Your question is too broad, but in case of protecting from DDoS over WAN, nftables is not suitable simply because attacker can easily overwhelm your uplink. However, for high-performance scenarios, XDP is a better alternative to nftables. For LAN, I suppose rate-limit using nftables is sufficient to handle DoS (if you have untrusted devices in your network). I can't imagine of any DDoS scenario in LAN though. On 4/17/24 19:43, William N. wrote:
Hi, I have been searching and reading, and reading... I understand this is a huge and complex subject, especially for a non-expert. I read earlier discussions on this ML - some answers seem to say it is futile (i.e. something that should be done by the ISPs, not by the end clients), others suggest there is benefit in doing at least what is possible. So, I hope to have some things clarified by the experts here. XY: I am trying to do what is right for the network security of a SOHO LAN. The nodes are distrusted, i.e. there is no assumption that they are/will always be "clean" just because they are on the LAN. My questions: 1. Is there a point to attempt DoS/DDoS protection directly on the LAN nodes (Linux based)? 2. What is the right approach (using nftables)?
