DDoS mitigation strategy for multi-region setup

We're running services across Vultr and Hetzner, currently using Cloudflare for basic DDoS protection. Getting hit with ~15 Gbps attacks weekly, and Cloudflare's standard tier isn't cutting it anymore.

Looking at upgrading to Cloudflare Advanced DDoS or switching to Akamai. Has anyone successfully mitigated L3/L4 attacks across multiple regions? Cost is a factor—these attacks are burning through our budget. What's your experience with anycast + BGP blackholing vs. dedicated scrubbing centers?

Also curious if anyone's using open-source solutions like ModSecurity + fail2ban alongside CDN protection. Thoughts?

15 Gbps is serious. Before you spend big on Akamai, have you looked at AWS Shield Advanced or Cloudflare's DDoS + fallback to Imperva? DDoS is often cheaper when bundled.

Tbh, anycast+BGP blackholing works but requires coordination with your upstream ISPs—Vultr and Hetzner both support this, but you'll need to negotiate traffic diversion. Real question: are these attacks hitting your origin IPs directly or through Cloudflare? If they're going straight to origin, BGP blackholing buys you time but you lose legitimate traffic too.

We've had better luck with multi-CDN + anycast at origin level. Hit us up if you want specifics on the Vultr/Hetzner BGP setup.

Good point about AWS Shield Advanced—hadn't considered bundling. We're already pretty locked into Vultr/Hetzner though, so moving infra isn't really an option. Will definitely check out the Imperva angle since Cloudflare integration might be cheaper than full Akamai. Cheers!

Have you considered setting up your own BGP anycast network with a cheap upstream transit provider that offers automatic DDoS mitigation? Vultr actually offers BGP support on most plans. You'd basically announce your IPs from multiple regions and let the provider handle L3/L4 filtering upstream—way cheaper than Akamai and you keep control. Worth exploring before dropping money on Enterprise DDoS services.

Tracert's BGP anycast idea is solid, but real talk: Vultr's DDoS mitigation through their own upstream is honestly underrated and cheaper than you'd think. You're already there, so leverage it.

For 15 Gbps though, consider a hybrid: use Vultr's native filtering (they drop obvious crud at the edge), then layer a smaller Cloudflare paid tier just for your origin. Cuts costs vs. full Advanced DDoS. The key is not letting one pipe get saturated—distribute across your Hetzner nodes too with proper geo-routing.

What ASN are you announcing from? If you're not doing your own prefix, that's the first lever.