Introduction
Describes the DDoS mitigation mechanisms used by Impreza Host, such as rate limiting, connection filtering, and IP reputation control.
This comprehensive tutorial will guide you through everything you need to know about what are anti-ddos server settings.
Understanding DDoS Attacks
What is a DDoS Attack?
A Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming it with a flood of Internet traffic.
Key Characteristics:
- Uses multiple compromised computer systems as sources of attack traffic
- Can include computers and other networked resources such as IoT devices
- Aims to make online services unavailable
- Can cause significant downtime and financial loss
Types of DDoS Attacks
1. Volume-Based Attacks
- UDP floods
- ICMP floods
- Amplification attacks
- Goal: Consume bandwidth
2. Protocol Attacks
- SYN floods
- Ping of Death
- Smurf DDoS
- Goal: Exhaust server resources
3. Application Layer Attacks
- HTTP floods
- Slowloris
- DNS query floods
- Goal: Crash web applications
Impreza Host's Anti-DDoS Infrastructure
Multi-Layer Protection
Our DDoS protection operates at multiple levels:
Network Layer (L3/L4)
- Filters malicious traffic at network edge
- Protects against volumetric attacks
- Handles protocol-based attacks
Application Layer (L7)
- Protects web applications
- Filters HTTP/HTTPS floods
- Intelligent request analysis
DNS Protection
- Protects against DNS amplification
- Filters DNS query floods
- Ensures DNS availability
Protection Capacity
Standard Protection:
- Up to 10 Gbps mitigation capacity
- Suitable for most websites and applications
- Included with all hosting plans
Advanced Protection:
- Up to 100+ Gbps mitigation capacity
- Enterprise-grade protection
- Available as upgrade option
Anti-DDoS Server Settings
1. Rate Limiting
Rate limiting controls the number of requests a server accepts from a single source within a specific time period.
How It Works:
- Monitors incoming request rates
- Sets thresholds for acceptable traffic
- Blocks or throttles excessive requests
- Prevents server overload
Configuration:
- Requests per second (RPS) limits
- Concurrent connection limits
- Bandwidth throttling
- Customizable thresholds
Example Settings:
Max requests per IP: 100/second
Max concurrent connections: 50
Burst allowance: 200 requests
Timeout: 30 seconds
2. Connection Filtering
Connection filtering analyzes and filters incoming connections based on various criteria.
SYN Flood Protection:
- Monitors TCP handshake completion
- Drops incomplete connections
- Implements SYN cookies
- Prevents resource exhaustion
Connection State Tracking:
- Monitors connection states
- Identifies abnormal patterns
- Blocks suspicious connections
- Maintains legitimate traffic flow
Geographic Filtering:
- Blocks traffic from specific countries
- Allows whitelisting of regions
- Reduces attack surface
- Customizable per service
3. IP Reputation Control
IP reputation systems identify and block traffic from known malicious sources.
Reputation Scoring:
- Analyzes IP address history
- Checks against threat databases
- Assigns reputation scores
- Blocks low-reputation sources
Blacklist Integration:
- Real-time blacklist checking
- Multiple threat intelligence sources
- Automatic blocking of known attackers
- Regular database updates
Whitelist Management:
- Allows trusted IP addresses
- Bypasses filtering for known good sources
- Customizable whitelist rules
- Priority traffic handling
4. Traffic Scrubbing
Traffic scrubbing analyzes all incoming traffic and removes malicious requests while allowing legitimate traffic through.
Deep Packet Inspection:
- Examines packet contents
- Identifies attack patterns
- Filters malicious payloads
- Maintains low latency
Behavioral Analysis:
- Learns normal traffic patterns
- Detects anomalies
- Adapts to new attack methods
- Machine learning integration
Challenge-Response:
- JavaScript challenges for browsers
- CAPTCHA for suspicious traffic
- Cookie validation
- Bot detection
5. Protocol Validation
Ensures all traffic conforms to proper protocol standards.
TCP/IP Validation:
- Checks packet structure
- Validates protocol compliance
- Drops malformed packets
- Prevents protocol exploits
HTTP/HTTPS Validation:
- Validates HTTP requests
- Checks header compliance
- Filters malicious payloads
- Enforces proper formatting
DNS Validation:
- Validates DNS queries
- Filters amplification attempts
- Rate limits DNS requests
- Protects DNS infrastructure
6. Bandwidth Management
Controls bandwidth allocation to prevent saturation.
Traffic Shaping:
- Prioritizes legitimate traffic
- Throttles suspicious sources
- Manages bandwidth allocation
- Prevents congestion
QoS (Quality of Service):
- Prioritizes critical services
- Ensures minimum bandwidth
- Manages traffic classes
- Optimizes performance
7. Anomaly Detection
Identifies unusual traffic patterns that may indicate an attack.
Statistical Analysis:
- Monitors traffic baselines
- Detects deviations
- Triggers alerts
- Automatic mitigation
Pattern Recognition:
- Identifies attack signatures
- Learns from previous attacks
- Adapts to new threats
- Continuous improvement
8. Load Balancing
Distributes traffic across multiple servers to prevent overload.
