I have a DigitalOcean Ubuntu 16.04 machine with Bash as main shell, Nginx, PHP-FPM, and MySQL as server environment, Certbot for TLS and WordPress for web applications.
- I protect from MITMs with TLS.
- I protect from SSH and application BFAs with SSHGuard and WordFence.
- I protect from Backdoors and DB injections (like SQL injections) with various policies like minimal usage of modules, simple and unified forms (and captchas and honeypots if needed), and automatic upgrades via
unattended-upgradesand WP-CLI for WordPress.
- If I'm not wrong, WordFence also protects from one or more types of application layer DoS attacks.
Currently I see no reason why the websites I host should be attacked in a Distributed DoS (for example, I hold no organization targeted by another organization).
And yet, I do fear of DoS in general; especially of a Network-Level DoS from a single machine.
What will be the best way to monitor and repel any simple (say, single machine) attack of a network-level DoS?
I would prefer not to use external tools like CloudFlare as their policies can change and they can suddenly cost money or change pricing.
Ideally I would desire to install a Linux utility that works automatically, "as is", monitoring and repelling attackers from
nftables in the future) but I get the impression such tool isn't available with current technology. UPDATE FOR THIS PASSAGE: It seems that such tool, if existed, wouldn't be enough anyway because I need a network level tool outside the operating system (a tool that DigitalOcean or any similar hosting provider should provide, in my opinion, and that would be controllable from their interface/GUI).