Preventing DoS attacks is infinitely easier than preventing DDoS's, since you're basically only blocking one IP. With a DDoS, you have to block tens, maybe even hundred or thousands of IP's. http://wiki.wegotserved.co.uk/Block_Certain_IP_Addresses_from_Accessing_Your_Website That site seems to give the information needed. Post here again if you need anymore help. That method seems to help against DoS attacks, but you may need to just sit out and twiddle your thumbs against a DDoS.
To Tezlin: That guide is for IIS. If you're using IIS, then maybe you deserve to get DDoS'd. Do you have root access through ssh? If you do, look at Iptables. http://www.netadmintools.com/art216.html To find out which IP addresses you're dealing with, run "netstat -tcpn" as root, and see which IP addresses are appearing the most. If the person operating the botnet is any skilled, however, you won't see many IP addresses repeating. Code: iptables -A INPUT -s IPADDRESS -j DROP ^ run that if you see a single or small source of the attack. Code: #!/bin/bash echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time echo 1 > /proc/sys/net/ipv4/tcp_window_scaling echo 0 > /proc/sys/net/ipv4/tcp_sack echo 1280 > /proc/sys/net/ipv4/tcp_max_syn_backlog for z in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $z done echo 1 > /proc/sys/net/ipv4/tcp_syncookies echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses echo "1" > /proc/sys/net/ipv4/conf/all/accept_redirects echo "1" > /proc/sys/net/ipv4/conf/all/log_martians echo "65535" > /proc/sys/net/ipv4/ip_conntrack_max /sbin/iptables -P INPUT ACCEPT /sbin/iptables -P OUTPUT ACCEPT /sbin/iptables -P FORWARD DROP /sbin/iptables -F /sbin/iptables -F INPUT /sbin/iptables -F OUTPUT /sbin/iptables -F FORWARD /sbin/iptables -F -t mangle /sbin/iptables -X /sbin/iptables -A INPUT -i lo -j ACCEPT /sbin/iptables -A INPUT -d 127.0.0.0/8 -j REJECT /sbin/iptables -A INPUT -i eth0 -j ACCEPT /sbin/iptables -A INPUT -m state --state INVALID -j DROP /sbin/iptables -N syn-flood /sbin/iptables -A syn-flood -m limit --limit 100/second --limit-burst 150 -j RETURN /sbin/iptables -A syn-flood -j LOG --log-prefix "SYN flood: " /sbin/iptables -A syn-flood -j DROP ^ Save that& run it as root, it should help you lower the effects by a lot. If it's Apache that's being targeted specifically, either switch to lighttpd, or install mod_evasive.
