What happens to your connection / modem when you are DDoSed and how can you prevent it?

Question

I want to learn more about how DDoS and DoS attacks affect the network and how you can prevent them. I know how they 'work' and why the network is overloaded but I still dont know if a router / computer that's connected to a router is being DDoSed, if that affects the modem (that's connected to the router).

And if it's possible to protect my router and (game) servers on my computer (that will be port forwarded) against these attacks with, for example, Cloudflare DNS and / or setting up a VPN server.

Kind regards,

Ruben

Answer 1

From the outside, only your public IP address is visible. A DDoS is sent to this public IP, which is your modem. If your modem passes this to the router, your router then has to decide if it sends this to a device in its network, or disregard the package.

In any case, it really depends on the hardware which of all these is going to fail first.

It is possible the modem fails first, then packets don't come in at all, and are stopped at the modem.

Its possible the router is weaker, so the modem relays the packets, and the router fails. It depends on how the router fails if the treshold for the modem is reached or not, but its possible the modem will fail after the router fails.

Its also possible a specific port is targetted, and the device behind it fails.

An attacker has to commit resources to do such attack, so they will likely stop once they see that whatever they're targetting is no longer responding. By that reasoning, if any of the devices in this loop fails, the attacker may stop and the other devices may be kept alive.

How can you prevent an attack like this? Have a modem that is capable of identifying an attack and then discarding it entirely without being affected.

NB: It's possible you have a modem/router device, one device that does both. In that case you would need a modem/router that is capable of stopping a DDoS attack, or add a modem to the signal that can do so.

In addition, keep in mind, that if an attacker wants your network down, you need expensive equipment with fall-over policies to deal with a DDoS. This solution is something you will not want in a home situation. You may want to look into the quickest way to recover from a DDoS attack, which is something that can identify the DDoS, and reset the system.

Final note: It's unlikely for a home user to be attacked like this, and performing a DDoS is illegal. It is likely that you know who will have performed the DDoS attack, so it is a far better idea to take legal actions after it was done, so it happens once and never again. For that, make sure you have sufficient evidence.

Answer 2

There are some steps you can try to mitigate this situation.

1. Unplug the modem router, download new firmware for the two on your phone if you need to. When you plug your modem and router back in, you should be assigned a new IP address. (I'm assuming yours is behind a FQDN so the new IP won't help much).

2. Go into the device that's holding the global IP for its WAN connection. Disable ping replies on the WAN interface. (Sometimes called stealth).

3. Record the offending IP addresses performing the attack. You can notify your ISP, or send emails to ([e-mail]). You can find out what companies own these addresses by doing an ARIN lookup.

4. Consider moving your server platform to a hosting service. (They have network engineers staffed to mitigate attacks like this). Or buy an IDS (intrusion detection system) for your network.