This question already has an answer here:
- I am under DDoS. What can I do? 2 answers
I have a server (2 x E2620, 32 GB RAM, Debian 6 Linux us-fw 2.6.32-5-amd64 #1 SMP Mon Feb 25 00:26:11 UTC 2013 x86_64 GNU/Linux, 10G Intel Ethernet Card). It has an Nginx proxy server inside. Idea is to use it as a frontend against DDoS attacks. Currently, if faced to a 500kpps spoofed SYN flood, it becomes almost unresponsive. I've already tried syncookies and various sysctl parameters. Even if a half-open connection timeout is 1 second, it is enough to fill up any buffers. Any ideas how to harden it against spoofed syn floods? Maybe, some hardcore configs or fw rules?