I just read that to protecting a server against a DDoS attack involves blacklisting IP addresses.

  1. What does the term blacklisting mean?
  2. What does it mean for a firewall to drop a connection?
  3. How does this protect a server against DDoS attacks?

Please keep in mind that I limited experience in firewall configuration.

  • Give info! What OS or system? What type of firewall? What type of webserver is running?
    – SPRBRN
    Jan 13, 2015 at 15:57
  • sorry if i cannot explain question briefly. but i read the techniques do advanced firewall use to protect against ddos? Jan 13, 2015 at 16:05
  • can you please give any example how blacklisting of ip is done in any firewall, any os , firewall Jan 13, 2015 at 16:06
  • @sushilchhetri If you cannot provide the type of firewall you're asking about it makes it difficult to answer the question. Each firewall can perform its actions differently.
    – RoraΖ
    Jan 13, 2015 at 16:22
  • what about windows firewall Jan 13, 2015 at 16:40

3 Answers 3


It's possible for blacklisting an IP to protect a server from a DDoS attack. A lot would depend on the firewall, the network, the system and the type of attack.

  1. Blacklisting means you tell your firewall to take a special action against traffic from that IP or network range. You could tell your firewall to ignore traffic from that IP or reject that traffic. If your network and firewall can handle large amounts of traffic but your server cannot, that may stop the attack assuming the attacker doesn't change source IPs. It might be a useful short-term mitigation but usually isn't a long-term fix.

  2. To "drop a connection" probably means to ignore it. The remote server would send (assuming TCP) a syn packet and your firewall would accept the packet, examine it, find that it matches a rule and then execute that rule. If you are dropping packets from that source then your firewall would do nothing further. Keep in mind that in order to find the rule it had to accept the packet and examine it which consumed a small amount of resources. Multiply that tiny resource consumption against a million packets and it starts to add up...

  3. How would this protect a server? If the firewall and server are separate devices then the firewall takes all of the traffic load and the server doesn't have to deal with junk traffic. If they're on the same system then hopefully the firewall layer handles the traffic and it doesn't have to be processed by the application layer.

Blacklisting IPs at the firewall is a case of "enumerating badness" and in many cases doesn't scale well. Do you want to spend the next week of your life pouring through logs and adding firewall rules each time an attacker gets a new IP? In the long term there are better approaches:

  • Whitelist known-good IPs - if possible, only allow traffic from your trusted partners and block everything else by default.
  • Implement a system that can automatically review traffic and filter out the unwanted traffic
  • Build a system that can scale to meet your expected traffic load as well as spikes of unwanted traffic. This would need to happen at all layers: network, firewall, application, etc.
  • how can we know that this ip is blacklisted or whitelisted Jan 14, 2015 at 14:59

The term blacklisting means that you effectively deny any connections (e.g. packets) to a particular IP address. Therefore all network packets with the blacklisted IP as the source or destination will not pass through the firewall. This can be considered a "dropped connection." Keep in mind that in cases where security is the highest priority, whitelisting trusted IPs is a better practice, meaning that only connections that are on your white list will be allowed and all others will be dropped. Blacklisting IPs does not remedy a DDoS attack. A DDoS attack is distributed, meaning it originates from many IP addresses. Furthermore IPs can be spoofed to appear to originate from a trustworthy source.


Basic blacklisting consists on ignoring packets coming from blacklisted addresses. They simply "drop it on the ground" and ignore it, making no further action after that beyond waiting for the next packet to analyse.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .