1

There was a question asking this posted earlier (seems to have been removed) and I did some research to find the answer.

You can protect http and https from DDoS using Cloudflare but non-http services like ftp are configured to bypass Cloudflare.

If my domain is example.com how can I configure pool.example.com so that it is protected for stratum+tcp? e.g.:

stratum+tcp://pool.example.com:3747
1

It is true that ordinary Cloudflare only protects http and https from DDoS. For this reason, other services are configured to bypass Cloudflare and operate directly on your server. It seems trivial that if an attacker can find out the real IP of your web server they can just attack that, but that is beside the point.

Cloudflare offers a service called Cloudflare Spectrum:

Spectrum extends the power of Cloudflare to protect not just your web traffic, but your other TCP ports and protocols from layer 3 and 4 DDoS. By enabling TLS encryption, Spectrum reduces the ability for attackers to snoop and steal sensitive data.

Your origin infrastructure is exposed when delivering TCP services such as: custom gaming protocols, remote server access (SSH), secure file transfer services (SFTP), and email (SMTP).

Attackers can directly send volumetric DDoS traffic to those services, degrading web performance or bringing them down entirely. Attackers can also snoop unencrypted traffic on those ports to steal confidential data or credentials.

Obviously, we are not concerned if someone snoops our worker password provided it is different to our pool login (no-one has ever complained if someone starts mining on their worker) but, the ability to protect service using tcp other than http and https is valuable.

If you are legitimately concerned about the possibility of attack, ALL service should be masked to protect the identity of your actual server, nothing should be available directly and your server IP should never be exposed.

Now for the bad news:

To start using Spectrum, you'll need to be subscribed to a Cloudflare Enterprise plan.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.