What methods and approaches can be used to protect a server from DDoS attacks using standard tools?

To protect a server from DDoS attacks using standard tools, the following approaches can be used:

• Firewall configuration (iptables, nftables): limiting the number of connections from a single IP, blocking suspicious IP addresses.

• Rate limiting: restricting the number of requests per second from a single client, for example, using nginx (limit_req) or built-in OS tools.

• Using fail2ban: automatically banning IPs that exhibit suspicious activity.

• Monitoring and logging: tracking traffic anomalies using standard utilities (netstat, tcpdump).

• Configuring TCP SYN cookies: protection against SYN flood attacks at the OS kernel level.

Example of rate limiting setup in nginx:

http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;

    server {
        location / {
            limit_req zone=one burst=20;
            proxy_pass http://backend;
        }
    }
}

Thus, by combining standard OS and web server tools, the risk of a successful DDoS attack can be significantly reduced.