How does Fly Proxy handle DOS attacks?

[naz1]

How does Fly Proxy handle DOS attacks?

I have an api server with two machines that I am going to go to prod with soon.

Was wondering if there is anything I should be doing to harden the security.

I have went through the “going to production” section in docs, but it does not mention anything about DOS attacks. Searching on here did not yield any information either.

Thanks!

[matthewford]

Not that I know of, I would use a WAF in front of fly, such as AWS Cloudfront or Cloudflare

[greg]

Further to this I’d agree about adding something like Cloudflare (though that often causes other issues, like with custom domain SSL verification or getting a client’s actual IP/country as the request now has to pass through an extra proxy). Definitely test it first to check it doesn’t break somthing.

I recall Fly mentioning it but I’m not sure what the current protection is:

server was unreachable until re-deploy

Yeah a little of that! We reuse IPv4 addresses when people delete apps and free apps churn pretty frequently. You never know how someone dirtied an IP. Free services attract people who are prone to getting DDoSed. We mitigate DDoS attacks a whole /24 block at a time. Today’s issue was caused by a DDoS mitigation bug. You won’t notice most DDoS attacks, but it’s still worth avoiding higher risk IP space.