Advanced DDoS Protection: Enterprise-Level Multi-Layer Filters

Advanced DDoS Protection: Enterprise-Level Multi-Layer Filters

This guide provides a comprehensive defense strategy against complex and large-scale DDoS attacks. We combine kernel-level hardening, stateful packet inspection, eBPF/XDP filtering, smart Layer-7 throttling, and automation to simulate protection usually found in high-end enterprise infrastructures.

1. Kernel Hardening – SYN Flood Resistance

Begin by tuning your system for stronger TCP/IP behavior:

sudo sysctl -w net.ipv4.tcp_syncookies=1
sudo sysctl -w net.ipv4.tcp_max_syn_backlog=4096
sudo sysctl -w net.ipv4.tcp_synack_retries=1
sudo sysctl -w net.ipv4.tcp_fin_timeout=30
sudo sysctl -w net.ipv4.tcp_rfc1337=1
sudo sysctl -w net.ipv4.ip_forward=0

Explanation:

• tcp_syncookies: Activates SYN cookies to defend against SYN floods.
• tcp_max_syn_backlog: Increases the queue size for incoming connections.
• tcp_synack_retries: Lowers SYN-ACK retries to reduce resource usage.
• tcp_fin_timeout: Reduces timeout for closed TCP connections.
• tcp_rfc1337: Mitigates certain SACK-related vulnerabilities.
• ip_forward: Prevents the server from acting as a router.

2. eBPF/XDP – In-Kernel Packet Filtering

Use eXpress Data Path (XDP) for ultra-lightweight in-kernel packet filtering:

sudo apt install clang libbpfcc-dev linux-headers-$(uname -r)
git clone https://github.com/xdp-project/xdp-tutorial
cd xdp-tutorial
make
sudo ip link set dev eth0 xdpgeneric obj drop-connection.o sec xdp_pass

This allows packets to be rejected at the lowest possible layer of the Linux networking stack—before reaching user-space or the kernel's TCP handler.

Other tools: dropbear-xdp, cilium-ebpf allow for advanced programmable firewall logic.

3. nftables – Precise L3/L4 Stateful Rules

sudo apt install nftables
sudo nft flush ruleset
sudo nft add table inet ddos
sudo nft add chain inet ddos input '{ type filter hook input priority 0; }'
sudo nft add rule inet ddos input ct state {established, related} accept
sudo nft add rule inet ddos input ip protocol tcp tcp dport {80,443} ct count over 50 drop
sudo nft add rule inet ddos input ip saddr /32 accept

These rules restrict the number of simultaneous TCP sessions per IP and prioritize established connections.

4. ipset + nftables – Automatic IP Blacklisting

sudo apt install ipset
sudo ipset create ddos_blacklist hash:ip timeout 3600
sudo nft add rule inet ddos input ip saddr @ddos_blacklist drop
sudo nft add rule inet ddos input ip protocol tcp tcp dport {80,443} ct count over 20 add @ddos_blacklist { ip saddr }

This setup will automatically add IPs to a blacklist if they exceed connection limits, and block them for one hour.

5. Layer-7 Throttling with NGINX + Lua

Use lua-resty-limit-req to control request rates on the HTTP level:

http {
  limit_req_zone $binary_remote_addr zone=clientlimit:10m rate=10r/s;
  server {
    location / {
      limit_req zone=clientlimit burst=20 nodelay;
      try_files $uri $uri/ =404;
    }
  }
}

This prevents request floods while keeping response times low for real users.

6. Web Application Firewall (ModSecurity + OWASP CRS)

sudo apt install libapache2-mod-security2
sudo cp /usr/share/modsecurity-crs/crs-setup.conf.example /etc/modsecurity/crs-setup.conf
sudo a2enmod security2
sudo systemctl restart apache2

ModSecurity with OWASP Core Rule Set (CRS) helps block Layer-7 attacks like SQL injection, XSS, and abnormal behavior patterns.

7. Fail2ban for HTTP DDoS

[http-flood]
enabled = true
port    = http,https
filter  = http-flood
logpath = /var/log/nginx/access.log
maxretry = 300
findtime = 60
bantime = 1800
action = iptables[name=HTTP-FLOOD, port="http,https", protocol=tcp]

Create the filter file at /etc/fail2ban/filter.d/http-flood.conf and restart:

sudo systemctl restart fail2ban

8. Live Traffic Monitoring and Alerts

• iftop – Realtime bandwidth per connection
• nethogs – Bandwidth by process
• tcpdump – Packet-level inspection
• ebpf-exporter – Prometheus-compatible stats for kernel metrics

Visualize using Grafana, Prometheus, or Netdata. Add alerts when thresholds exceed safe limits.

9. Edge Protection – Proxy/CDN Layer

• Cloudflare: Under Attack mode, rate limiting, IP firewall
• AWS Shield, Google Cloud Armor, or OVH Anti-DDoS for hosting infrastructure

Always hide your origin IP address when using reverse proxies. Block all direct access to your server.

10. Automation and Emergency Scripts

Use cron jobs, Ansible, or Jenkins to automatically:

• Rotate blocked IPs daily
• Pull blacklists from abuse databases (e.g., Spamhaus DROP, FireHOL)
• Push alert messages to Discord or Telegram bots

Summary

This system combines the following techniques:

• Kernel tuning for SYN flood mitigation
• eBPF/XDP filtering for fast packet drops at NIC level
• nftables + ipset for dynamic blacklists
• Layer-7 protection using WAF and Lua rate-limiting
• Monitoring and alerting using real-time network tools
• Edge-layer shielding with CDN or proxy firewalls

Combined, these methods offer a powerful and scalable solution—suitable for modern websites, game servers, APIs, and SaaS platforms that need to withstand aggressive DDoS threats.