4

In my home network, I currently have a Hitron cgnm-2250 acting as a modem/router combo with an IP Passthrough option enabled for a 2nd router connected to it (ddwrt nighthawk x6 r8000). I already have the 2 external IPs showing for each device, but my issue is getting DDoS'ed offline.

I have my computer that I stream off of connected directly to the Hitron, and my gaming consoles connected to my Nighthawk. People are obtaining the external IP address assigned to the Nighthawk router and are DDoSing that IP. The external IP assigned to the Hitron is safe from being DDoSed as the players only see the IP of the Nighthawk. I have the QoS setting on the nighthawk so it can use a max of 25% of my total bandwidth, this is theoretically to prevent all the bandwidth being used when I am being DDoSed.

So my question is why are these DDoS attacks bringing down the entire network? Shouldn't these attacks only affect/bring down my nighthawk because the Hitron shouldn't be handling any of that traffic? I theoretically should have even bandwidth leftover for the Hitron to run the stream and other applications. My end goal is to only have the consoles knocked offline and the computer stay connected.

Any solutions to this? I would prefer not to use a VPN to prevent these DDoS attacks as my speeds take a huge hit.

Improve this question
1
  • 1
    Primarily, if you're getting hosed because of a non high bandwidth application, maybe just redirecting that through a vpn would help.
    – munchkin
    Aug 3, 2015 at 13:59

2 Answers 2

Reset to default
2

Your Hitron device is still acting as a gateway. This means that any traffic targeted to your second device must be handled by the Hitron. When the Hitron device is running out of resources, every host which is using the Hitron as a gateway is affected.

First of all, it's not very effective to work around this issue without a external gateway like VPN. However you could evaluate the possibility to get a secondary, physically separated connection. (In Germany for example there's the option to use the TV cable for internet besides the phone line) You could also ask your ISP for help.

Improve this answer
2

As was stated a secondary IP via the same gateway will not help. This text-based diagram shows why:

{INTERNET} <---> [Hitron, the Gateway, 2xIP] <--IP Passthrough---(a)
   (a)---> [dd/wrt NightHawk, 2xIP] <---> Devices on the network

IP Passthrough only works because the Hitron device sees all the traffic first, then it goes to the NightHawk through that. As such a secondary IP won't help in this case, as the Hitron device is your gateway to the 'net.

Specifics of a DDoS are dependent on the attack vector being chosen for the attack. It sounds like you're concerned about bandwidth saturation which would consume all the available bandwidth of your network. Such a DDoS is designed to overload the pipe and consume all resources of the network. That means that if you have a pipe that can only handle 100Mbps of traffic and I attack via botnet/DDoS with 500Gbps of traffic, I have consumed all your resources. Even QoS won't solve that problem, as a DDoS is going to hit, and consume your entire network pipe (from the Internet, to the ISP, and then to your network), and in your setup the first thing hit is the Hitron. Remove that from the equation and your entire network goes down, even if you connect the NightHawk to the incoming connection, because that too will be the next hit.

The only way this would work is if the ISP is able to 'nullroute' your primary IP address at the beginning of DDoS, or to begin filtering DDoS traffic. When that gets nulled your second IP can work, or both can still operate with filtering in place at the ISP's side. Note though that if that second IP is in the same subnet as the other IP it's probably likely they will target that subnet as well with a DDoS, if they truly want to disrupt availability. ISPs may offer DDoS filtering or mitigation as well, provided you pay for the service.

True failover of type you're thinking of with the second device taking over and not still getting DDoS'd is to have a second connection into the network which can be switched to when the first is 'under attack'.

This, however, is only the most basic mitigation, because a threat actor going after you is likely going to eventually figure out your other connection and take it out as well, targeting both network gateways simultaneously.

DDoSes can be difficult to mitigate. The best option is to reach out to the ISP and see if they can help with DDoS filtering and mitigation - they're likely going to be your best resource for DDoS mitigation.

Improve this answer
2
  • It's not entirely clear what kind of DDoS attack it actually is (which tells you how/whether it really can be mitigated without just having two independent connections). I assume that they are not amplification attacks (like synflood), which do have practical mitigations; or spoofing that could be mitigated by egress filtering by the ISP. I presume that the gaming protocol is speaking peer-to-peer with the real attacker rather than purely to the server; so setting up the interfaces to only respond to a few server IPs may not be a possibility.
    – Rob
    Aug 3, 2015 at 14:37
  • @Rob That's a good point, however without further details we can only guess what they mean by "DDoS". Solely based on the other statements made on the OP's question ("25% of bandwidth", "DDoSed as [threat actors] only see the nighthawk IP", "prevent all bandwidth being used during DDoS"), I'm inclined to believe that the specific attack vector isn't the 'game server' itself, rather that they're afraid of bandwidth saturation attacks in general, such as "bandwidth saturation" strikes which attempt to consume the entire pipe and prevent additional in/out traffic.
    – Thomas Ward
    Aug 3, 2015 at 14:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .