Skip to main content

Absorb a volumetric attack

A flood is arriving faster than your application can refuse it. The problem is rarely that the requests are hard to identify — it is that identifying them at all costs more than you have left, because by the time a userspace process sees a packet the kernel has already allocated for it.

Drop it before the cost is paid​

Access rules are enforced by Hillock at the XDP hook, which runs in the driver before routing and before a socket buffer exists. That is the cheapest drop a Linux host can perform.

The tradeoff is deliberate: XDP sees an address and a port, not a request. So this layer answers is this source allowed to talk to me at all, and nothing more subtle.

Access rulesFirewall rules
HookXDP, before routingTC, after ingress and before egress
MatchesIP addressIP, port range, protocol, TCP flags
DirectionInboundInbound and outbound
Use it forAbsorbing a known-bad source at volumeExpressing a specific allowed conversation

Where the list comes from​

You are not expected to write it by hand. Threat detection distributes known-bad sources as a database the agent pulls and installs into the kernel maps. ASN and country are resolved on the platform side and arrive already expanded, so the datapath never does a lookup.

--show-firewall-rules reports what the kernel actually holds, which is the thing to check when a rule appears not to work.

Turning it on​

# /etc/synapse/config.yaml
firewall:
  mode: "auto"        # auto, xdp, nftables, iptables, none

platform:
  threat:
    enabled: true

auto picks XDP where the kernel supports it and falls back to nftables, then iptables. The rule you wrote does not change — only the machinery under it. See Firewall Rules.

See it happen first

The playground has a DDoS Attempt scenario and a geo-blocked Germany Request, both stopped by access rules — the same layer described here, without attaching anything to a NIC.

Where this stops working​

  • XDP is not universally available. It needs a driver that supports it and a kernel with BTF. Without them you land on nftables or iptables, which still work and still drop early, but not at driver level.
  • An address list cannot stop a distributed attack from addresses you have never seen. This absorbs known-bad and repeat sources cheaply; it is not a substitute for upstream capacity when the flood is genuinely novel and genuinely large.
  • Layer 7 floods look like valid traffic here. A slow flood of well-formed requests from unremarkable addresses passes XDP untouched and has to be handled at the proxy — see Stop bots.
  • Restarting the agent has a brief window. The XDP link is pinned and re-attachment is not instantaneous; plan restarts accordingly.

See also​