How to block DDoS at the edge using iptables and eBPF

The challenge of protecting the edge against volumetric attacks

When a server experiences a distributed denial-of-service attack, known as DDoS, the volume of incoming data can exhaust operating system resources within seconds. Historically, administrators rely on iptables, the classic Linux firewall tool, to filter unwanted packets. However, when millions of packets per second hit the interface, the kernel's packet processing machinery consumes all available CPU.

In practice, this means that even before an iptables rule decides to drop a malicious packet, the system has already spent valuable processing cycles receiving and queueing it. To overcome this limitation, modern network engineering has adopted eBPF, or Extended Berkeley Packet Filter, a technology that safely runs custom bytecode programs directly inside the Linux kernel space.

What is eBPF and how XDP transforms network filtering

eBPF acts as a lightweight virtual machine running custom code in the kernel without needing new loadable modules or reboots. Within this ecosystem, XDP, which stands for eXpress Data Path, operates at the lowest possible layer of the network card driver, intercepting packets as soon as they physically arrive at the interface.

Combining this technology with network infrastructure allows instant decisions on traffic handling. For experienced engineers managing complex setups, using this approach is just as crucial as fixing packet loss and jitter on critical links to maintain robust system stability under severe stress. The XDP program can return direct instructions like XDP_DROP to discard digital garbage instantly, saving vital resources.

Writing a high-performance filter with XDP

To put theory into practice, we create a constrained C program compiled into bytecode and injected into the network interface. This code inspects Ethernet, IP, and TCP or UDP headers of each incoming packet, identifying typical malicious traffic patterns or empty packet floods.

The code below demonstrates a basic XDP filter that rejects packets destined for a specific port under attack:

#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/udp.h>
#include <bpf/bpf_helpers.h>

SEC("xdp")
int block_udp_flood(struct xdp_md *ctx) {
    void *data = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;
    struct ethhdr *eth = data;
    
    if ((void *)(eth + 1) > data_end) return XDP_PASS;
    if (eth->h_proto != __constant_htons(ETH_P_IP)) return XDP_PASS;
    
    struct iphdr *ip = (void *)(eth + 1);
    if ((void *)(ip + 1) > data_end) return XDP_PASS;
    
    if (ip->protocol == IPPROTO_UDP) {
        struct udphdr *udp = (void *)(ip + 1);
        if ((void *)(udp + 1) > data_end) return XDP_PASS;
        
        if (udp->dest == __constant_htons(80)) {
            return XDP_DROP;
        }
    }
    return XDP_PASS;
}

This script runs directly inside the driver, ensuring drops happen nanoseconds after physical packet arrival. If traffic is legitimate, it simply returns XDP_PASS, allowing normal flow to proceed down the rest of the Linux network stack.

The complementary role of iptables in defense-in-depth

While XDP and eBPF excel at eliminating raw volumetric attacks at the driver layer, they operate without complex connection state tracking. This is precisely where iptables and its modern successor, nftables, remain indispensable for infrastructure security.

As eBPF blocks bulk noise at the entrance, iptables handles contextual rules, such as stateful connection rate-limiting for SSH ports or applying NAT policies. Integrating both tools creates a robust multi-layered defense where each layer operates right where it delivers highest operational efficiency.

Step-by-step guide to load and test the XDP filter

To deploy this architecture in production, follow the correct sequence of commands on your Linux workstation with kernel eBPF support enabled.

1. Install development tools and required compilers by running sudo apt install clang llvm libelf-dev libpcap-dev build-essential in your terminal.
2. Compile the C code of the XDP filter into bytecode with clang -O2 -target bpf -c ddos_filter.c -o ddos_filter.o to generate the kernel-compatible binary object.
3. Load the program directly onto your primary network interface using sudo ip link set dev eth0 xdpgeneric obj ddos_filter.o sec xdp to start immediate filtering.

After loading the filter, verify that the interface processes packets correctly using traffic monitoring tools. This verification ensures no legitimate services are accidentally affected by the new edge blocking rules. To complement this implementation in production environments, see our related technical analyses on Multimeter stuck? How to track board shorts safely and False alerts in Zabbix? How to tune triggers and reduce noise.

Final thoughts on modern attack mitigation

Implementing eBPF and XDP filtering combined with iptables radically transforms the resilience of any internet-exposed infrastructure. By pushing block logic as close to the hardware as possible, we save valuable CPU time and prevent volumetric attacks from crashing critical applications.

Keeping this architecture updated requires ongoing monitoring, regular stress tests, and fine-tuning of packet inspection rules. With proper planning, your network edge will be ready to absorb anomalous traffic spikes with unmatched stability and efficiency.