Distribution Methods:
- Round-robin
- Least connections
- IP hash
- Geographic distribution
Benefits:
- Prevents single point of failure
- Distributes attack impact
- Maintains service availability
- Improves performance
How Anti-DDoS Settings Work Together
Attack Detection Phase
Traffic Monitoring
- Continuous traffic analysis
- Baseline comparison
- Anomaly detection
- Alert generation
Attack Classification
- Identifies attack type
- Determines severity
- Selects mitigation strategy
- Activates appropriate defenses
Mitigation Phase
Immediate Response
- Activates rate limiting
- Enables connection filtering
- Implements IP blocking
- Redirects traffic to scrubbing centers
Sustained Protection
- Continuous traffic analysis
- Dynamic rule adjustment
- Attack pattern learning
- Performance optimization
Recovery Phase
- Gradual relaxation of restrictions
- Monitoring for attack resumption
- Performance restoration
- Post-attack analysis
Configuration Options
Automatic Protection (Default)
Features:
- Always-on monitoring
- Automatic attack detection
- Instant mitigation activation
- No manual intervention required
Best For:
- Most websites and applications
- Users without technical expertise
- Standard protection needs
- Set-and-forget security
Custom Configuration
Available Settings:
- Rate limit thresholds
- Geographic restrictions
- IP whitelist/blacklist
- Challenge sensitivity
- Protocol strictness
Access:
- Available through client panel
- Advanced users only
- Technical support available
- Documentation provided
Enterprise Protection
Features:
- Dedicated DDoS protection
- Custom mitigation rules
- Priority support
- SLA guarantees
- Real-time reporting
Best For:
- High-traffic websites
- E-commerce platforms
- Critical applications
- Enterprise clients
Monitoring and Reporting
Real-Time Monitoring
Dashboard Features:
- Live traffic graphs
- Attack detection alerts
- Mitigation status
- Performance metrics
Access:
- Client panel dashboard
- Mobile app (if available)
- Email alerts
- SMS notifications (optional)
Attack Reports
Included Information:
- Attack start/end times
- Attack type and size
- Mitigation actions taken
- Traffic statistics
- Source analysis
Report Delivery:
- Automatic email reports
- On-demand generation
- Historical data access
- Exportable formats
Performance Impact
Latency Considerations
Typical Impact:
- Normal traffic: <5ms additional latency
- During mitigation: 10-50ms additional latency
- Varies by attack severity
- Optimized for minimal impact
Optimization:
- Edge network deployment
- Efficient filtering algorithms
- Hardware acceleration
- Continuous optimization
False Positives
Minimizing False Positives:
- Intelligent traffic analysis
- Whitelist management
- Behavioral learning
- Manual override options
If Legitimate Traffic is Blocked:
- Contact support immediately
- Provide affected IP addresses
- Request whitelist addition
- Temporary mitigation adjustment
Best Practices
For Website Owners
Enable Protection Early
- Don't wait for an attack
- Always-on protection is best
- Prevention is easier than recovery
Monitor Regularly
- Check dashboard periodically
- Review attack reports
- Stay informed of threats
Maintain Whitelists
- Add trusted IP addresses
- Include your own IPs
- Update regularly
Optimize Your Application
- Efficient code reduces vulnerability
- Cache static content
- Use CDN services
- Minimize server load
For Developers
Implement Rate Limiting
- Application-level rate limiting
- API throttling
- Resource management
Validate Input
- Sanitize user input
- Validate requests
- Prevent injection attacks
Use Security Headers
- Implement CSP
- Use HSTS
- Configure CORS properly
Monitor Application Performance
- Track response times
- Monitor resource usage
- Identify bottlenecks
Upgrading Protection
When to Upgrade
Signs You Need More Protection:
- Frequent attacks
- Large attack volumes
- Extended attack duration
- Business-critical services
- High-value targets
Available Upgrades
Enhanced Protection:
- Higher mitigation capacity
- Advanced filtering rules
- Priority support
- Custom configurations
Enterprise Protection:
- Dedicated resources
- Custom SLA
- 24/7 dedicated support
- Advanced reporting
How to Upgrade:
- Log into client panel
- Navigate to your service
- Select "Upgrade Protection"
- Choose protection level
- Complete payment
Troubleshooting
Common Issues
Issue: Legitimate traffic blocked
Solution:
- Add IP to whitelist
- Adjust sensitivity settings
- Contact support for assistance
Issue: Website slow during attack
Solution:
- Normal during large attacks
- Mitigation prioritizes availability
- Consider upgrading protection
Issue: Attack not detected
Solution:
- Verify protection is enabled
- Check attack size (may be below threshold)
- Contact support for analysis
Getting Support
When to Contact Support:
- Ongoing attacks
- Configuration questions
- False positive issues
- Performance concerns
Information to Provide:
- Your domain/service
- Time of issue
- Description of problem
- Any error messages
- IP addresses affected
Conclusion
Impreza Host's anti-DDoS server settings provide comprehensive protection against a wide range of DDoS attacks. Through a combination of rate limiting, connection filtering, IP reputation control, traffic scrubbing, and other advanced techniques, we ensure your services remain available even during attacks.
Our multi-layer approach protects against volumetric, protocol, and application-layer attacks while minimizing impact on legitimate traffic. With automatic detection and mitigation, most attacks are handled without any action required from you.
For users with specific needs or high-value targets, custom configuration options and enterprise-grade protection are available. Our support team is available 24/7 to assist with any DDoS-related concerns and help optimize your protection settings.
Remember, DDoS protection is most effective when enabled proactively. Don't wait for an attack to activate protection—ensure your services are protected from day one.
