Distribued denial of service (DDoS) is unfortunately still becoming more and more common way to attack an organization's infrastructure.
This usually involves the use of multiple external systems (bots) to flood the target system with requests in an attempt to overload systems and prevent some or all legitimate requests from being fulfilled. These attacks work because for an unprotected system it can be difficult to distinguish between actual traffic and DDoS traffic.
If the incoming traffic exceeds your available connectivity / bandwidth, none of these tools or any other software will be able to help you (except for a service provider that has sufficient connectivity and protection). Any protection even against small DoS and DDoS is better than none, which will eliminate a substantial part of attacks on your services. You will reduce unnecessary utilization of your server resources (bruteforce attacks, massscanning, bots, etc.) and prevent those small attacks that may already limit your services before your provider notices them (provider may not even notice small attacks).
Below you can find some of the most popular, easy-to-use, but also very effective DDoS protection tools for securing your server.
DDoS Deflate
DDos Deflate is a small open source shell script that you can easily implement on your server and configure to mitigate most DDoS attacks.
Basic DDoS Deflate:
- Can automatically recognize rules within iptables or Advanced Firewall (APF).
- Ability to block IP addresses temporarily (preconfigured time limit is 10 minutes).
- It is possible to whitelist IP addresses.
- It is possible to whitelist hostnames.
- Can send email alerts when IP addresses are blocked.
Fail2Ban
Fail2ban works in a similar way to DDoS Deflate, it also denies traffic based on malicious IP address profiling. You can create your own rules and activate it for FTP, HTTP, SMTP service, etc.
Some of the main features:
- Easy configuration of some functions (HTTP, FTP, SSH, ...).
- Compatible with existing firewalls, for example.: iptables.
- Customizable blacklists.
- Ability to block automated attacks by brute force.
- Block IP address for certain time.
Fail2Ban is a good choice for each web server which uses SSH and other services.
Apache module - mod_evasive
The mod_evasive module is suitable for protecting Apache web servers from DDoS attacks. It includes email and syslog attack notifications. Mod_evasive is a powerful Apache module that has the benefits of adapting to real-time situations by creating rules at runtime based on the following detected patterns:
- Accessing the same page too many times per second.
- Creating 50 concurrent connections to the same process per second.
- Getting new requests from IP addresses that are included in blacklist.
Functions that can help prevent from DDoS attacks:
- Server admin can restrict access to certain pages based on the number of requests that one particular IP can make (DOSPageCount option).
- Access to the entire web page can be restricted based on the number of connections that are used by each IP using the DOSSiteCount option.
- The DOSHashTable feature can monitor who is accessing a Web server based on their previous visits, and can decide whether to allow or block connections.
Mod_evasive is relatively easy to use and because as a module it is "built-in" into Apache, it is easy to use.
Easy setup tutorial: https://coderwall.com/p/eouy3g/using-mod_evasive-to-rate-limit-apache
FastNetMon
FastNetMon is another high-performance DDoS mitigation tool based on a packet analyzer (PF_RING, sFLOW, Netflow, PCAP).
Basic functions:
- Can process incoming and outgoing traffic.
- Can trigger block script if certain IP loads network with a large amount of packets/bytes/flows per second.
- Can untag VLAN.
- Can decrypt encrypted protocols to investigate malicious packets.
- Redirects DDoS requests into "black hole".
- Works fine in mirrored networks.
- Can work on server / virtualized router
- High performance - decets DoS / DDoS in 1-2 seconds.
- High compatibility - works on Debian, Ubuntu, FreeBSD, MacOS, ....
HAPROXY
HaProxy HaProxy is an excellent load balancing tool and is also effective against DDoS attacks.
- Can block traffic based on bandwidth.
- Contains IP blacklists and enabled IP list in a database.
- Ability to block IP addresses, which may perform DDos.
- Bot identification.
- Protects from SYN flood attacks, can restrict connections, ....
DDOSMON
Another DDoS monitoring and mitigation tool is DDOSMON. It monitors traffic with possible attacks and responds by warning and triggering user-defined actions based on the type of attack.
It is able to detect the following attacks:
- SYN Flood
- UDP Flood
- ICMP Flood
Detects an attack, sends an email to the admin, and takes correct actions defined by the admin.
NGINX
NGINX also has powerful features to prevent DDoS attacks.
Some of the anti-DDoS features for NGINX are:
- Speed limitation, identification of concurrent IP addresses to restrict access based on IP addresses.
- ngx_http_geo_module - you can block whole countries using this function. Possibility to block users based on their geographical location.
- Can be combined with HaProxy for sufficent DDoS protection.