How to Prevent DDoS Attacks on Your Server

Understanding DDoS Attacks

Distributed Denial of Service (DDoS) attacks overwhelm your server with traffic from multiple sources, making your service unavailable to legitimate users.

Types of DDoS Attacks

Volumetric Attacks

These flood your bandwidth with massive amounts of traffic. Common techniques include UDP floods, ICMP floods, and DNS amplification attacks.

Protocol Attacks

These exploit weaknesses in network protocols. SYN floods, Ping of Death, and Smurf attacks target the server's connection state tables.

Application Layer Attacks

The most sophisticated type, these target specific applications with seemingly legitimate requests. HTTP floods, Slowloris, and DNS query floods are common examples.

Prevention Strategies

1. Rate Limiting

Limit the number of requests from any single IP address:

# Nginx rate limiting
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

server {
    location /api/ {
        limit_req zone=api burst=20 nodelay;
        limit_req_status 429;
    }
}

2. Configure Fail2Ban

Fail2Ban monitors log files and automatically bans IPs that show malicious behavior:

# Install fail2ban
sudo apt install fail2ban

# Configure for nginx
sudo cat > /etc/fail2ban/jail.local << EOF
[nginx-limit-req]
enabled = true
filter = nginx-limit-req
port = http,https
logpath = /var/log/nginx/error.log
maxretry = 5
bantime = 3600
EOF

3. UFW Firewall Rules

# Limit SSH connections
sudo ufw limit 22/tcp

# Block known bad IP ranges
sudo ufw deny from 123.456.0.0/16

# Allow only necessary ports
sudo ufw default deny incoming
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

4. Use ServerGuard's Attack Prevention

ServerGuard shows the network connections on each server and lets an administrator act on them:

• Connection monitoring — See active connections per server
• Manual IP blocking — Add firewall rules from the console (there is no automatic blocking)
• Failed login tracking — Repeated SSH failures from one address raise an incident
• Attack dashboard — Review recorded events and incidents

5. CDN and DDoS Protection Services

For larger deployments, consider using a CDN like Cloudflare or AWS Shield that can absorb volumetric attacks before they reach your server.

Monitoring for Attacks

Set up monitoring to detect attacks early:

1. Connection count alerts — Alert when active connections spike above normal
2. Bandwidth alerts — Detect unusual traffic volume
3. Error rate monitoring — Spike in 429/503 errors indicates an attack
4. Geographic anomaly detection — Traffic from unusual countries may indicate a botnet

Incident Response Plan

1. Detect — Automated monitoring alerts your team
2. Analyze — Identify attack type and source
3. Mitigate — Apply rate limiting, block IPs, enable DDoS protection
4. Recover — Verify service restoration
5. Post-mortem — Document the attack and improve defenses

Conclusion

DDoS prevention requires a layered approach. No single solution is sufficient. Combine rate limiting, firewalls, monitoring, and DDoS protection services for comprehensive defense.