The reliable way to protect a server from distributed denial-of-service (DDoS) attacks is to keep hostile traffic away from the server in the first place. Put a CDN or reverse proxy in front of the origin, hide the origin address, allow inbound connections only from the edge network, and add separate controls for network floods and application request floods. Caching, scalable capacity, monitoring, and a written response plan complete the defense.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
A host firewall alone cannot absorb a large volumetric attack that fills your internet connection before packets reach the host. Firewalls and WAFs remain important, but they work best behind an upstream provider with scrubbing capacity and automatic mitigation.
As an Amazon Associate I earn from qualifying purchases.
What a DDoS attack is—and why one control is not enough
A DDoS attack distributes traffic or requests across many sources so that a service becomes slow or unavailable. The target may be the network link, a transport protocol, a web server, a database, or one expensive application endpoint. An attack can therefore look like either an enormous bandwidth spike or a relatively modest stream of requests that consumes CPU, memory, connection slots, database workers, or application threads.
Three broad classes require different controls:
- Volumetric attacks: floods of bits or packets attempt to saturate the upstream link. Once the link is full, a local firewall has little useful capacity left.
- Protocol attacks: malformed or excessive TCP, UDP, or connection traffic consumes state tables and network-processing resources.
- Application-layer floods: HTTP or API requests are made to expensive paths such as login, search, checkout, GraphQL, or mutation endpoints. Each request may be syntactically valid but costly to process.
UDP reflection and amplification is a common network-level pattern. An attacker spoofs the victim’s address in requests sent to third-party services; those services send replies to the victim, multiplying the traffic. CISA guidance calls for network-level rate limiting for legitimate UDP services, while large events require upstream mitigation from a hosting provider, ISP, or DDoS-scrubbing network.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
The protection model: place controls in layers
Use this traffic path as the design goal:
Clients → CDN/reverse proxy and DDoS edge → WAF/rate limits → origin firewall → application and data storesEach layer has a specific job. The edge absorbs or filters traffic before it consumes your origin link. The WAF evaluates HTTP behavior. Rate-based rules limit abusive sources or endpoints. The origin firewall prevents bypasses. Caching makes legitimate requests cheaper, while scaling and monitoring keep the service usable when demand changes.
Layer 1: upstream capacity and mitigation
Choose an edge provider that can inspect and discard traffic outside your network. AWS describes scalable services, attack-surface reduction, malicious-traffic filtering, monitoring, and a DDoS response plan as core practices. CloudFront and Route 53 provide inline mitigation in the AWS stack, and Shield Advanced can add automatic application-layer WAF protections. Comparable services from other providers should be evaluated for the same capabilities rather than by marketing labels alone.
Layer 2: origin access control
The origin must not be a second, unprotected public entry point. If an attacker discovers the origin IP and can connect directly, the CDN can be bypassed. Restrict security groups, host firewalls, or network ACLs so that web ports accept traffic only from the edge provider’s published address ranges. Cloudflare’s guidance explicitly says the origin should be reachable only from Cloudflare IP addresses.
Layer 3: HTTP and API controls
A WAF can block known malicious patterns, but rate-based rules are what limit repeated requests. AWS WAF rate-based rules automatically block traffic from source IPs when they exceed thresholds you define; they can also be configured to alert on sudden spikes. Cloudflare documents managed DDoS rulesets, custom WAF rules, and rate limiting, including controls that consider endpoint behavior and request complexity.
Layer 4: resilient application design
Cache public content at the edge, reuse connections, and separate inexpensive anonymous pages from expensive authenticated operations. Keep databases and internal services on private networks where possible. Scaling cannot make an unlimited attack harmless, but it gives the edge and filtering layers more time to work and reduces the chance that a normal traffic surge becomes an outage.
Implementation plan: protect a server before an attack
1. Inventory the public attack surface
List every public hostname, IP address, listening port, protocol, and backend service. Remove unused DNS records, services, and ports. Do not assign public IP addresses to backend resources when the architecture allows private addressing. Expose only the listener paths that users actually need; an unused UDP service can become an amplifier or a target even when the website itself is well protected.
- Identify the canonical public hostname and every alternate hostname.
- Record which services are HTTP, HTTPS, TCP, or UDP.
- Find direct DNS records, old test systems, mail or monitoring hosts, and forgotten cloud instances.
- Move administrative interfaces behind a private network or a separate access mechanism rather than leaving them on the public web listener.
2. Put DNS and traffic behind a CDN or reverse proxy
Create the site or API on the chosen edge platform and route public DNS through it. Use the provider’s proxying or CDN mode instead of publishing the origin address in an ordinary A or AAAA record. Terminate TLS at the edge where that fits your design, and use an encrypted connection from the edge to the origin as well.
Confirm that every public hostname, including API and upload subdomains, follows the intended path. A single unproxied hostname can reveal the same origin or provide a bypass route.
