Project L2 Server Fabric - L2j Reverse Proxy

[Tryskell]

I don't see the point if things are already filtered before reaching the GS. iptables/whatever ddos mitigation already filters the bad traffic, therefore the load balancing isn't needed. For the regular packets send, even on big players amount, an asynchronous mmocore is probably the only answer, and probably far enough.

 

Finally, can't you use existing solution rather than trying to implement solutions working only for L2 ? As I said, it remembers me "self coded firewalls" for Lineage 2 than RU forks add.

 

NGINX doesn't make the deal, for exemple ?

 

Good job nonetheless, you should test it on real, live, attacked server with before/after results.

Edited May 9, 2019 by Tryskell

[Elfo]

a

Edited October 1, 2021 by Elfocrash

[Nik]

Okay, we get it. Its just simple reverse proxy that has one good feature and that is the ability to change proxies while ingame.

Please do not advertise that thing as having the ability to protect against ddos attacks. It doesn't. It just hides the gameserver IP so the attacker cannot directly attack it. Its enough for a smarter attacker to lightly attack all of your proxies concurrently, just enough to not stress them too much, and those proxies will pass on the traffic just as if its a normal traffic, thus reaching the gameserver without any problems. The concealment of the real IP of the connections coming to the gameserver is working in favor of the attacker btw. Saying that your solution requires no additional firewall and whatever settings is just outright laughable, further nailing the fact that once you get attacked by a ddos, the whole solution will crumble down. So yes, you've created something that may route players traffic to a lower ping route. Nothing more, nothing less. There is no protection, it just conceals the gameserver and players' IPs.

 

If you really think your solution offers any kind of protection, fell free as @Tryskell said - test it on a real, live attacked server.

 

P.S. Yes, we do talk about NAT and tunnels, because it is the proper way to go if you want to offer any kind of basic protection. But of course, they alone do not offer the real solution, thats why firewall rules come into play after setting up proper NAT.

[Elfo]

a

Edited October 1, 2021 by Elfocrash

[Tryskell]

You're still and will probably forever be a showoff, so... Whatever.

 

I don't get the purpose of the topic if you don't want to speak about what you did, actual numbers of your solution, or if there is nothing to test.

 

I'm almost sure there are other solutions, way easier to manage and less disturbing for the player (enforcing players to switch proxies - the lagger simply have to switch of proxy too, enforcing other players to switch, or even, simply attack most if not all your proxies in same time, making all your players permanetly moving from one proxy to another).

 

Anyway, you're probably happy to show your e-penis.

 

I'm off the topic.

[Nik]

1 hour ago, Elfocrash said:

As I mentioned in my first post, the Autoproxy solution is currently in production and has been for about 2 weeks without any issues for a server that was constantly attacked.

Was? So its no longer attacked I assume. Your solution might only prevent very few gbps and mpps ddos. The server is still lucky to not get a bigger ddos.

 

1 hour ago, Elfocrash said:

Well it does though. It's not a cheap way to protect against it though. You can get very expensive ddos protected VPSes and host the proxies there.

And until mitigation kicks on, I can still down your proxies. Sure, once mitigation kicks on, you would be safe, but I can attack you again when your mitigation turns off and constantly harass your players by disconnecting them from every proxy.

 

1 hour ago, Elfocrash said:

This can't happen because the proxies only pass traffic through to the server if a player with this IP is connected to it. Since the ddos attacks come from another IP the proxy won't allow them through to the gameserver. The orchestrator keeps note of who is where and will only allow connected players traffic in.

Good, its not as horrible as I thought. But still, its a far cry from what it should be.

 

1 hour ago, Elfocrash said:

The proxy has such a small footprint that you don't need a beefy VPS to host it. 

While an in-kernel solution would have multiple times less overhead. The OS still needs to initialize the connection before it goes to your app, which means the machine where your proxy is hosted on is very vulnerable when it gets spammed by connections. An in-kernel solution can prevent initialization of connections, which in turn doesn't waste precious system resources.

[Elfo]

a

Edited October 1, 2021 by Elfocrash

[UnAfraid]

Looking at the video and the description the only way i could think of is if you kept the login server connection to client open, even after client gets connected to game server.

 

And upon move request to game server you send again login server -> client packet to connect to a game server and your proxy sends few packets to select the character that was previously selected.

 

I haven't tested this, just thinking out laud.

 

But even if this works like you've shown it still has one pretty big flaw, if you get disconnected and reconnected you'll be kicked out of instance, no party, possibly teleport to some safe spot (What normally happens when you relog) which is quite annoying for players

[Sail0rMo0n]

On 5/9/2019 at 3:10 PM, Elfocrash said:

This can't happen because the proxies only pass traffic through to the server if a player with this IP is connected to it. Since the ddos attacks come from another IP the proxy won't allow them through to the gameserver. The orchestrator keeps note of who is where and will only allow connected players traffic in.

:)
At least you can defend vs skids!

I don't see why this "solution" is a good idea, because proxies, being proxies, will add delay to client-server exchanges. Even with geolocation the proxy will still have to transfer data to the gameserver which adds to the aforementioned delay. It is worth to use this system only with very good machines and geolocation connections.

This system becomes even more unstable with ddos. It makes sense to redirect players to healthy proxies, however, the attacker can also redirect his/her bad traffic, especially if you transfer his/her character to the new target. Imagine players with loading screens popping up every 5 minutes during siege. At least in 2008 we knew when a server was down, whilst the siege was cancelled!

Therefore, it can be inferred that this "solution" may sound and be better than others from a technical standpoint, but the players may still suffer, whilst it is to be used with expensive equipment. To me, it makes more sense to rent a good server of a big company while having hundreds of anti-ddos servers protecting me than integrate this "solution". More code = more problems. I would only use this with many many proxies on a server with 5k+ active players under certain conditions.

PS: The OP is neither advertising nor selling, yet he/she discusses a system that we have not seen. It seems to me that he/she reveals more and more potential vulnerabilities of that "solution".

[Trance]

What if an attacker is ddosing the proxies?

 

It's just that good feeling to get back to L2J when you actually have some knowledge about programming and network. He most likely got inspired and tried it out. Why not.

Edited September 1, 2019 by Trance

[Elfo]

a

Edited October 1, 2021 by Elfocrash

[Nightw0lf]

share the server name you made it for so we can test it