I have a ddos protection proxy in place to deal with SYN floods and such. But http floods are still getting through. For some reason their ddos proxy is not blocking any of the flood. So there are about 500 ips connecting to the box as many times as possible and max out at about 20k connections. This is causing php to spawn 1k processes overloading the box. How can I mitigate this http flood? I thought setting up an htaccess file which required a cookie to access the site would work but rewritecond seems to be invoking php which causes the box to overload.
How can I mitigate this?