Their firewall situation is not. Guess what, if you use the supplied firewall, any server from any other customer in the local NOC that your server is in, can connect to your server. They seem to be all "safely" behind the OVH firewall product.
You have to protect each server individually with its own in-machine firewall.
I don't want to automatically trust all other OVH customers.
At first I thought I was doing something wrong (more than a decade of setting up firewalls). But I did put in a support ticket and they confirmed this.
Maybe I'm wrong, maybe something I did not understand, but damn... If I'm not.... :-(
That's the standard practice?
OVH's own firewall is for DDoS/DoS protection, not for fine-grained security, did I understand OVH's information incorrectly?
Saying that because (by default) Docker screws with firewall rules on the VM when it starts up, to allow other hosts to communicate with the containers.
In other hosting environments, the workaround is to apply firewall rules to your VMs using the hosting infrastructure capabilities. eg separate to the iptables (etc) rules on each host
In the most general case, it seems other customers can actually send DDoS/volumetric traffic toward you from within OVH and it doesn't get picked up.
As of November 2019, OVH is listed by The Spamhaus Project as the world's
second worst Internet service provider for the proliferation of unsolicited bulk E-Mail
Looking at the same list now, it recently seems to have added fraud, and many malware distribution entries too.
Picking one at random:
https://www.spamhaus.org/sbl/query/SBL492369
That's showing a fair number of IPs.
If a firewall goes offline for 60 seconds, I will get hammered from OVH/DO networks. Not exclusively but they're the standout kings. Just think Psychz networks, but scaled up.
I know OVH's size plays into that. But size here is less about the number of net blocks and more about their bureaucratic disinterest in abuse (common to larger hosts, inc hosts I like).
There are comparable sized hosts in the US (AWS, Azure) but when it comes to crapty traffic, OVH makes them look small and insignificant[1].
Unlike moderation at scale, known attacks are often qualifiable, detectable patterns. Can we please care enough to notice & maybe eventually, one day interrupt them?
[1]disclaimer: Spam from Google/Azure & malicious SMTP traffic from AWS totally dominated the first ½ of this year. IDK why. It's since died off - which differentiates them from OVH/DO.
Seems like OVH is not on it anymore.
I moved to hetzner immediately, and I haven’t had such issues till today.
I know that you can’t expect much from cheap providers but OVH is extremely unprofessional in my experience.
It’s unacceptable that all these (cloud) hosting providers collectively make ISPs look good.
I can't imagine why anyone would want to run anything on the same networks that OVH uses to host spammers and scammers.
And good luck talking to an actual human at OVH if something goes wrong.