Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been looking around on how to limit the connections per IP for windows server but I have had no luck.

I might need some kind of firewall. My servers are getting DDOSED.

Please advice.

share|improve this question

1 Answer 1

up vote 2 down vote accepted
  1. Yes, you need some kind of firewall. Not because of this, but in general.

  2. You don't solve a DDoS at the server or at the firewall. By the time the packets have reached your firewall or server, they've already succeeded by using up your resources.

You solve a Denial-of-Service attack by calling your ISP and having them drop the traffic from the hosts before it gets to your network.

share|improve this answer
    
Hello, I just need to limit the number of connections. What they have done is they open up too many connections to the port of my application that it maxes it out. I really need to limit the connections per IP. thats all. Please advice? –  user1855539 Mar 14 '13 at 15:37
    
@user1855539 Advice? Ask the right question next time. You're describing port exhaustion, not DDoS-mitigation. So, if you problem really is port exhaustion, I'd do a search on that (here, Google, etc.) and come back and ask a proper question if you run into problems implementing whatever strategy you decide upon. –  HopelessN00b Mar 14 '13 at 15:42
    
Thanks that actually inlightened me. The problem is I can't modify the application. There are 2 instances of the application. Each accepting 500 users. But someone is using an application to emulate our client and connect and max out the server so others can't connect. That's why I need to limit the number of connections per IP so each user can't flood connections. Care to give one last advice? :D thanks good sir. –  user1855539 Mar 14 '13 at 15:54
    
@user1855539 I don't know of a way to do it from the Server 2008 OS offhand, but it's pretty trivial to do with a firewall, or an application-specific service - IIS has a way to do it, for example - but I think we're at the point where you need to provide a lot more information and/or look at getting something else put into your environment to achieve what you want to achieve here. –  HopelessN00b Mar 14 '13 at 17:08
    
Check out RioRey. They make some amazing devices that solve your exact problem. –  John Homer Mar 14 '13 at 17:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.