Cloud Scrubbing Integrations

Auto-divert traffic to upstream scrubbing providers when attacks are detected

Overview

Cloud scrubbing integrations connect Flowtriq to upstream DDoS mitigation providers. When an attack is detected, Flowtriq calls the provider's API to activate traffic scrubbing. When the attack resolves, scrubbing is automatically deactivated and direct routing resumes.

This is different from firewall rules (which run firewall commands on your server). Cloud scrubbing diverts traffic at the network level before it reaches your infrastructure.

Supported Providers

Setup: Cloudflare Magic Transit

Prerequisites

• A Cloudflare account with Magic Transit enabled
• At least one IP prefix (/24 or larger) configured in Cloudflare
• An API token with Account:IP Prefixes:Edit and Account:Magic Transit:Edit scopes

Configuration Steps

1. Go to Dashboard → Integrations
2. Select Cloudflare Magic Transit (Scrubbing) from the type dropdown
3. Enter your API Token, Account ID, and Prefix ID
4. Enable Auto-divert to automatically announce the prefix when attacks are detected
5. Click Add Integration
6. Use the Test button to verify credentials and prefix access

Finding Your Prefix ID

After adding the integration, click Test - the response will show how many prefixes are on your account. To get specific prefix IDs, use the Cloudflare API:

curl -X GET "https://api.cloudflare.com/client/v4/accounts/{account_id}/addressing/prefixes" \
  -H "Authorization: Bearer {api_token}" \
  -H "Content-Type: application/json"

How It Works

1. Flowtriq detects an attack on one of your nodes
2. Flowtriq calls PATCH /accounts/{id}/addressing/prefixes/{prefix_id}/bgp/statuses with {"advertised": true}
3. Cloudflare begins advertising your prefix via BGP (convergence takes 30-90 seconds)
4. Traffic is routed through Cloudflare's scrubbing network
5. When the incident resolves, Flowtriq withdraws the prefix ({"advertised": false})
6. Direct routing resumes

Setup: OVH DDoS Protection

Prerequisites

• An OVH, SoYouStart, or Kimsufi dedicated server
• OVH API credentials (Application Key, Application Secret, Consumer Key)

Getting API Credentials

1. Go to api.ovh.com/createToken
2. Log in with your OVH account
3. Set the validity period to Unlimited
4. Add all 5 of these access rules exactly as shown (each one is a separate row on the OVH form):
   GET /ip

   GET /ip/*

   GET /ip/*/mitigation/*

   POST /ip/*/mitigation

   DELETE /ip/*/mitigation/*
5. Click Create keys
6. Save the Application Key, Application Secret, and Consumer Key immediately. The consumer key is only shown once.

Configuration Steps

1. Go to Dashboard → Integrations
2. Select OVH DDoS Protection (Scrubbing)
3. Enter your Application Key, Application Secret, Consumer Key
4. Select your API endpoint (EU, CA, or US)
5. Enter the IP address to protect
6. Enable Auto-mitigate for automatic activation

How It Works

OVH already has built-in DDoS detection, but it operates on a higher threshold and slower detection cycle. Flowtriq detects attacks faster and can force-enable OVH's "permanent mitigation" mode via API, which applies stricter filtering to your IP.

• On attack: POST /ip/{ip}/mitigation with {"ipOnMitigation": "{ip}"}
• On resolution: DELETE /ip/{ip}/mitigation/{ip} (restores auto mode)

Setup: Hetzner Firewall

Prerequisites

• A Hetzner dedicated server with firewall configured in the Robot panel
• Robot API credentials (separate from Hetzner Cloud API)

Getting Robot API Credentials

1. Log in to robot.your-server.de/preferences
2. Under Webservice access, create a new login
3. Save the username (format: #ws+xxxxx) and password

Important: Configure Firewall Rules First

Flowtriq activates/deactivates the Hetzner firewall - it does not create rules. You must configure your firewall rules in the Hetzner Robot panel before enabling this integration. When Flowtriq detects an attack, it sets status=active; when the attack resolves, it sets status=disabled.

Configuration Steps

1. Configure firewall rules in the Hetzner Robot panel (Firewall tab for your server)
2. Go to Dashboard → Integrations
3. Select Hetzner Firewall (Scrubbing)
4. Enter your Robot login, password, and server IP
5. Enable Auto-activate firewall

Setup: DigitalOcean Cloud Firewall

Prerequisites

• A DigitalOcean account with at least one Cloud Firewall
• A personal access token with read + write scope

Configuration Steps

1. Generate a personal access token at cloud.digitalocean.com/account/api/tokens with read + write scope
2. Find your Firewall ID in the DigitalOcean dashboard (Networking → Firewalls → click your firewall → the ID is in the URL)
3. Go to Dashboard → Integrations
4. Select DigitalOcean Cloud Firewall (Scrubbing)
5. Enter your API token and Firewall ID
6. Enable Auto-activate

Setup: Vultr Firewall

Prerequisites

• A Vultr account with at least one Firewall Group
• An API key from the Vultr control panel

Configuration Steps

1. Generate an API key at my.vultr.com/settings (API section)
2. Make sure API access is enabled and your IP is whitelisted if you use the IP allowlist feature
3. Find your Firewall Group ID in the Vultr dashboard (Products → Firewall → click your group → the ID is in the URL)
4. Go to Dashboard → Integrations
5. Select Vultr Firewall (Scrubbing)
6. Enter your API key and Firewall Group ID

Setup: Linode/Akamai Cloud Firewall

Prerequisites

• A Linode (Akamai Cloud) account with at least one Cloud Firewall
• A personal access token with Firewalls read/write scope

Configuration Steps

1. Generate a personal access token at cloud.linode.com/profile/tokens with Firewalls: Read/Write scope
2. Find your Firewall ID in the Linode dashboard (Network → Firewalls → click your firewall → the ID is in the URL)
3. Go to Dashboard → Integrations
4. Select Linode Cloud Firewall (Scrubbing)
5. Enter your API token and Firewall ID

Manual Controls

Each scrubbing integration has manual control buttons in the integrations list:

• Test - Verify API credentials and connectivity
• Activate - Manually start scrubbing (announce prefix / enable mitigation / activate firewall)
• Withdraw - Manually stop scrubbing (withdraw prefix / disable mitigation / deactivate firewall)

Auto-Withdraw Safety

When an incident resolves, Flowtriq checks if there are other active incidents for the same workspace before withdrawing. If multiple attacks are in progress, scrubbing stays active until all incidents resolve. This prevents flapping where scrubbing is withdrawn during a brief lull in a multi-wave attack.

Combining with Firewall Rules

Cloud scrubbing and firewall rules serve different purposes and work well together:

Recommended setup: Use firewall rules for immediate local protection (iptables rate limiting, protocol drops), BGP mitigation for network-level FlowSpec/RTBH at your border routers, and cloud scrubbing for upstream volumetric protection. All three trigger automatically on the same incident.