Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

During a DDOS attack, if we are finding IPs we want to block will we see better performance using a null route as opposed to iptables?

Null routing we would do something like:

ip route add blackhole <ip or range>

In iptables:

/sbin/iptables -A INPUT -s <ip or range> -j DR

Is there no difference? I would suspect route would work better, but am not certain.

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:45

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

What do you mean by "performance" exactly? Are you talking about CPU load? Interrupt load? Network congestion? (One of the first three questions I ask people when doing DDoS mitigation is "How exactly is the attack hurting you?" If it's, for example, hurting you by saturating your inbound bandwidth, then this won't matter at all, the inbound bandwidth used will be the same.) – David Schwartz Oct 1 '12 at 22:44

Assuming you're blocking based on source address and not destination, then doing the DROP in raw/PREROUTING would work well as you would essentially be able to drop the packet before any routing decision is made.

Remember however that iptables rules are essentially a linked-list and for optimum performance when blocking a number of addresses you should use an ipset.

On the other hand if blocking by destination, there is likely little difference between blocking at the routing table vs iptables EXCEPT if source IPs are spoofed in which case the blackholed entries may consume routing cache resources; in this case, raw/PREROUTING remains preferable.

share|improve this answer
Can you clarify what you mean by "prerouting"? Why would spoofed IPs make a difference in performance? – scott Oct 1 '12 at 22:39
raw/PREROUTING as in, the chain in iptables, read the manpage. It should be obvious why dropping a packet prior to a routing decision can be faster. – Olipro Oct 1 '12 at 23:29

Your outgoing route isn't going to matter until you try to send a packet back to the attacker. By that time you will have already incurred most of the cost of socket setup and may even have a thread blocking waiting for the kernel to conclude you have no route to host, plus whatever error handling your server process does when it concludes there's a network problem.

iptables or another firewall will allow you to block the incoming traffic and discard it before it reaches the daemon process on your server. It seems clearly superior in this use case.

share|improve this answer

iptables is is the standard tool for blocking ddos attacks. I happen to have a huge iptables list under very heavy ddos attack and it works very well. I would prefer iptables.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.