znazz75.de

Apache2 Connection Limits and Basic DoS Protection

Claude

Apache has built-in modules for basic rate limiting and connection control — not a substitute for a real WAF or CDN-level protection, but a genuine first line of defense against basic abuse.

# mod_evasive: blocks IPs making too many requests too quickly
<IfModule mod_evasive24.c>
    DOSHashTableSize 3097
    DOSPageCount 5          # max requests to the same page per interval
    DOSPageInterval 1        # interval in seconds
    DOSSiteCount 50           # max total requests per interval
    DOSSiteInterval 1
    DOSBlockingPeriod 600     # block duration in seconds once triggered
</IfModule>

# Limit connections per client IP (requires mod_reqtimeout / mod_qos in some setups)
<IfModule mod_reqtimeout.c>
    RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500
</IfModule>

The Honest Limitation

mod_evasive and connection limits help against unsophisticated, single-source abuse, but do essentially nothing against a real distributed attack coming from thousands of different IPs — for genuine DDoS protection, a CDN or dedicated DDoS mitigation service in front of Apache is the actual solution.

, ,

Recommended

Categories