Base de Conhecimento

A Distributed Denial of Service (DDoS) attack overwhelms your server or network with traffic, making it unavailable to legitimate users. While a VPS can't fully defend against massive volumetric attacks alone, several practical measures reduce vulnerability and impact.

Types of DDoS Attacks

Layer 1 — Use a CDN/DDoS Protection Service

For meaningful protection against large volumetric attacks, a dedicated CDN or DDoS mitigation service in front of your VPS is generally necessary — a single VPS's network capacity is typically far smaller than what a determined attacker can generate. See How to Set Up a CDN in Front of Your VPS.

Layer 2 — Restrict Origin Access to CDN IPs Only

Once a CDN is in place, ensure attackers can't bypass it by hitting your VPS's IP directly:

sudo ufw allow from CDN_IP_RANGE to any port 443
sudo ufw deny 443

Layer 3 — Rate Limiting at the Web Server Level

Nginx can limit request rates per IP, mitigating smaller application-layer floods:

http {
    limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;

    server {
        location / {
            limit_req zone=general burst=20 nodelay;
        }
    }
}

Layer 4 — Connection Limiting

limit_conn_zone $binary_remote_addr zone=addr:10m;

server {
    limit_conn addr 20;
}

Limits how many simultaneous connections a single IP can hold open.

Layer 5 — SYN Flood Protection at the Kernel Level

sudo nano /etc/sysctl.conf

net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2

sudo sysctl -p

Layer 6 — Fail2Ban for Aggressive Request Patterns

Configure a custom Fail2Ban filter to ban IPs generating unusually high request rates — see How to Set Up Fail2Ban Custom Filters for Application-Level Protection.

Layer 7 — Firewall Rate Limiting

sudo ufw limit 443/tcp

Application-Level Mitigations

• Cache aggressively so repeated identical requests don't hit the application/database — see How to Add Caching to Speed Up a Slow Web Application
• Identify and optimize any particularly slow endpoints, which are common targets for application-layer attacks

Monitoring for an Active Attack

sudo tail -f /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -nr

A sudden concentration of requests from a small number of IPs, or an unusual overall traffic spike, is a strong signal.

Having a Response Plan

1. Confirm it's genuinely an attack, not a legitimate traffic spike (check content of requests, geographic distribution, user agents)
2. Enable more aggressive rate limiting temporarily
3. If using a CDN/DDoS service, enable "under attack" mode if available
4. Block clearly malicious IP ranges at the firewall

What a Single VPS Realistically Cannot Do

Be realistic: no amount of server-side configuration fully protects against a large, well-resourced volumetric DDoS attack — a dedicated upstream mitigation service is the only reliable defense at that scale.

Related Articles

• How to Set Up a CDN in Front of Your VPS
• How to Install and Configure Fail2Ban on Ubuntu & Debian
• Nginx Performance Tuning: Worker Processes, Caching & Gzip