waf ddos protection

ConceptUsing the BPF (Berkeley Packet filter) toolset combined with the Iptables XT_BPF module enables high-performance packet filtering to address large-scale DDoS attacks. BPF Tools contains a simple set of Python scripts that are used to parse the Pcap file, and others are primarily used to generate BPF bytecode.First, download and install BpftoolsDownload the zip file in Https://github.com/cloudflare/bpftools, or you can download it via git, and t

causes a large number of TCP connection requests to wait .http{. #定义一个名为allips的limit_req_zone used to store session, size is 10M memory, #以 $binary _remote_addr to key, limit the average request per second to 20 , #1M能存储16000个状态, the value of Rete must be an integer, #如果限制两秒钟一个请求, can be set to 30r/m limit_req_zone $binary _remote_addr zone=allips:10m rate=000/ s; server{... location {... #限制每ip每秒不超过20个请求, the number of leaky barrels burst is 5 #brust的意思就是, as Fruit 1 seconds,2,3, the 4-second