To protect a VPS against DDoS attacks, the most effective defense stacks multiple layers: a properly configured server-level firewall, connection rate limiting, and an external mitigation service such as Cloudflare that absorbs malicious traffic before it ever reaches your IP.
No single solution is enough on its own. Below we walk through each layer and how to implement it on a Linux VPS.
What Is a DDoS Attack and Why VPS Servers Are Vulnerable
A Distributed Denial of Service (DDoS) attack floods a server or network with fake traffic until legitimate users can no longer reach the service. Unlike enterprise dedicated servers that come with built-in mitigation hardware, a standard VPS has limited resources and can go down within minutes under a moderate-scale attack.
The most common attack vectors include:
- Volumetric: overwhelm available bandwidth (UDP flood, ICMP flood).
- Protocol: exploit weaknesses in TCP/IP (SYN flood).
- Application layer (L7): mimic legitimate HTTP traffic to exhaust web server resources.
Layer 1 — Server Firewall: UFW and iptables
The first filter should sit as close to the operating system as possible. On Ubuntu/Debian, UFW is the most accessible option:
# Allow only necessary ports
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp # SSH
ufw allow 80/tcp # HTTP
ufw allow 443/tcp # HTTPS
ufw enable
For SYN flood protection with iptables, add rules that limit the rate of new incoming connections:
iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP
These rules accept up to 3 simultaneous SYN packets and drop the rest, effectively slowing low- to medium-intensity SYN floods.
Layer 2 — Rate Limiting at the Web Server
Layer 7 (HTTP) attacks require rate limiting directly inside Apache or Nginx.
Nginx
limit_req_zone $binary_remote_addr zone=web_limit:10m rate=30r/m;
server {
location / {
limit_req zone=web_limit burst=10 nodelay;
}
}
Apache with mod_evasive
# In /etc/apache2/mods-enabled/evasive.conf
DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 100
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 60
These settings temporarily block IPs that make more than 5 requests to the same resource per second, or more than 100 site-wide requests per second.
Layer 3 — External Mitigation with Cloudflare
The weak point of the server-side layers above is that DDoS traffic still reaches your VPS before it gets dropped, consuming bandwidth and CPU. The structural solution is to hide your VPS's real IP behind a mitigation service.
Cloudflare is the most accessible option for most budgets:
- The free plan includes basic L3/L4 and L7 DDoS mitigation.
- Point your domain's DNS records to Cloudflare; traffic is filtered at their data centers before hitting your VPS.
- Enable "Under Attack" mode during an active attack — it adds a JavaScript challenge for every new visitor.
- Critical step: once Cloudflare is set up, block direct access to your VPS IP in the firewall. Accept HTTP/HTTPS connections only from Cloudflare's published IP ranges.
For more robust infrastructure-level protection, many VPS providers include network-level DDoS scrubbing that cleans traffic before it reaches the server. Compare options in our VPS servers guide.
Additional Security Best Practices
- Change the SSH port: moving SSH from port 22 to a non-standard port (e.g., 2222) dramatically reduces automated bot noise.
- Fail2ban: automatically bans IPs with too many failed SSH logins, web app authentication attempts, and similar brute-force patterns.
- Disable unused services: every open port is an attack surface. Shut down what you don't need.
- Traffic monitoring: tools like
iftop,nethogs, or managed monitoring solutions help you spot anomalous traffic patterns before an attack escalates. - Known abuse IP lists: use IP reputation services to proactively block known malicious ranges — consulting experts at elenlace.com can help you build a tailored blocklist strategy.
Key Takeaways
- Effective DDoS protection requires multiple layers: OS firewall, web server rate limiting, and external mitigation (Cloudflare or equivalent).
- Configure iptables to throttle SYN floods and UFW to minimize exposed attack surface.
- Free Cloudflare defends against most L7 attacks; the Pro plan adds more advanced WAF rules.
- Hide your VPS's real IP — if an attacker knows it, they can bypass Cloudflare entirely.
- Fail2ban and a non-standard SSH port cut automated bot noise at nearly zero cost.
Looking for a VPS with network-level DDoS protection included and real technical support? Browse the plans at elenlace.com and find the right fit for your project.
FAQ
Is free Cloudflare enough to protect a VPS from DDoS attacks?
For most small and mid-sized sites, yes. The free plan mitigates volumetric and L7 attacks effectively. However, massive volumetric attacks (>100 Gbps) require Cloudflare's paid plans or network-level protection from your VPS provider. You must also block direct access to your VPS IP to prevent attackers from bypassing Cloudflare.
Does Fail2ban protect against DDoS?
Fail2ban is primarily designed to stop brute-force attacks on SSH and web applications. It can help block IPs generating excessive failed HTTP requests, but it is not built to absorb volumetric DDoS traffic. Use it as a complement, not as your primary DDoS defense.
How do I know if my VPS is under a DDoS attack?
Common signs include unusually high CPU or bandwidth usage with no clear cause, slow or unresponsive web server, and traffic spikes visible in your provider's control panel. Tools like iftop, netstat -s, or Apache/Nginx access logs help confirm the diagnosis.
Does my VPS provider offer DDoS protection?
It depends on the provider. Some include basic network-level scrubbing from certain plans; others charge for it as an add-on. Before signing up, ask specifically how much DDoS traffic they can absorb at the network level before it reaches your server.
Useful resources
Other providers and guides worth comparing:
