{"id":7406,"date":"2020-05-06T11:39:56","date_gmt":"2020-05-06T11:39:56","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/ddos-protection-for-applications-in-a-data-center\/"},"modified":"2026-11-03T19:28:39","modified_gmt":"2026-11-03T19:28:39","slug":"ddos-protection-for-applications-in-a-data-center","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/de\/blogs\/ddos-protection-for-applications-in-a-data-center\/","title":{"rendered":"DDoS protection for applications in a data center"},"content":{"rendered":"<p><strong>Attackers target the origin<\/strong><\/p>\n<p>To protect the <em>origin<\/em>&nbsp;infrastructure, the edge provider handles Domain Name System (DNS) resolution,&nbsp;so that requests to your domains do not reveal the origin IP addresses. This process mitigates attacks&nbsp;against public-facing resources or websites and absorbs them on the edge. Edge providers can distribute&nbsp;attacks among hundreds of locations around the world before getting anywhere near your servers.<\/p>\n<p>But what if an attacker does know your origin IP address or related blocks? &nbsp;Can they attempt to launch&nbsp;a DDoS attack directly? In a word, yes.<\/p>\n<p>There are plenty of ways an attacker might come to learn your origin IP address, including by exploring<br \/>\nthe following avenues:<\/p>\n<ul>\n<li>Historic DNS records, perhaps from before you implemented the edge security. &nbsp;It\u2019s a good idea to&nbsp;request new IP ranges after such an implementation.<\/li>\n<li>Similar or generic subdomains, for example, **dev.example.com**, which might point back to your origin.<\/li>\n<li>Leaks from the application level, perhaps in HTTP headers.<\/li>\n<li>Secure Sockets Layer (SSL) Virtual Private Network (VPN) endpoints, which might expose a company domain&nbsp;name during the SSL handshake.<\/li>\n<li>Bad actors with inside knowledge, such as a disgruntled ex-employee.<\/li>\n<li>Compromise of a development environment or configuration management database.<\/li>\n<li>Malware on a company laptop.<\/li>\n<li>Social engineering or another sophisticated attack.<\/li>\n<\/ul>\n<p>You can mitigate each of those avenues individually, but a persistent attacker might find a way to get&nbsp;through. Let\u2019s assume that they have done so.<\/p>\n<p><strong>First line of defense: Firewalls<\/strong><\/p>\n<p>Within a data center environment or Private Cloud, perimeter firewalls are the first line of defense. Most people&nbsp;configure firewalls to allow incoming connections only via the edge provider, controlling access from Layer 4 or&nbsp;higher and preventing attempts to bypass a Layer 7 WAF.<\/p>\n<p>But perimeter firewalls have a finite capacity for packet filtering and are connected to the public Internet with&nbsp;finite bandwidth. For many setups, this might be a 1 Gbps switch port or perhaps a 10 Gbps uplink. DDoS attacks,&nbsp;especially reflection attacks, can easily be in the tens or hundreds of Gbps. If bad actors launch an attack&nbsp;against the origin, then the firewall\u00ae and everything behind it is offline. You need another line&nbsp;of defense.<\/p>\n<p><strong>Next line of defense: Monitoring and mitigation<\/strong><\/p>\n<p>\n<a href=\"https:\/\/www.rackspace.com\/en-gb\/security\/tools\/ddos-mitigation\">Rackspace DDoS Mitigation Services<\/a>&nbsp;offer&nbsp;comprehensive traffic monitoring, multilayered anomaly detection technologies, and immediate DDoS attack&nbsp;mitigation to help keep your data secure and your business online. Our highly skilled team of DDoS specialists&nbsp;augments the hardware capability with human intuition to fend off attacks in real-time.<\/p>\n<p>Also, consider reducing the attack surface or eliminating it. Tools such as&nbsp;<a href=\"https:\/\/www.akamai.com\/uk\/en\/products\/security\/enterprise-application-access.jsp\">Akamai Enterprise Application Access<\/a>&nbsp;and <a href=\"https:\/\/www.cloudflare.com\/en-gb\/products\/argo-tunnel\/\">Cloudflare Argo Tunnel<\/a>&nbsp;work by deploying agents and&nbsp;connectors within your origin infrastructure that make secure <em>outgoing<\/em>&nbsp;connections to the CDN edge. &nbsp;These tools then&nbsp;send legitimate or authenticated requests back through those connections, with no need to expose your website or&nbsp;application to the Internet. These techniques result in no incoming firewall filtering and no access control lists. This powerful solution works exceptionally well with containerized workloads, eliminating the need to manage ingress controllers.<\/p>\n<p><strong>Conclusion<\/strong><\/p>\n<p>In summary, WAF and DDoS protection are essential for business-critical workloads and websites. Edge providers like Akamai, Cloudflare, and Imperva offer great solutions for performance and security. Despite these options, a sophisticated, persistent attacker can still attempt to attack the origin directly. Rackspace security experts can help with that.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>DDoS protection for applications in a data center<\/p>\n","protected":false},"author":2,"featured_media":7408,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26411","content_type":"blog","created_by":"10130","authored_on":"2023-12-21T12:39:55+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Staff","seo_description":"Discover features and benefits of Armor Anywhere cloud security platform by Rackspace. Threat detection, response, and compliance.\r\n\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26411-insights_image-aws-technical-blog-1-insights.png","field_partners":"","rxt_platforms":"On-Premises Security, Palo Alto Networks","product":"","publisheddate":"2020-05-06T11:39:56","rxt_solutions":"","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"DDoS Protection for Applications in a Data Center | Rackspace","field_topics":"","field_slug":"ddos-protection-for-applications-in-a-data-center","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7406","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/7406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/comments?post=7406"}],"version-history":[{"count":1,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/7406\/revisions"}],"predecessor-version":[{"id":7407,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/7406\/revisions\/7407"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media\/7408"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media?parent=7406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/categories?post=7406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/tags?post=7406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}