These are good questions and you asked them humbly. I hope this is a good response.
Can a VPN service like say the one provided by Private Internet Access. If the only port they have opened on a server is an OpenVPN port, no http, mail, or anything else, can it be DDoSed?
Yes, absolutely. So I'll start with the literal meanings and go into the technicalities.
DoS = Denial of Service
DDoS = Distributed Denial of Service
So a DoS usually comes from one source, or is really small. DDoS is likely to come from a botnet and be rather large, at least in term usage.
A DoS attack can be very simple, or more complicated. If you want to "deny service" from a service, you usually have to keep it from giving service. That could mean simply disconnecting a cable. Or making so many fake orders on a website that there's nothing else in stock, in which case there's no more service which people can take.
More commonly, a DoS can be a network flood enough to saturate the link. If their connection can only handle 10MB/s of traffic and you flood them with 10+MB/s of traffic, not much else is going to get through. Any services, OpenVPN, SMTP/email, HTTP, all depend on the network link on the server to serve traffic. The firewall on the server itself pretty much can do nothing other than drop traffic for ports already open (or move traffic around in silly ways if needed). But it won't stop traffic from hitting the interface. You can send UDP traffic or even a completely different layer 4 altogether, and it'll probably get to the host and have an effect, at least in terms of network saturation.
More efficiently in terms of bandwidth, you can do HTTP benchmarks. If the webserver/web code is slow or particularly misconfigured, that alone will make a website mostly unavailable. If the service is over TCP at all (I think OpenVPN can do TCP and/or UDP), a TCP syn flood is possible.
So you really have to look at network saturation, application saturation, service saturation, and server saturation. If any of those are "saturated", it can be a successful denial of service.
If I wanted to try it in person, set up my own VPN server and DDoS it, are there simple legitimate DDoS services or methods or are they all black market?
Kind of iffy. You may have issues with hosting providers on both ends. Most hosting providers don't like their network being needlessly flooded. For a DoS from a single source (or multiple, if you have several VPSs), you can try hping3. I have seen one DDoS-as-a-service website, and maybe there are some "legitimate" ones, but that is still questionable. You can search for them and try them if you like. Your best option is to test it out locally. If you can get three machines and a switch, you can set the server to negotiate to 10Mbit/s (to make it easier) on the ethernet link, have the attacking machine flood the server, and see what happens when the real client tries to reach it.
You can also do that in a VM environment, all on your desktop. Of course, it's not entirely as realistic due to certain factors, but may be enough of a test. And keep in mind, DoS on a switch is much harder than over a router. Routers are so much slower than switches in terms of packet-per-second performance. They are often the bottle neck in many cases.
If you want a good DDoS service to do a real world test (which is a bad idea), you can try the black market sites on Tor.
I hope this helps a bit! Let me know if you have any more questions about this.
Sincerely,
Teran
