I use Nginx compiled with the Naxsi module to protect against some vulnerabilities (SQL injection and cross-site scripting). Now I need to apply a layer of poor man's DDoS protection at this level.
I read a lot to come to the conclusion that there are three recommended approaches: two modules for Nginx and the option to use a TCP/HTTP load balancer (like HAProxy). The modules I'm referring to are testcookie and anddos. Apparently, you can combine the power of both.
What would you recommend not only from a security perspective but also considering the performance point of view?