What is the best way to defend your web site against HTTP FLOOD POST/GET ATTACK ?
depending on your implementation, it can be done three (3) ways:
1. application layer approach:
2. network layer approach:
this is far more practical considering you are deciding for the fate of the packet right before it reaches the other end or even if it had already completed the 3-way handshake. consider these examples:
a. restrict the number of concurrent connections per IP on your firewall. this will give you the ability to define how many connections can a client requests simultaneously.
in iptables, you can do this by:
in openbsd, you can do this in pf.conf:
where it means:
b. for pf, you can filter the traffic by matching the tcp packets based on flags and decide for your next rule.
3. do an combination of an application layer and a network layer approach
Although there is not solution that can provide a complete protection against DoS attacks such as flooding. Mitigation against DoS attacks may requires help from the upstream ISP.But what we can do to defend our website is to scale our website with load balancer and caching.I recommend a read on this paper "Leveraging the Load Balancer to Fight DDoS".