3. Lock the origin to edge addresses
At the cloud security-group, firewall, or network-ACL layer, allow inbound web traffic only from the CDN or reverse proxy’s current IP ranges. Deny direct internet access by default. Permit administrative access through a separate, restricted path. Keep the allowlist synchronized when the provider publishes changes, and test both an allowed edge request and a deliberately blocked direct request.
Rank #2
- WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
- 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
- Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
- Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
- Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.
Origin restriction is not complete if applications reveal the address in error pages, email headers, DNS history, server banners, or direct links. Use a dedicated origin hostname that is not advertised publicly, and review logs and certificates for accidental disclosure. If the address has already been exposed, plan an origin-IP change after the edge-only rule is ready.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Configure WAF rules in observation mode first
Start new rules in logging or count mode when the platform supports it. Review which URLs, methods, countries, authentication states, and user agents would be affected. Then enforce rules for clearly abusive patterns while keeping an exception process for known partners and monitoring systems.
Separate rules by function instead of applying one blanket limit:
- Authentication and password-reset endpoints: low thresholds because each request can invoke cryptography, identity lookups, or email delivery.
- Search, report generation, and GraphQL endpoints: limits based on query cost or concurrency as well as request count.
- Checkout, payment, and account mutation paths: strict controls with careful treatment of retries and authenticated sessions.
- Static assets and cacheable pages: higher thresholds because edge caching makes each request inexpensive for the origin.
5. Set rate-based thresholds from a baseline
Measure normal requests per second by endpoint, source category, authentication state, geography, and time of day. Set an initial threshold above normal legitimate bursts, then lower it only when logs show that the rule is catching the intended behavior. A threshold that is appropriate for a public image can be harmful on a login form, and a per-IP rule can miss a botnet that distributes requests across thousands of addresses.
Use the narrowest key that matches the abuse pattern: source IP, session, API token, account, ASN, or a combination. Add a response action appropriate to the risk—log, challenge, delay, or block—and define how long an action lasts. Cloudflare notes that limiting request complexity can protect the origin from resource exhaustion; request count alone is not enough for expensive APIs.
6. Make legitimate traffic cheap with caching
Cache static files and cacheable public responses at the edge. Set explicit cache keys and revalidation behavior so that a flood of identical requests does not trigger repeated origin work. Use connection reuse between the edge and origin, compress responses where practical, and avoid making every page request perform a database query.
Do not cache personalized or sensitive responses merely to improve hit ratio. Instead, separate anonymous content from authenticated operations and give each class its own policy. Track the cache-hit ratio so that an unexpected drop is visible during an event.
7. Build capacity and failure isolation
Use scalable compute and keep backend resources private. Set sensible connection, worker, queue, and database limits so that one expensive endpoint cannot consume every resource. Isolate background jobs from interactive requests, and use bounded queues rather than allowing unbounded work to accumulate during a spike.
Autoscaling is useful only when its trigger and maximum are defined. Scaling every time an attack increases traffic can create a cost spiral without restoring availability. Let edge filtering and rate limits remove abusive traffic, then scale the remaining legitimate load within a tested ceiling.
Recommended Free Tools
8. Monitor both edge and origin views
Create dashboards that distinguish traffic seen at the edge from traffic that actually reaches the origin. Track:
Rank #3
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
- Requests per second and bandwidth at the edge.
- Origin requests per second, concurrent connections, CPU, memory, worker or thread utilization, and database load.
- HTTP status-code mix, latency percentiles, timeout rate, and cache-hit ratio.
- WAF matches, rate-limit actions, challenged requests, and top endpoints.
- DNS health, TLS errors, and provider or origin error rates.
Configure alarms for sudden deviations from the established baseline. AWS recommends CloudWatch alarms that can trigger scaling responses and monitoring of application behavior. Alert on both availability symptoms and leading indicators, such as a rapid increase in connections or a fall in cache hits.
9. Write and rehearse a DDoS runbook
Document the people and permissions needed to respond. Include:
- Who can change DNS, WAF rules, rate limits, security groups, and scaling settings.
- Emergency contacts for the CDN, cloud provider, hosting provider, and ISP.
- Decision thresholds for moving from observation to blocking, failover, or provider escalation.
- Customer and internal communication templates, status-page ownership, and update intervals.
- Log and packet evidence to preserve, along with retention locations and timestamps.
- Rollback steps for every emergency rule, including an expiry time for temporary blocks.
- A post-incident review covering the attack path, missed exposure, false positives, and required architecture changes.
