Please follow these steps to use these scripts.

Do not ask for help with them unless you're an active customer, we won't help you and there's a 100% chance you'll get kicked from our channels.

*** Once this is enabled you will no longer be able to directly connect to your backend server! You must connect through your DDOS protected IP ***

Follow these steps:

On the BuyVM side:

1) create a file with nano named "/root/enable_tunnel.sh" and paste the contents of TAB #2
2) Change the IP address in the variables in the top half of the file.
3) Type: "chmod +x /root/enable_tunnel.sh".
4) Type: "/root/enable_tunnel.sh".

On the backend side:

1) create a file with nano named "/root/enable_tunnel.sh" and paste the contents of TAB #3
2) Change the IP address in the variables in the top half of the file.
3) Type: "chmod +x /root/enable_tunnel.sh"
4) Type: "/root/enable_tunnel.sh"

#!/bin/bash

#
# Variables
#
# Adjust these to match your BuyVM VPS & Backend IP's!
#

BUYVM_UNPROTECTED_IP="BUYVM_UNPROTECTED_IP"
BUYVM_PROTECTED_IP="BUYVM_DDOS_IP"

BACKEND_IP="YOUR_BACKEND_IP"

#
# DO NOT CHANGE ANYTHING PAST THIS POINT
#

GATEWAY_IP=$(ip route show default 0.0.0.0/0 | awk '{print $3}')
INTERFACE=$(ip -br addr show | grep $BACKEND_IP | awk '{print $1}')

# bring up our GRE to our BuyVM VPS

ip tunnel add gre1 mode gre local $BACKEND_IP remote $BUYVM_UNPROTECTED_IP ttl 255
ip link set gre1 up

# make sure our routing table exists

if !grep -Fxq "100 BUYVM" /etc/iproute2/rt_tables
then
     echo "100 BUYVM" >> /etc/iproute2/rt_tables
fi

# add our IP addresses
# NOTE: the 192.168.168.2 IP is only used for transporting packets to/from BuyVM, nothing more

ip addr add 192.168.168.2/30 dev gre1
ip addr add $BUYVM_PROTECTED_IP/32 dev gre1

ip rule add from $BUYVM_PROTECTED_IP lookup BUYVM
ip route add default via 192.168.168.1 table BUYVM

# this is needed since we have multiple IP's on the GRE interface

iptables -o gre1 -t nat -I POSTROUTING -j SNAT --to-source $BUYVM_PROTECTED_IP

# handle our resolvers
# NOTE: this is sloppy and makes Poettering spin in his grave

echo 'nameserver 4.2.2.1' > /etc/resolv.conf
echo 'nameserver 4.2.2.2' >> /etc/resolv.conf

# finally cut over our routing
# NOTE: this will cut all access to your BACKEND IP!

ip route add $BUYVM_UNPROTECTED_IP via $GATEWAY_IP dev $INTERFACE onlink
ip route replace default via 192.168.168.1

#!/bin/bash

#
# Variables
#
# Adjust these to match your BuyVM VPS & Backend IP's!
#

BUYVM_UNPROTECTED_IP="BUYVM_UNPROTECTED_IP"
BUYVM_PROTECTED_IP="BUYVM_DDOS_IP"

BACKEND_IP="YOUR_BACKEND_IP"

#
# DO NOT CHANGE ANYTHING PAST THIS POINT
#

# enable proxy ARP so we can forward our DDOS IP

sysctl -w net.ipv4.conf.eth0.proxy_arp=1

# bring up our GRE to our Backend server

ip tunnel add gre1 mode gre local $BUYVM_UNPROTECTED_IP remote $BACKEND_IP ttl 255
ip link set gre1 up

# add our IP addresses
# NOTE: the 192.168.168.2 IP is only used for transporting packets to/from BuyVM, nothing more

ip addr add 192.168.168.1/30 dev gre1

# route our DDOS IP down the tunnel

ip route add $BUYVM_PROTECTED_IP/32 via 192.168.168.2