Mitigate DDoS attack with HAProxy [duplicate]

Solution 1:

I think you're going after the wrong potential fix for this scenario. If you're being DDoSed then the only real route of mitigation you have is to talk to your upstream providers and get them to null-route/blackhole the traffic before it gets to your network. Otherwise, no matter what you do, it'll still be reaching the edge of your network, and potentially (probably) saturating the connection at your end.

The only thing to do is to have it blocked before it reaches the edge of your network. Any kind of DDoS mitigation scenario is unlikely to be as useful, as the traffic has to get onto your network before it can be ignored/blocked/dropped. As a result, it'll still eat your bandwidth.

Solution 2:

In addition, simply increasing the number of available workers can make the problem worse if you don't actually have enough memory available for all those child processes. You'll start swapping to disk and your machine will grind to a halt. Surprised that no one mentioned mod_evasive or mod_security, too; having some automated heuristics to block access to computationally-expensive resources helps quite a bit in the case where you upstream won't or can't nullroute.

EDIT: this was a comment, but I turned it into an answer per @Tom O'Connor's suggestion.