Re: DoS/DDoS protection for end nodes

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





Am 17.04.24 um 21:43 schrieb William N.:
I have been searching and reading, and reading... I understand this is
a huge and complex subject, especially for a non-expert. I read earlier
discussions on this ML - some answers seem to say it is futile (i.e.
something that should be done by the ISPs, not by the end clients),
others suggest there is benefit in doing at least what is possible. So,
I hope to have some things clarified by the experts here.

XY: I am trying to do what is right for the network security of a SOHO
LAN. The nodes are distrusted, i.e. there is no assumption that they
are/will always be "clean" just because they are on the LAN.

My questions:

1. Is there a point to attempt DoS/DDoS protection directly on the LAN
nodes (Linux based)?

2. What is the right approach (using nftables)?

you can rate-limit requests but for a real DDOS you have *nothing* on your side - your upstream connection is overloaded and dropping packets will gain you nothing




[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux