DDoS Attacks on VPS: How to Detect and Protect Your Server

A DDoS (Distributed Denial of Service) attack floods your server with fake traffic until it collapses and can no longer respond to real users. The good news: with the right protection layers you can detect it before it causes serious damage and mitigate it within minutes.

This guide covers the warning signs, diagnostic tools, and concrete defenses you should have active on your VPS.

What Exactly Is a DDoS Attack and Why Do VPS Servers Get Hit?

Unlike a traditional hack that tries to break into your system, a DDoS simply aims to exhaust your resources — bandwidth, CPU, TCP connections — until the server can no longer serve legitimate requests.

VPS servers are frequent targets because:

• They share physical infrastructure with other customers (massive traffic affects the whole node).
• They typically have fixed, easily scannable public IPs.
• Many run without any DDoS protection enabled by default.

The most common attack types are volumetric (UDP/ICMP flood that saturates bandwidth), protocol-based (SYN flood that exhausts TCP connections), and application-layer (HTTP flood targeting heavy pages).

How to Detect a DDoS Attack on Your VPS

Before reacting, confirm you are actually under attack rather than experiencing a legitimate traffic spike or misconfiguration.

Early Warning Signs

• Spiking latency or the server becoming completely unreachable.
• CPU and/or bandwidth at 100% with no obvious cause.
• Apache/Nginx logs flooded with requests from the same IPs or IP ranges.
• Your VPS provider notifies you that you are exceeding your traffic limit.

Quick Diagnostic Commands

Run these in your terminal to pinpoint the source of the problem:

# Number of connections per IP (sorted highest to lowest)
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

# Real-time bandwidth usage
iftop -n

# Check Nginx access log for repeated IPs
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20

If you see tens of thousands of connections from a handful of IPs, or nonsensical gigabits of traffic, you are under attack.

Protection Layers You Need on Your VPS

There is no single silver bullet; effective defense combines several layers.

1. OS-Level Firewall

With UFW (Ubuntu/Debian) or iptables / firewalld (CentOS/RHEL) you can block attacking IPs and rate-limit new connections:

# Limit SSH connections to 6 per minute
ufw limit ssh

# Block a specific attacking IP
ufw deny from 203.0.113.50

# With iptables: limit new HTTP connections to 25 per second per IP
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/s --limit-burst 50 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

Browse the full step-by-step firewall guides in our VPS servers section.

2. Fail2Ban for Automatic Blocking

Fail2Ban monitors your logs and automatically bans IPs that exceed a threshold of failed or suspicious requests. It is lightweight and runs in the background with minimal resource usage.

# Install and enable
apt install fail2ban -y
systemctl enable --now fail2ban

# Check currently banned IPs
fail2ban-client status sshd

3. Rate Limiting in Nginx or Apache

For layer 7 attacks (HTTP flood), rate limiting at the web server level is very effective:

# In nginx.conf or your server block:
limit_req_zone $binary_remote_addr zone=req_limit:10m rate=20r/s;
limit_req zone=req_limit burst=40 nodelay;

4. Provider DDoS Protection or a CDN Service

The layers above handle moderate-volume attacks. For massive floods (>1 Gbps), you need upstream absorption — scrubbing traffic before it ever reaches your server:

For most websites, free Cloudflare + a properly configured firewall is sufficient. If your business depends on 24/7 uptime, consider a paid plan or a VPS with built-in DDoS protection.

What to Do If You Are Being Attacked Right Now

1. Identify the source using netstat / iftop (commands above).
2. Block attacking IPs immediately with ufw deny from <IP> or iptables.
3. Enable Cloudflare if you have not already: change your domain's DNS to Cloudflare's nameservers so traffic is filtered before reaching your IP.
4. Contact your provider: many can apply a temporary null-route (dropping all traffic to your IP) to protect the shared node.
5. Document the attack: save logs to report to your provider or authorities if the attack persists.

If you need expert help setting up all these layers, the team at elenlace.com offers managed server services to get your VPS fully protected without you having to do it alone.

Key Takeaways

• A DDoS exhausts resources rather than breaking in; the goal is to deny service.
• Detect the attack with netstat, iftop, and log analysis before acting.
• Layered defense combines a firewall (UFW/iptables), Fail2Ban, web server rate limiting, and upstream protection (Cloudflare or your provider).
• For large volumetric attacks (+1 Gbps) only upstream absorption is truly effective.
• Free Cloudflare + configured UFW covers the vast majority of websites.

Does your VPS have no active protection yet? Reach out to the team at elenlace.com — we can audit your setup and have your server protected today.

FAQ

Can a cheap VPS survive a DDoS attack?

A low-end VPS without upstream protection will rarely survive a large volumetric flood. However, with Cloudflare acting as a proxy and a well-configured firewall, it can handle layer 7 attacks and small floods without issue.

Does free Cloudflare protect against DDoS?

Yes. The free plan includes unlimited layer 7 DDoS mitigation and basic layer 3/4 protection. For very high-volume layer 3/4 attacks, Pro or Business plans offer greater absorption capacity.

How do I tell whether high traffic is a DDoS or a legitimate spike?

Check the pattern: legitimate traffic comes from many distinct IPs showing real browser behavior (varied paths, diverse user-agents). A DDoS typically concentrates requests from a few IPs or ranges, all hitting the same route, with repeated or empty user-agents.

Can my VPS provider block the attack for me?

Usually yes, with a null-route: they stop routing traffic to your IP during the attack. This stops the DDoS but also cuts your service. It is a last-resort measure to protect the shared node. Contact your provider's support as soon as you detect the attack.

Useful resources

Other providers and guides worth comparing:

• IONOS
• GoDaddy
• HostGator México