐ฆ๐ง ๐ ๐ฌ ๐๐ก๐๐ฅ๐ (๐จ๐ฃ ๐ง๐ข ๐ญ๐ฌ๐ต ๐ฟ๐ฒ๐พ๐/๐๐ฒ๐ฐ), ๐๐ก๐ ๐๐๐๐๐๐ฉ๐๐ ๐ ๐ด๐ฌ% - ๐ญ๐ฌ๐ฌ% ๐๐๐ข๐๐ ๐ฅ๐๐ง๐ ๐ข๐ก ๐๐ง๐ง๐๐๐ ๐๐๐๐๐ก๐ง๐ฆ, ๐๐ก๐ ๐ญ๐ฌ๐ฌ% ๐ฆ๐จ๐๐๐๐ฆ๐ฆ ๐ฅ๐๐ง๐ ๐ข๐ก ๐๐๐ฆ๐๐๐๐ก๐ ("๐ก๐ข๐ฅ๐ ๐๐") ๐๐๐๐๐ก๐ง๐ฆ
Heyyy beautiful people ๐๐พ...its mee againnnn ๐ซ
Sooo, I decided to run another little "experiment" on my infrastructure to test its resiliency....andddd, I was able to simulate a DDoS attack on my infra (up to 109 reqs/sec), while protecting it using Cloudflare GCP Firewall Rules :)
๐ฆ๐ผ๐ผ, ๐ต๐ผ๐'๐ฑ ๐ ๐ฑ๐ผ ๐ถ๐?
โข Provisioned a
@googlecloud @kubernetesio (GKE Cluster)
โข Set up
@IstioMesh Public Gateway for accepting external connections into the cluster
โข Created a Proxied DNS record on
@Cloudflare, mapping the domain name to the GCP Network Load Balancer (NPLB) IP used by the Ingres Service
โข Created GCP Firewall Rules to restrict access to the NPLB to only Cloudflare source IPs
โข Created a Cloudflare rule to rate-limit the incoming requests to the GKE Cluster Gateway -- only 50 reqs allowed within a 10s sliding window
โข I created abt 3 attack sources (simulating DDoS attackers) and 1 baseline source (simulating the "real" traffic); 2 attack sources connected to my gateway via the domain name, while 1 connected via the IP address
I wanted to test if the IP would also be protected, just as Cloudflare protects the hostname
---
๐ง๐๐ ๐ฅ๐๐ฆ๐จ๐๐ง๐ฆ๐ฆ๐ฆ๐ฆ!
I ran the tests for about 30 mins, and...
โข All the requests to the Gateway LB IP were blocked by the GCP Firewall Rule
โข Achieved an 80% block rate on the requests from the "attack" clients (sending abt 35 reqs/sec each, comfortably exceeding the rate-limit rule of 50 reqs in a 10s sliding window)
I needed to ensure that in a real-world scenario, real user traffic won't be affected during "attacks" like these...So, I set up a baseline client to send requests to the Gateway while the "attacks" were ongoing (at 4 reqs/sec, below the rate-limiting threshold), and...
โข It achieved a 100% success rate; ALL baseline requests went through ๐!
After sending about 109 reqs/sec (attacks baseline) to the GKE Gateway, only abt ~11 reqs/sec made it through (100% baseline and ~20% attack)
80% of the attack clients were blocked by Cloudflare, without affecting ANY of the baseline reqs :)
Now, this wasn't a volumetric DDoS attack, but a simulated one...during a real-world volumetric DDoS, my infra would be protected by the Cloudflare DDoS Protection feature :)
---
๐ก๐๐ซ๐ง๐ง๐ง...
I'll be sharing a case-study soon, explaining my thought processes, the architecture, the DDoS environment, and how everything could benefit ur organization infra ๐
#DevOps #PlatformEngineering #CTOs #CEOs #Startups #CloudEngineering #SoftwareEngineering #VPEngineering #DDoS #SecurityEngineering #DevSecOps #GoogleCloud #Cloudflare