How to Secure a VPS Against DDoS Attacks

知識庫

A Distributed Denial of Service (DDoS) attack overwhelms your server or network with traffic, making it unavailable to legitimate users. While a VPS can't fully defend against massive volumetric attacks alone, several practical measures reduce vulnerability and impact.

Types of DDoS Attacks

Type	Target	Example
Volumetric	Network bandwidth	UDP flood, amplification attacks
Protocol	Server/network infrastructure resources	SYN flood
Application-layer	Specific application logic	HTTP flood targeting a slow endpoint

Layer 1 — Use a CDN/DDoS Protection Service

For meaningful protection against large volumetric attacks, a dedicated CDN or DDoS mitigation service in front of your VPS is generally necessary — a single VPS's network capacity is typically far smaller than what a determined attacker can generate. See How to Set Up a CDN in Front of Your VPS.

Layer 2 — Restrict Origin Access to CDN IPs Only

Once a CDN is in place, ensure attackers can't bypass it by hitting your VPS's IP directly:

sudo ufw allow from CDN_IP_RANGE to any port 443
sudo ufw deny 443

Layer 3 — Rate Limiting at the Web Server Level

Nginx can limit request rates per IP, mitigating smaller application-layer floods:

http {
    limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;

    server {
        location / {
            limit_req zone=general burst=20 nodelay;
        }
    }
}

Layer 4 — Connection Limiting

limit_conn_zone $binary_remote_addr zone=addr:10m;

server {
    limit_conn addr 20;
}

Limits how many simultaneous connections a single IP can hold open.

Layer 5 — SYN Flood Protection at the Kernel Level

sudo nano /etc/sysctl.conf

net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2

sudo sysctl -p

Layer 6 — Fail2Ban for Aggressive Request Patterns

Configure a custom Fail2Ban filter to ban IPs generating unusually high request rates — see How to Set Up Fail2Ban Custom Filters for Application-Level Protection.

Layer 7 — Firewall Rate Limiting

sudo ufw limit 443/tcp

Application-Level Mitigations

Cache aggressively so repeated identical requests don't hit the application/database — see How to Add Caching to Speed Up a Slow Web Application
Identify and optimize any particularly slow endpoints, which are common targets for application-layer attacks

Monitoring for an Active Attack

sudo tail -f /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -nr

A sudden concentration of requests from a small number of IPs, or an unusual overall traffic spike, is a strong signal.

Having a Response Plan

Confirm it's genuinely an attack, not a legitimate traffic spike (check content of requests, geographic distribution, user agents)
Enable more aggressive rate limiting temporarily
If using a CDN/DDoS service, enable "under attack" mode if available
Block clearly malicious IP ranges at the firewall

What a Single VPS Realistically Cannot Do

Be realistic: no amount of server-side configuration fully protects against a large, well-resourced volumetric DDoS attack — a dedicated upstream mitigation service is the only reliable defense at that scale.

Continue Reading

Browse more articles in Advanced Security & Compliance.

知識庫

分類

分類