The Anti-DDoS option of an interface filters, at line rate, the TCP traffic typical of denial-of-service attacks: malformed packets, impossible addresses, floods of new connections from one source.
Be realistic about what a server-side firewall can do: no software firewall can absorb a volumetric attack that saturates your Internet link. Most UDP attacks are amplified reflections that exhaust the link itself; they must be stopped upstream, by your provider or a scrubbing service.
What the Anti-DDoS option does well is to drop the bad TCP traffic cheaply, before it reaches your services, and to stop a single source from opening too many connections.
¶ Enable it
- Go to Your Firewall › Parameters and click the interface to protect (it must be linked to the firewall).
- Check Anti-DDOS and click Apply.
The protection is applied a few seconds later and the DDOS column of the interfaces table is checked.
¶ What it does
¶ Before routing (all packets of the interface)
- Drops packets in an invalid connection state.
- Drops new TCP packets that are not SYN.
- Drops SYN packets with an uncommon MSS value (outside 536–65535).
- Drops packets with bogus TCP flag combinations (SYN+FIN, SYN+RST, FIN+RST, FIN without ACK, URG or PSH without ACK, no flag at all).
- Drops fragments.
- Drops packets whose source can never be valid: multicast and reserved ranges (
224.0.0.0/3), documentation network (192.0.2.0/24). - On an interface whose behavior is Act as WAN, also drops sources that cannot come from the Internet: private networks (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16),0.0.0.0/8and link-local addresses (169.254.0.0/16). On a LAN interface these sources are your own clients (and DHCP requests come from0.0.0.0), so they are kept.
¶ New connections, before your rules
- A source that already has more than 111 TCP connections is rejected.
- A source that opens more than 60 new TCP connections per second (bursts of 20) is rejected.
- A source that sends more than 2 TCP resets per second is dropped (RST flood).
These limits only reject the excess: the connections under the limits continue to your rules and to the default policy of the interface. Replies to established connections are never limited.
¶ DNS amplification protection
If Artica answers DNS queries from the Internet, enable DNS Amplification DDOS protection in the options of the parameters page.
DNS queries in UDP that do not come from a trusted network then go through a rate limit, per /24 source network:
- queries of type ANY (the core of amplification attacks): more than 1 per second is dropped;
- queries for the root zone: more than 1 per second is dropped;
- any DNS query: more than 10 per second (bursts of 20) is dropped.
¶ Check that it is active
# Anti-DDoS rules of an interface (eth0 here)
iptables-save | grep -c DDOS_eth0
# DNS amplification chain
iptables -S DNS-RATE-LIMITIf a kernel module needed by a rule is missing (xt_hashlimit, xt_connlimit, xt_string, xt_u32), only that rule is refused: it is listed in the red badge of the rules table, the others are applied. The Modules tab of the parameters page shows which modules your kernel provides.
Note for appliances updated from an older version: before October 2026, these protections were applied by a script of the former firewall builder. They are now part of the firewall rule set, with two corrections: private source networks are only dropped on WAN interfaces, and the connection limits no longer bypass your rules.