I use Nginx compiled with the Naxsi module to protect against some vulnerabilities (SQL injection and cross-site scripting). Now I need to apply a layer of poor man's DDoS protection at this level.

I read a lot to come to the conclusion that there are three recommended approaches: two modules for Nginx and the option to use a TCP/HTTP load balancer (like HAProxy). The modules I'm referring to are testcookie and anddos. Apparently, you can combine the power of both.

What would you recommend not only from a security perspective but also considering the performance point of view?

2 Answers 2


I would also recommend using:

  • ngx_http_limit_req_module to limit RPS, and fallback to 503 on burst cap hit optionally. It does very well with exploited zombie browsers DDoS;
  • agressive caching for anonymous users (with next bullet applied maybe) and for target location (in case it is not random) to eliminate FastCGI passes;
  • use power of LUA module and bash-fu to integrate with iptables, to block zombies on a system level to prevent concurrent UDP/SSH/whatever-flood (you may consider using ipset utility to handle large sets of zombie IPs which iptables will fail to process fast enough).
  • Why lua and bash-fu when fail2ban already exists?
    – Shadur
    Jan 5, 2014 at 13:38
  • @Shadur because with LUA-fu one can evaluate more complex ban conditions and filters realtime. Like cookies, additional headers, and maybe some aggregated stats from memcached/redis/RDBMS/etc. fail2ban is quite handy too, but it is not as flexible as nginx+LUA. Jan 5, 2014 at 14:17
  • @НЛО: what approach would you suggest "to block zombies on a system level to prevent concurrent UDP/SSH/whatever-flood"? Jan 8, 2014 at 9:49
  • @thatguyfromoverthere temporarily block zombie IPs with a firewall as a prevention of some other types of attacks. Jan 8, 2014 at 10:42

i only know of Roboo, which seems to be the forerunner of the testcookie-thingie. it is not so easy to detect AND protect from ddos on http-level, esp. on high-volume-sites.

if possible you might want to enable proxy_cache which is quite fast. when you're under attack it is possible to gibve a short cache_time like 1 minute.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.