#!/bin/bash

#
# Variables
#
# Adjust these to match your BuyVM VPS & Backend IP's!
#

BUYVM_UNPROTECTED_IP="BUYVM_UNPROTECTED_IP"
BUYVM_PROTECTED_IP="BUYVM_DDOS_IP"

BACKEND_IP="YOUR_BACKEND_IP"

#
# DO NOT CHANGE ANYTHING PAST THIS POINT
#

# make sure iptables isn't blocking FORWARD

iptables -P FORWARD ACCEPT

# enable IP forwarding and proxy ARP so we can forward our DDOS IP

sysctl -w net.ipv4.ip_forward=1
sysctl -w net.ipv4.conf.eth0.proxy_arp=1

# bring up our GRE to our Backend server

ip tunnel add gre1 mode gre local $BUYVM_UNPROTECTED_IP remote $BACKEND_IP ttl 255
ip link set gre1 up

# add our IP addresses
# NOTE: the 192.168.168.2 IP is only used for transporting packets to/from BuyVM, nothing more

ip addr add 192.168.168.1/30 dev gre1

# route our DDOS IP down the tunnel

ip route add $BUYVM_PROTECTED_IP/32 via 192.168.168.2

#!/bin/bash

#
# Variables
#
# Adjust these to match your BuyVM VPS & Backend IP's!
#

BUYVM_UNPROTECTED_IP="BUYVM_UNPROTECTED_IP"
BUYVM_PROTECTED_IP="BUYVM_DDOS_IP"

BACKEND_IP="YOUR_BACKEND_IP"

#
# DO NOT CHANGE ANYTHING PAST THIS POINT
#

GATEWAY_IP=$(ip route show default 0.0.0.0/0 | awk '{print $3}')
INTERFACE=$(ip -br addr show | grep $BACKEND_IP | awk '{print $1}')

# bring up our GRE to our BuyVM VPS

ip tunnel add gre1 mode gre local $BACKEND_IP remote $BUYVM_UNPROTECTED_IP ttl 255
ip link set gre1 up

# make sure our routing table exists

if ! grep -Fxq "100 BUYVM" /etc/iproute2/rt_tables
then
     echo "100 BUYVM" >> /etc/iproute2/rt_tables
fi

# add our IP addresses
# NOTE: the 192.168.168.2 IP is only used for transporting packets to/from BuyVM, nothing more

ip addr add 192.168.168.2/30 dev gre1
ip addr add $BUYVM_PROTECTED_IP/32 dev gre1

ip rule add from $BUYVM_PROTECTED_IP lookup BUYVM
ip route add default via 192.168.168.1 table BUYVM

# this is needed since we have multiple IP's on the GRE interface

iptables -o gre1 -t nat -I POSTROUTING -j SNAT --to-source $BUYVM_PROTECTED_IP

# handle our resolvers
# NOTE: this is sloppy and makes Poettering spin in his grave

echo 'nameserver 4.2.2.1' > /etc/resolv.conf
echo 'nameserver 4.2.2.2' >> /etc/resolv.conf

# finally cut over our routing
# NOTE: this will cut all access to your BACKEND IP!

ip route add $BUYVM_UNPROTECTED_IP via $GATEWAY_IP dev $INTERFACE onlink
ip route replace default via 192.168.168.1

Please follow these steps to use these scripts.

Do not ask for help with them unless you're an active customer, we won't help you and there's a 100% chance you'll get kicked from our channels.

*** Once this is enabled you will no longer be able to directly connect to your backend server! You must connect through your DDOS protected IP ***

Follow these steps:

On the BuyVM side:

1) create a file with nano named "/root/enable_tunnel.sh" and paste the contents of TAB #2
2) Change the IP address in the variables in the top half of the file.
3) Type: "chmod +x /root/enable_tunnel.sh".
4) Type: "/root/enable_tunnel.sh".

On the backend side:

1) create a file with nano named "/root/enable_tunnel.sh" and paste the contents of TAB #3
2) Change the IP address in the variables in the top half of the file.
3) Type: "chmod +x /root/enable_tunnel.sh"
4) Type: "/root/enable_tunnel.sh"