This question already has an answer here:
- I am under DDoS. What can I do? 4 answers
I'm soon going to change my infrastructure when I buy a new server. I'm going to replace my D-Link DIR-655 router with an pFsense router (and probably use the 655 as an AP) using my old server hardware (Intel Atom 330, 1GB ram, Intel Pro Server MT Dual Gigabit nic). My new server will be SandyBridge based and run Apache+Samba.
Now while I'm setting up this new infrastructure at home I want to experiment with DDoS protection, I know there are some modules and stuff for apache that let me do it but since I will have an BSD based router the best solution would seem to set something up already in the router thus putting less strain on network hardware behind the router.
So basically with that background information I would like to ask how would I set up such a configuration and would it be the best solution?
Is it smart to set up DDoS protection in pFsense or should such a thing be handled by the webserver? One would think that it's best to drop the packages as early as possible.
Even though I probably won't be subject to an DDoS attack it's better to be safe then sorry.
Edit: I understand that my servers probably wont be able to handle a serious DDoS attack but by maximising the protection so that my infrastructure can handle a little bit bigger attacks then without protection I would probably be able to stop some script-kiddies with smaller "bot-nets" from brining down the server. So what I want to do is to have as good protection as possible software wise.
Even if it's not software related the fact that I'm only using Intel Pro Server nics should raise my odds some since they consume less cpu power then the average Realtek nics you'd see in the compromised systems. I don't want someone to be able to bring down my system just because it's not properly configured. But as mentioned earlier I will most likely never be subject to such an attack and this is mainly because I want to experiment with my options.