☁️ I made my own little Cloudflare called Pietflare, it's a DDOS and probe detector with AI and with a central IP / ASN / country block list
Each server (VPS) sends suspicious probes, or DDOS attempts etc, from the access logs to the central admin and each server pulls a central blocklist every minute and blocks it in Nginx
It has a central dashboard where I can see any threats and then instantly block them but preferably the AI blocks it by itself
Positive users praise Pietflare's indie custom AI DDOS detector built on Hetzner VPS instances as a smart alternative to big tech, while negative users flag risks from its centralized false-positive blocking.
No Digg Deeper questions have been answered for this story yet.
http://Nomads.com and http://PhotoAI.com aren't on my Hetzner VPS fleet yet but I'll migrate them in soon too and then they'll also be protected
☁️ I made my own little Cloudflare called Pietflare, it's a DDOS and probe detector with AI and with a central IP / ASN / country block list
Each server (VPS) sends suspicious probes, or DDOS attempts etc, from the access logs to the central admin and each server pulls a central blocklist every minute and blocks it in Nginx
It has a central dashboard where I can see any threats and then instantly block them but preferably the AI blocks it by itself
☁️ I made my own little Cloudflare called Pietflare, it's a DDOS and probe detector with AI and with a central IP / ASN / country block list
Each server (VPS) sends suspicious probes, or DDOS attempts etc, from the access logs to the central admin and each server pulls a central blocklist every minute and blocks it in Nginx
It has a central dashboard where I can see any threats and then instantly block them but preferably the AI blocks it by itself
@levelsio We some Hetzner customer you can use with Cloudflare. https://github.com/gen0sec/synapse
If you pull and block directly in Nginx every minute, configuration reloads might hurt your performance at scale don't you think .
It's better to dump the central blocklist into an ipset at the firewall level (iptables/nftables) or use OpenResty with shared memory so Nginx handles it dynamically without reloads
@davpapp Oh very nice
@levelsio Why don't you just use cloudflare don't you think there service is a bit more advanced and actually they are not that expensive for basic protection?
@levelsio Is it a permanent or temporary ban?
@levelsio I put fake stuff, fake configs, fake directories, fake error messages, etc. Also use mod_security, mod_evasive, fail2ban, rate limit endpoints using php's apcu
@stealthexploit That's not how it works, it only reloads when the blocklist changes based on a hash, also it's a graceful reload with zero dropped connections
@mozhn_dev Usually 24h
@levelsio I'm going to ping you:)
@levelsio Did you do it just for fun? Or did you have some issues with Cloudflare?
@levelsio Super cool, dude 😎
Did you make it from the couch? 😁
@levelsio I needed this 😭. Everytime I see the log on my server bunch of ddos and probes like .env .git attaches.
@levelsio Interesting.
@levelsio Looks cool! Curious what pushed you to build your own vs using Cloudflare?
@levelsio If you need an access platform and you want to try the full feature set, I would give you a tour. We have an ML engine and CTI integrated in the agent. Updating every 5 minutes.
@levelsio I use fail2ban + CF updates
@levelsio it might look like i was trying to hack but i accidentally slipped and landed on my keyboard
@levelsio Doing similar thing month ago, but blocking the clankers from Cloudflare level, it alrady grow to 2k block list now,
The crazy thing I found is that some vuln scanner able to know sub domain that newly created even not yet indexed by google (scan cert)
