Cloud Scrubbing Integrations

Auto-divert traffic to upstream scrubbing providers when attacks are detected

Overview

Cloud scrubbing integrations connect Flowtriq to upstream DDoS mitigation providers. When an attack is detected, Flowtriq calls the provider's API to activate traffic scrubbing. When the attack resolves, scrubbing is automatically deactivated and direct routing resumes.

This is different from firewall rules (which run firewall commands on your server). Cloud scrubbing diverts traffic at the network level before it reaches your infrastructure.

Supported Providers

Setup: Cloudflare Magic Transit

Prerequisites

• A Cloudflare account with Magic Transit enabled
• At least one IP prefix (/24 or larger) configured in Cloudflare
• An API token with Account:IP Prefixes:Edit and Account:Magic Transit:Edit scopes

Configuration Steps

1. Go to Dashboard → Integrations
2. Select Cloudflare Magic Transit (Scrubbing) from the type dropdown
3. Enter your API Token, Account ID, and Prefix ID
4. Enable Auto-divert to automatically announce the prefix when attacks are detected
5. Click Add Integration
6. Use the Test button to verify credentials and prefix access

Finding Your Prefix ID

After adding the integration, click Test - the response will show how many prefixes are on your account. To get specific prefix IDs, use the Cloudflare API:

curl -X GET "https://api.cloudflare.com/client/v4/accounts/{account_id}/addressing/prefixes" \
  -H "Authorization: Bearer {api_token}" \
  -H "Content-Type: application/json"

How It Works

1. Flowtriq detects an attack on one of your nodes
2. Flowtriq calls PATCH /accounts/{id}/addressing/prefixes/{prefix_id}/bgp/statuses with {"advertised": true}
3. Cloudflare begins advertising your prefix via BGP (convergence takes 30-90 seconds)
4. Traffic is routed through Cloudflare's scrubbing network
5. When the incident resolves, Flowtriq withdraws the prefix ({"advertised": false})
6. Direct routing resumes

Setup: OVH DDoS Protection

Prerequisites

• An OVH, SoYouStart, or Kimsufi dedicated server
• OVH API credentials (Application Key, Application Secret, Consumer Key)

Getting API Credentials

1. Go to api.ovh.com/createToken
2. Set the validity period (unlimited recommended)
3. Add these access rules:
   • GET /ip/*
   • POST /ip/*/mitigation
   • DELETE /ip/*/mitigation/*
   • GET /ip/*/mitigation/*
4. Save the Application Key, Application Secret, and Consumer Key

Configuration Steps

1. Go to Dashboard → Integrations
2. Select OVH DDoS Protection (Scrubbing)
3. Enter your Application Key, Application Secret, Consumer Key
4. Select your API endpoint (EU, CA, or US)
5. Enter the IP address to protect
6. Enable Auto-mitigate for automatic activation

How It Works

OVH already has built-in DDoS detection, but it operates on a higher threshold and slower detection cycle. Flowtriq detects attacks faster and can force-enable OVH's "permanent mitigation" mode via API, which applies stricter filtering to your IP.

• On attack: POST /ip/{ip}/mitigation with {"ipOnMitigation": "{ip}"}
• On resolution: DELETE /ip/{ip}/mitigation/{ip} (restores auto mode)

Setup: Hetzner Firewall

Prerequisites

• A Hetzner dedicated server with firewall configured in the Robot panel
• Robot API credentials (separate from Hetzner Cloud API)

Getting Robot API Credentials

1. Log in to robot.your-server.de/preferences
2. Under Webservice access, create a new login
3. Save the username (format: #ws+xxxxx) and password

Important: Configure Firewall Rules First

Flowtriq activates/deactivates the Hetzner firewall - it does not create rules. You must configure your firewall rules in the Hetzner Robot panel before enabling this integration. When Flowtriq detects an attack, it sets status=active; when the attack resolves, it sets status=disabled.

Configuration Steps

1. Configure firewall rules in the Hetzner Robot panel (Firewall tab for your server)
2. Go to Dashboard → Integrations
3. Select Hetzner Firewall (Scrubbing)
4. Enter your Robot login, password, and server IP
5. Enable Auto-activate firewall

Manual Controls

Each scrubbing integration has manual control buttons in the integrations list:

• Test - Verify API credentials and connectivity
• Activate - Manually start scrubbing (announce prefix / enable mitigation / activate firewall)
• Withdraw - Manually stop scrubbing (withdraw prefix / disable mitigation / deactivate firewall)

Auto-Withdraw Safety

When an incident resolves, Flowtriq checks if there are other active incidents for the same workspace before withdrawing. If multiple attacks are in progress, scrubbing stays active until all incidents resolve. This prevents flapping where scrubbing is withdrawn during a brief lull in a multi-wave attack.

Combining with Firewall Rules

Cloud scrubbing and firewall rules serve different purposes and work well together:

Recommended setup: Use firewall rules for immediate local protection (iptables rate limiting, protocol drops), BGP mitigation for network-level FlowSpec/RTBH at your border routers, and cloud scrubbing for upstream volumetric protection. All three trigger automatically on the same incident.