Guides

Kernel-Level DDoS Protection: Filtering Traffic with nftables Netdev Ingress

When a volumetric DDoS attack hits, traditional iptables rules will exhaust your CPU before filtering the traffic. Learn how to drop millions of malicious packets per second at the network driver level using the nftables netdev family.

The Overhead of Legacy Netfilter

When a volumetric DDoS attack hits your server, iptables is often the first bottleneck. By the time a packet reaches the PREROUTING chain, the Linux kernel has already allocated an sk_buff structure and triggered hardware interrupts. If you are dealing with millions of packets per second (Mpps), your CPU will hit 100% usage entirely consumed by ksoftirqd, and legitimate traffic will drop. To survive, you must filter traffic before the network stack even begins processing it.

The Power of the Netdev Family

Modern Linux kernels introduce the nftables netdev family, which provides an ingress hook attached directly to the network interface. This allows you to drop malicious packets at the driver level, acting as a software-defined line-rate firewall. If you are deploying a robust KVM VPS, utilizing the netdev hook is mandatory for surviving L3/L4 floods. Before touching advanced routing, ensure your baseline security is configured as described in our Securing Your Server guide.

Crafting the Ingress Ruleset

We will create a dedicated table attached to the eth0 interface to drop common volumetric vectors, such as UDP amplification floods and fragmented packets, instantly. Open your terminal and create a new ruleset file:

sudo nano /etc/nftables.conf

Inject the following configuration. This block creates a netdev table and an ingress chain with a priority of -500, ensuring it executes before any other kernel process. We explicitly drop fragmented packets and UDP traffic targeting non-standard high ports, while counting the dropped packets for telemetry:

table netdev ddos_defense {
    chain ingress_eth0 {
        type filter hook ingress device eth0 priority -500; policy accept;
        ip frag-off & 0x1fff != 0 counter drop
        udp dport > 10000 limit rate over 10000/second burst 10000 packets counter drop
        ip saddr { 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12 } counter drop
    }
}

Applying and Monitoring the Defense

Once the configuration is saved, flush the existing rules and load your new ingress defense. Unlike legacy firewalls, nftables applies changes atomically, meaning there is zero downtime during the reload. To verify the defense is active and actively dropping malicious traffic, you can list the table and observe the hardware counters incrementing in real-time:

sudo nft -f /etc/nftables.conf
sudo nft list table netdev ddos_defense

This architecture allows your machine to process massive traffic spikes without exhausting CPU resources. However, if the volumetric attack exceeds the physical capacity of your network port, no software can save you. At that stage, migrating to enterprise-grade AMD Dedicated Servers with premium uplink capacity at CLOUD HIVE DC is the only solution.

Back to Blog