> For the complete documentation index, see [llms.txt](https://services.validexis.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://services.validexis.com/validator-security-our-approach-and-protection-measures/protecting-validator-from-ddos-attacks.md).

# 🛡️ Protecting Validator from DDoS Attacks

### Understanding the DDoS Threat

**What is a DDoS attack?**\
A Distributed Denial of Service (DDoS) attack floods your server with excessive traffic, making it unavailable.

**Types of DDoS attacks:**

* **Network-layer attacks (L3-L4, volumetric attacks)** – Overloading bandwidth (UDP flood, SYN flood).
* **Transport-layer attacks (L4)** – Exhausting connections (TCP flood, Slowloris).
* **Application-layer attacks (L7, HTTP flood)** – Overloading APIs and RPC endpoints.

### Network-Level Protection (L3-L4)

At the network level, you need to limit malicious traffic.

#### Configuring Firewalls (UFW, iptables)

**UFW (Uncomplicated Firewall)**

```bash
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 26656/tcp  # Open port for P2P (example for Cosmos SDK)
sudo ufw enable
```

**iptables (Advanced option)**

```bash
# Blocking UDP flood
sudo iptables -A INPUT -p udp --dport 26656 -m limit --limit 10/s --limit-burst 20 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 26656 -j DROP

# SYN flood protection
sudo iptables -A INPUT -p tcp --syn --dport 26656 -m limit --limit 10/s --limit-burst 20 -j ACCEPT
sudo iptables -A INPUT -p tcp --syn --dport 26656 -j DROP
```

#### Rate Limiting (Restricting Requests)

**Fail2Ban** can automatically ban suspicious IPs.

```bash
sudo apt install fail2ban -y
sudo nano /etc/fail2ban/jail.local
```

Add:

```
[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600
```

Apply changes:

```bash
sudo systemctl restart fail2ban
```

***

### Protecting Network Infrastructure

#### Using Cloudflare or Another CDN

Cloudflare or Radware helps filter malicious traffic.

**How to set up Cloudflare?**

1. Register on [Cloudflare](https://www.cloudflare.com/).
2. Add your domain.
3. Enable **"Under Attack Mode"**.
4. Restrict API access to trusted IPs only.

#### Setting Up Reverse Proxy (NGINX)

**Why use it?**\
NGINX can hide your real IP and limit requests.

**Example config for L7 attack protection:**

```nginx
server {
    listen 80;
    server_name validator.example.com;

    location / {
        proxy_pass http://localhost:26657;
        proxy_set_header X-Real-IP $remote_addr;
        limit_req zone=one burst=5 nodelay;
    }

    limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
}
```

Apply the config:

```bash
sudo systemctl restart nginx
```

***

### Monitoring and Automated Response

#### Installing CrowdSec

CrowdSec detects and blocks attacks.

```bash
curl -fsSL https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
sudo apt install crowdsec -y
```

####  Monitoring Load (Prometheus + Grafana)

1. Install **Prometheus**:

```bash
sudo apt install prometheus -y
```

2. Install **Grafana** and set up dashboards.

***

### Additional Security Measures

* **Restrict access by IP** – Allow access only from trusted IPs.
* **Use VPN (WireGuard, OpenVPN)** – Hide your validator’s real IP.
* **Separate RPC and P2P networks** – Don’t run everything on a single server.