- Core distinction: DoS attacks stem from a single IP (easy to block with iptables); DDoS attacks come from distributed botnets requiring layered mitigation.
- L3/L4 attacks (UDP/SYN flood): Mitigated by enabling SYN Cookies in the Linux kernel and rate-limiting connections with iptables hashlimit.
- L7 attacks (HTTP flood): Mitigated at the reverse proxy layer using Nginx limit_req_zone and perimeter WAF scrubbing.
- Recommended architecture: Origin IP cloaking behind Anycast WAF and Nginx TLS 1.3 load balancers.
Distributed Denial of Service (DDoS) attacks aim to exhaust memory, network sockets, or server bandwidth. For initial operating system fortifying, review our guide on Linux VPS Server Hardening.
1. Core Fundamentals: DoS vs DDoS Architecture
The primary distinction lies in origin topology and overall network volume:
- DoS (Denial of Service): Traffic generated from a single IP source. Mitigated via static firewall rules.
- DDoS (Distributed DoS): Coordinated across thousands of compromised hosts globally. Demands behavioral inspection, rate limiting, and perimeter scrubbing.
2. Attack Vectors and Mitigation Strategies
The table below classifies primary attack vectors across the OSI stack and their Linux mitigation mechanisms:
Table 1: DDoS Attack Vectors vs Linux Defense Mechanisms
| Attack Vector | OSI Layer | Primary Impact | Recommended Linux Mitigation |
|---|---|---|---|
| SYN Flood | Layer 4 (Transport) | Exhaustion of incomplete TCP connection backlog table | Enable net.ipv4.tcp_syncookies = 1 in sysctl |
| UDP Reflection | Layer 3 / 4 (Network) | Bandwidth saturation via amplification (DNS/NTP) | iptables packet limits or edge Anycast WAF |
| HTTP Flood / Slowloris | Layer 7 (Application) | Worker thread exhaustion in web server | Nginx rate limiting and strict socket timeouts |
3. Linux Kernel Socket Tuning (/etc/sysctl.conf)
The Linux network stack can be tuned to survive SYN floods and drop spoofed packets early:
# Enable TCP SYN Cookies
net.ipv4.tcp_syncookies = 1
# Increase max syn backlog and connection queue
net.ipv4.tcp_max_syn_backlog = 4096
net.core.somaxconn = 8192
# Lower synack retries
net.ipv4.tcp_synack_retries = 2
# Enable Reverse Path Filtering against IP spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
# Ignore broadcast ICMP requests
net.ipv4.icmp_echo_ignore_broadcasts = 14. Packet Filtering with iptables
Dropping malicious frames inside the netfilter pipeline minimizes CPU overhead:
# Drop invalid TCP packets
iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
# Drop new connections with non-SYN flags
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
# Rate-limit new HTTPS connections per IP
iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW -m hashlimit --hashlimit-name HTTPS_LIMIT --hashlimit-above 25/sec --hashlimit-burst 50 --hashlimit-mode srcip -j DROP5. Infrastructure Cluster Interlinking
A DDoS-resilient host requires secured application proxies. Check our guide on Nginx Hardening & TLS 1.3 Configuration or explore the full production layout in our Interactive Architecture Visualizer.