DDoS Mitigation at the Edge: Rate Limiting and Traffic Scrubbing

February 20, 2026 · 8 min read

Your upstream link is 1 Gbps. The attack is 10 Gbps. Your edge router can’t help — the link is already saturated before packets reach you.

Edge DDoS mitigation isn’t about stopping massive volumetric attacks. It’s about protecting against smaller attacks, reducing collateral damage, and buying time until upstream mitigation kicks in.

Edge mitigation buys time. It’s not a complete solution, but it’s better than nothing.

What Edge Routers Can Do

Effective Against

Application-layer attacks (HTTP, DNS)
SYN floods (up to link capacity)
Slowloris-style attacks
Amplification from your network
Small-scale volumetric attacks

Not Effective Against

Attacks larger than your upstream link
Sophisticated distributed attacks
Attacks that saturate your ISP’s network

Rate Limiting

Basic Rate Limiting with Firewall

configure

# Rate limit incoming connections per source
set firewall ipv4 name WAN-IN rule 50 action drop
set firewall ipv4 name WAN-IN rule 50 recent count 100
set firewall ipv4 name WAN-IN rule 50 recent time minute
set firewall ipv4 name WAN-IN rule 50 state new
set firewall ipv4 name WAN-IN rule 50 description "Rate limit: 100 new conn/min/source"

commit

Rate Limit Specific Services

configure

# Rate limit SSH connections
set firewall ipv4 name WAN-LOCAL rule 100 action drop
set firewall ipv4 name WAN-LOCAL rule 100 destination port 22
set firewall ipv4 name WAN-LOCAL rule 100 protocol tcp
set firewall ipv4 name WAN-LOCAL rule 100 recent count 5
set firewall ipv4 name WAN-LOCAL rule 100 recent time minute
set firewall ipv4 name WAN-LOCAL rule 100 state new
set firewall ipv4 name WAN-LOCAL rule 100 description "SSH: Max 5 new conn/min/source"

# Allow SSH that passes rate limit
set firewall ipv4 name WAN-LOCAL rule 101 action accept
set firewall ipv4 name WAN-LOCAL rule 101 destination port 22
set firewall ipv4 name WAN-LOCAL rule 101 protocol tcp
set firewall ipv4 name WAN-LOCAL rule 101 state new

commit

Rate Limit DNS Queries

configure

# Protect DNS server from amplification abuse
set firewall ipv4 name WAN-IN rule 200 action drop
set firewall ipv4 name WAN-IN rule 200 destination port 53
set firewall ipv4 name WAN-IN rule 200 protocol udp
set firewall ipv4 name WAN-IN rule 200 recent count 50
set firewall ipv4 name WAN-IN rule 200 recent time second
set firewall ipv4 name WAN-IN rule 200 description "DNS: Max 50 queries/sec/source"

commit

Connection Limits

Limit Concurrent Connections

configure

# Limit connections per source IP
set firewall ipv4 name WAN-IN rule 60 action drop
set firewall ipv4 name WAN-IN rule 60 conntrack connection-limit source-mask 32
set firewall ipv4 name WAN-IN rule 60 conntrack connection-limit count 100
set firewall ipv4 name WAN-IN rule 60 state new
set firewall ipv4 name WAN-IN rule 60 description "Max 100 concurrent connections/IP"

commit

Conntrack Table Protection

configure

# Increase conntrack table size
set system conntrack table-size 524288

# Aggressive timeouts during attack
set system conntrack timeout tcp time-wait 30
set system conntrack timeout tcp close 10
set system conntrack timeout udp other 30

commit

SYN Flood Protection

SYN Cookies

# Enable SYN cookies (usually enabled by default)
configure
set system sysctl parameter net.ipv4.tcp_syncookies value 1
commit

# SYN cookies allow handling SYN floods without conntrack exhaustion

SYN Rate Limiting

configure

# Limit SYN packets per source
set firewall ipv4 name WAN-IN rule 70 action drop
set firewall ipv4 name WAN-IN rule 70 protocol tcp
set firewall ipv4 name WAN-IN rule 70 tcp flags syn
set firewall ipv4 name WAN-IN rule 70 recent count 20
set firewall ipv4 name WAN-IN rule 70 recent time second
set firewall ipv4 name WAN-IN rule 70 description "SYN flood protection"

commit

Invalid Packet Dropping

Drop Malformed Packets

configure

# Drop invalid state packets
set firewall ipv4 name WAN-IN rule 1 action drop
set firewall ipv4 name WAN-IN rule 1 state invalid
set firewall ipv4 name WAN-IN rule 1 description "Drop invalid packets"

# Drop fragments (often used in attacks)
set firewall ipv4 name WAN-IN rule 2 action drop
set firewall ipv4 name WAN-IN rule 2 fragment match-frag
set firewall ipv4 name WAN-IN rule 2 description "Drop fragments"

commit

TCP Flag Validation

configure

# Drop XMAS scan
set firewall ipv4 name WAN-IN rule 3 action drop
set firewall ipv4 name WAN-IN rule 3 protocol tcp
set firewall ipv4 name WAN-IN rule 3 tcp flags fin,psh,urg
set firewall ipv4 name WAN-IN rule 3 description "Drop XMAS packets"