Run a tabletop exercise before an incident. Verify that the person listed as an owner can actually sign in, that provider contacts respond, and that an origin lockout can be reversed safely.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Choosing between AWS and Cloudflare-style protection
Do not choose solely on a claim of “unlimited” mitigation. Compare the controls that match your architecture and the attack layers you need to cover.
| Capability | AWS services documented in the guidance | Cloudflare controls documented in the guidance |
|---|---|---|
| Edge and DNS placement | CloudFront and Route 53 inline mitigation | Reverse-proxy edge with origin restriction |
| Application protection | AWS WAF rate-based rules; Shield Advanced automatic WAF protections | Managed DDoS rulesets and custom WAF rules |
| Rate limiting | Rules block or alert when source IPs exceed configured thresholds | Rate limiting based on resource exhaustion, endpoint behavior, and request complexity |
| Origin protection | Use private backend resources and restrict inbound access to the edge | Allow access only from Cloudflare IP addresses |
| Monitoring and response | CloudWatch alarms, scaling responses, and a documented DDoS plan | Edge and WAF activity must be integrated with your monitoring and response process |
The right choice is the one that integrates with your DNS, hosting, identity, logging, and escalation processes. Confirm whether the service covers the network and transport layers you use, whether mitigation is automatic or requires a manual rule change, how long logs are retained, and how emergency support is reached. Pricing, program availability, and eligibility vary by account and region; obtain current terms directly from the provider before committing.
Can a firewall stop a DDoS attack?
A firewall can reduce exposure and block unwanted ports, protocols, addresses, and application patterns. It cannot by itself solve a volumetric attack that exhausts the internet link or upstream router before traffic reaches the firewall. Host-based controls are therefore a supporting layer, not the primary capacity for a large event.
Use the firewall to enforce the origin-only-from-edge rule, close unused ports, restrict administrative access, and apply conservative connection limits. Rely on the CDN, reverse proxy, ISP, or cloud mitigation service for traffic that must be discarded upstream.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →How to hide the origin IP correctly
Hiding the address is an architectural property, not a DNS trick. Proxy every public web and API hostname, remove direct records, and restrict the origin firewall to edge addresses. Search application output, certificate transparency records, DNS history, mail headers, and third-party integrations for accidental disclosure.
If an address is already known, assume attackers can bypass the proxy until you rotate it or place the service behind a new private origin. Change the address only after the replacement is protected; otherwise the new host can be attacked directly during the transition.
What to do during an active attack
First 15 minutes: preserve availability and confirm scope
- Declare the incident and open the runbook. Assign one technical lead and one communications owner.
- Compare edge traffic with origin traffic to determine whether the event is volumetric, protocol-based, or application-focused.
- Check whether the origin address or an unproxied hostname is being targeted.
- Contact the CDN, cloud provider, hosting provider, and ISP through the documented escalation channels if traffic threatens the link or provider limits.
- Preserve dashboards, WAF logs, flow records, and timestamps before changing rules.
Next: apply the narrowest effective controls
- Enable the provider’s managed DDoS protections and confirm they are active for every affected hostname.
- Raise edge caching for safe public content and temporarily disable features that trigger expensive origin work.
- Apply rate limits to the specific endpoint, account, token, or source pattern under attack.
- Block clearly malicious signatures or networks only when evidence supports the block; broad geographic or provider blocks can deny legitimate users.
- Lock the origin to edge addresses if any direct exposure is found, and rotate a compromised origin address according to the runbook.
Keep communications and recovery controlled
Publish factual status updates without exposing defensive details that help the attacker. Watch error rates and legitimate conversion or login success, not only total traffic. Remove temporary blocks gradually after the attack subsides, and retain evidence for the post-incident review.
Quick Recap
Common mistakes and their fixes
- Publishing the origin IP: a direct A record or forgotten test host bypasses the edge. Proxy all public names and restrict the firewall.
- Using one global rate limit: it either blocks normal bursts or leaves expensive endpoints exposed. Create endpoint- and cost-aware rules.
- Relying on IP blocking alone: distributed attacks rotate addresses. Combine rate, behavior, authentication, and request-complexity signals.
- Turning on blocking without observation: legitimate clients can be locked out. Count and review first where possible, then enforce with exceptions.
- Scaling without filtering: autoscaling can increase cost while the attack continues. Filter at the edge and cap backend scaling.
- Watching only origin CPU: a full network link or edge error can cause an outage before CPU rises. Monitor edge bandwidth, requests, origin health, and cache behavior together.
- Having no rollback: emergency rules often outlive the incident. Record an owner, expiration time, and reversal step for each temporary change.
Pre-deployment and quarterly checklist
- All public traffic passes through the selected CDN or reverse proxy.
- Origin security groups and firewalls allow only the provider’s edge ranges on required ports.
- Unused public services, ports, DNS records, and backend public IPs are removed.
- WAF rules cover login, search, checkout, GraphQL, mutation, upload, and other expensive paths.
- Rate thresholds are based on normal traffic and are tested in count mode before enforcement.
- Static and safe public responses are cached, with sensitive responses excluded.
- Edge and origin dashboards show requests, bandwidth, status codes, latency, connections, resource use, WAF actions, and cache hits.
- Alarms, contacts, permissions, provider escalation paths, and rollback steps are current.
- A tabletop exercise has verified that the team can restrict the origin and restore service without guesswork.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
