VergeCloud DDoS Protection

VergeCloud offers robust protection against DDoS attacks, designed in four stages to safeguard your website from malicious intrusions. This guide will help you understand how to implement and manage DDoS protection effectively through the VergeCloud dashboard and API.

Glossary Before Configuration

• DDoS: Distributed Denial of Service; an attempt to make a machine or network resource unavailable to its intended users by overwhelming it with traffic.
• Layer 3/4 Attacks: Network-layer attacks that target the infrastructure of a network, disrupting data flow.
• Layer 7 Attacks: Application-layer attacks that aim to exploit vulnerabilities in web applications.
• Cookie Challenge: A method used to verify users by requiring a browser cookie to be sent back with requests.
• Captcha: A security measure that requires users to perform a task to verify they are human.

Protection Levels

Layer 3/4 Protection

Layer 7 Protection

• Cookie Challenge: When enabled, VergeCloud sends a cookie to the user’s browser. The user must apply the cookie in subsequent requests. This helps to identify and block simple bots.
• JS Challenge: This method sends a JavaScript file to the user's browser, requiring it to perform an encryption operation to confirm its legitimacy.
• Captcha Challenge: This advanced challenge displays a Captcha to the user, ensuring that no load is placed on your server during traffic processing.

How To implement a DDoS strategy?

A- Limit the Abused IP Addresses

B- Limit or block most visited IPs

in front of each row you can find a button to add a firewall rule on this IP.

C- Use headers or user agents to block bots

Add Firewall Rule to challenge every incoming connection with most repeated user agents in your logs. 

D- Use rate limiting for most visited URLs

Add Firewall Rule to challenge every incoming connection to the most repeated URL in your logs.

 

E- Use JA3 finger printing to recognize bots

You need to enable JA3fingerprint from left side menu SSL/TLS -> Edge Servers

You can download a list of malicious JA3 fingerprints from here:

https://sslbl.abuse.ch/ja3-fingerprints/

then you can go to firewall and add a rule base of JA3 fingerprint and block or challenge malicious ones.

 

F- if none of the above solved your problem, turn on general DDoS mitigation

Disable DDoS Protection on a URL

If DDoS challenges disrupt a specific route, enter the URL in VergeCloud to exempt it from challenges. Use the "New Rule" option in the custom rules section.

Tips for Using Fetch or XHR When the Challenge is Active

If your domain (example.com) contains JavaScript that requests a subdomain (sub.example.com), consider the following:

Using Fetch

fetch("https://sub.example.com", { credentials: 'include' });

Using XHR

let xhttp = new XMLHttpRequest();
xhttp.open("GET", "https://sub.example.com", true);
xhttp.withCredentials = true;
xhttp.send();

Using Ajax

$.ajax("https://sub.example.com", { xhrFields: { withCredentials: true } });

Preflight or CORS Request Management

For subdomain requests, manage Preflight Headers as needed. If the request does not need a response, set the mode to no-cors:

fetch("https://sub.example.com", { mode: 'no-cors', credentials: 'include' });