# Drop NULL scan
set firewall ipv4 name WAN-IN rule 4 action drop
set firewall ipv4 name WAN-IN rule 4 protocol tcp
set firewall ipv4 name WAN-IN rule 4 tcp flags !syn,!ack,!fin,!rst,!urg,!psh
set firewall ipv4 name WAN-IN rule 4 description "Drop NULL packets"

commit

Source Address Validation

Block Bogons

configure

# Block RFC 1918 from WAN
set firewall group network-group BOGONS network 10.0.0.0/8
set firewall group network-group BOGONS network 172.16.0.0/12
set firewall group network-group BOGONS network 192.168.0.0/16
set firewall group network-group BOGONS network 127.0.0.0/8
set firewall group network-group BOGONS network 0.0.0.0/8

set firewall ipv4 name WAN-IN rule 5 action drop
set firewall ipv4 name WAN-IN rule 5 source group network-group BOGONS
set firewall ipv4 name WAN-IN rule 5 description "Block bogon sources"

commit

uRPF (Unicast Reverse Path Forwarding)

configure

# Enable strict uRPF on WAN interface
set firewall interface eth0 in ipv4 urpf strict

# Loose mode (accepts if any route exists)
set firewall interface eth0 in ipv4 urpf loose

commit

Traffic Shaping (QoS)

Prioritize Legitimate Traffic

configure

# Traffic policy
set traffic-policy shaper WAN-OUT bandwidth 1gbit
set traffic-policy shaper WAN-OUT default bandwidth 50%
set traffic-policy shaper WAN-OUT default ceiling 100%
set traffic-policy shaper WAN-OUT default queue-type fair-queue

# High priority class
set traffic-policy shaper WAN-OUT class 10 bandwidth 30%
set traffic-policy shaper WAN-OUT class 10 ceiling 100%
set traffic-policy shaper WAN-OUT class 10 match SSH ip destination port 22
set traffic-policy shaper WAN-OUT class 10 match ICMP ip protocol icmp

# Apply to interface
set interfaces ethernet eth0 traffic-policy out WAN-OUT

commit

Emergency Response

Quick Blocks During Attack

# Block specific attacking IP immediately
configure
set firewall ipv4 name WAN-IN rule 10 action drop
set firewall ipv4 name WAN-IN rule 10 source address 203.0.113.100
commit

# Block attacking network
set firewall ipv4 name WAN-IN rule 11 action drop
set firewall ipv4 name WAN-IN rule 11 source address 203.0.113.0/24
commit

Block by Country (GeoIP)

# VyOS doesn't have native GeoIP
# Use external IP lists

# Download country IP ranges
# Add to firewall group
set firewall group network-group BLOCKED-COUNTRY network x.x.x.x/xx
# ... many entries

set firewall ipv4 name WAN-IN rule 20 action drop
set firewall ipv4 name WAN-IN rule 20 source group network-group BLOCKED-COUNTRY

Monitoring During Attack

Watch Connection States

# Monitor conntrack
watch -n 1 'cat /proc/sys/net/netfilter/nf_conntrack_count'

# Show connections by source
sudo conntrack -L | awk '{print $5}' | cut -d= -f2 | sort | uniq -c | sort -rn | head -20

# Show firewall counters
watch -n 1 'show firewall'

Traffic Analysis

# Monitor interface traffic
watch -n 1 'show interfaces ethernet eth0'

# Capture attack traffic
sudo tcpdump -i eth0 -c 1000 -w /tmp/attack.pcap

# Quick packet rate estimate
timeout 10 tcpdump -i eth0 -c 10000 2>&1 | tail -1

What To Do When Overwhelmed

1. Contact Upstream Provider

# Your ISP can:
# - Apply upstream ACLs
# - Activate DDoS scrubbing
# - Null route attacking traffic

# Have their NOC number ready!

2. Enable Upstream Blackhole

# Advertise your prefix with blackhole community
# Traffic dropped at ISP, saves your link

# See RTBH article for details

3. Use DDoS Protection Service

Services like Cloudflare, Akamai, AWS Shield:
- Route traffic through their scrubbing centers
- They absorb attack, send clean traffic to you
- Works for attacks much larger than your capacity

Best Practices

1. Prepare Before Attack

# Have emergency playbook ready
# Know your upstream NOC contact
# Pre-configure blocking rules (disabled)
# Monitor baseline traffic patterns

2. Layer Your Defense

Layer 1: Upstream ISP (volumetric)
Layer 2: Edge router (smaller attacks)
Layer 3: Application firewall (app-layer)
Layer 4: Application hardening

3. Automate Response

# Script to block high-traffic sources
#!/bin/bash
THRESHOLD=1000  # connections
for ip in $(sudo conntrack -L | awk '{print $5}' | cut -d= -f2 | sort | uniq -c | awk -v t=$THRESHOLD '$1 > t {print $2}'); do
    echo "Blocking $ip"
    # Add firewall rule
done

The Lesson

Edge mitigation buys time. It’s not a complete solution.

What edge routers can do:

Rate limit connections
Drop invalid traffic
Block known attackers
Protect specific services

What edge routers can’t do:

Stop attacks larger than your pipe
Replace upstream scrubbing
Handle sophisticated multi-vector attacks

Build defense in depth:

Upstream DDoS protection for volumetric
Edge rate limiting for application-layer
Application hardening for everything else

The edge router is one layer. Make it effective, but don’t rely on it alone.