Does a VPS mitigate risks of a DDOS attack versus shared hosting?

Question

A client of mine has a website on a shared hosting account, and one of the other accounts on that server was targeted by a DDOS attack, which of course brought all of the websites on that server down. We're talking about moving to a dedicated server or VPS to help mitigate this in the future. I am fully aware that this won't prevent DDOS attacks from ever happening, but being on their own server will at least reduce the risk because they won't be caught in someone else's collateral damage (as much?).

But I'm wondering if being on a VPS will have any effect at all in this regard -- yes the system is isolated from other systems at the software level, but my understanding is that there are still several virtual machines sharing one physical machine (and hence one physical network connection). My question is: does the quasi-isolation that a VPS offers provide any kind of benefit in terms of reducing the chances of being caught up in someone else's DDOS attack, or do you only get that kind of benefit from being on a separate physical server?

Answer 1

The risks will be slightly reduced, but not eliminated obviously.

In general, there will be fewer customers on a VPS host than reside on a shared webserver, making fewer potential targets. Of course this is all completely theoretical, and there's literally nothing that can stop a determined DDoS attack short of having a massive infrastructure scaled like say Google or Facebook.

Answer 2

The risk of being attacked is the same but

any decent provider that does some kind of mass hosting should have appropriate infrastructure to deal with attacks. That means your upstream should be more reliable (but the same is true for any provider that cares about it's own infrastructure)

There's no way anyone can survive a DDoS attack (given the attack is sufficiently large). Basically it boils down to infinite resources vs. finite resources.

Simple example:

Your provider has:

• a full 10GBit/s line to every server
• Servers powerfull enough to saturate the link

Attacker has:

• total bandwith of 5GBit/s

You can (in theory) survive the attack, in contrast to

Attacker has:

• total bandwith of 12GBit/s

there's nothing you can possibly do. If the attacker just sends a simple SYN-flood attack to you webserver you can't react to the attack because there's no way for you to log in over the line, it's already saturated (assuming it's the only way you reach that server).

SYN flood protection won't help because the 12GBit incoming will simply saturate the 10GBit pipe by sheer amount of data (hell 12GBit of SYN packets with no payload that has been sent yet is a lot). Especially when there are thousands of boxes and not 2 or 3 boxes....

iptables won't help you because by the time iptables can take care of the situation the pipeline of your network card is already full.

The only thing that will help is someone upstream that can cope with the incoming traffic to block each of boxes sending requests, but I doubt that with a cheap VPS (even if it's a few hundred bucks/month) anyone will care to take measures because of your VPS. They will only care because it hurts their own infrastructure, probably they'll just take your VPS offline so that the attacker thinks he or she has reached the goal and stop attacking early.

Keep in mind that with a VPS you are still affected by attacks to another (possibly completely unrelated) VPS on the same physical server. By using a physical server you'll at least be only subject to attacks that are targeted at your customers not some random customer of your provider that happens to be on the same physical host but in another VPS.

(I'm tired and english is not my native language, I apologize if none of this makes sense)

Answer 3

No

Answer 4

Its not about the resources on the machines but your VPS has its own IP and with shared hosting you have no dedicated IP address.

So its easier to block a DDOS to a VPS because the traffic has an unique destination IP.

Answer 5

A providers first response to a large DDoS attack is going to be damage limitation. Often that means blocking by destination IP address.

If you share an IP address with other people then you are likely to be caught-up in those blocks.

Shared web hosting services, especially non-https ones often use shared IP addresses. VMs and dedicated servers have their own network stacks and hence usually* have their own IP addresses.

A dedicated has the advantages over a VM that you aren't sharing CPU/Ram/storage resources and while you are at some point going to be sharing network resources the links between network devices in the provider network are likely to be bigger than the links to individual servers.

* Due to IPv4 shortages one provider i'm aware of only gives an IPv6 address by default and relies on a reverse proxy for IPv4. This setup may increase DDOS vulnerability as the reverse proxy may be hit with a DDOS.