Configure Robust DDoS Protection Systems

This skill provides expertise in designing and configuring comprehensive DDoS protection across multiple layers of network infrastructure, with deep knowledge of attack vectors, mitigation strategies, rate limiting, traffic analysis, and configuring various DDoS protection tools and services. Core defense-in-depth principles cover Layer 3/4 protection (network and transport layer filtering), Layer 7 protection (application-layer analysis and filtering), edge protection (CDN and network-edge mitigation), infrastructure hardening (server and application resilience), and real-time traffic monitoring/anomaly detection. Attack classification distinguishes volumetric attacks (UDP floods, ICMP floods, amplification attacks), protocol attacks (SYN floods, fragmented packet attacks, Ping of Death), application-layer attacks (HTTP floods, Slowloris, RUDY), and reflection/amplification attacks (DNS, NTP, SSDP, Memcached amplification).

Network-layer DDoS protection covers a comprehensive iptables rule set - dropping invalid packets and non-SYN new connections, blocking bogus TCP flag combinations, rate-limiting new TCP connections globally and per source IP (via the recent module), and limiting UDP/ICMP flood rates - plus sysctl-based network hardening (SYN flood protection via syncookies and backlog tuning, reduced TIME_WAIT socket duration, increased netdev budget for high packet rates, TCP buffer tuning, and reverse-path filtering).

Application-layer DDoS protection covers Nginx rate limiting configuration - separate rate-limit zones for login/API/general traffic, connection limiting per IP and per server, request size and timeout limits, and endpoint-specific rate limits (stricter for /login, moderate for /api/) returning HTTP 429 on limit breach - and Apache ModSecurity custom rules detecting POST flood patterns (counting POST requests per IP and blocking for a cooldown period once a threshold is exceeded) and slow-attack protection (rejecting oversized request bodies that could indicate a slow POST attack).

Use this skill when configuring layered DDoS protection - network-level iptables/sysctl hardening plus application-level rate limiting via Nginx or ModSecurity - for a production system exposed to potential attack traffic. It is well suited to internet-facing services needing defense against volumetric, protocol, and application-layer attacks. It is not meant for internal-only services with no internet exposure, or as a substitute for a dedicated cloud/CDN DDoS mitigation service for very large-scale volumetric attacks.

Input: the exposed service's network topology, expected traffic patterns, and the attack vectors to defend against.

Output: iptables/sysctl network hardening rules and Nginx/ModSecurity application-layer rate limiting configuration. Example Nginx rate limiting zones:

limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

location /login {
    limit_req zone=login burst=5 nodelay;
    limit_req_status 429;
}

Configures iptables, Linux sysctl network parameters, Nginx rate limiting, and Apache ModSecurity rules; layers alongside cloud/CDN DDoS mitigation services for edge protection.

Infrastructure and security engineers configuring layered DDoS protection for internet-facing services, and teams that need both network-level and application-level rate limiting rather than relying on a single defense layer.