DDoS attacks come in three broad families: volumetric floods that saturate your pipe, protocol attacks that exhaust connection state, and application-layer floods that look like legitimate traffic. Each one exhausts a different resource, so each one needs a different defence, and no single layer stops all three. This guide maps the common attack forms to the resource they target and the mitigation that actually works against them, explains what an on-host firewall can and cannot stop, and ends with a practical incident-response runbook for when your server is under fire.

A fresh Linux server ships with no firewall rules at all. Every listener you start is instantly reachable from the whole internet. The fix is a short, well-understood baseline: default-deny inbound, allow established traffic, and an explicit allow-list for the services you actually run. This guide builds that baseline in nftables rule by rule, explains the parts everyone gets wrong (ICMP and IPv6), shows the same policy in ufw and firewalld, and covers how not to lock yourself out, plus the Docker port-publishing trap.

A freshly provisioned server starts receiving SSH probes within minutes of its IP going live; honeypot studies show most exposed machines are attacked within a day. The good news: the defences that matter are a short, boring, one-hour checklist, not a security research project. This guide walks the eight steps in order (users and SSH keys, firewall baseline, automatic updates, fail2ban, time sync, a listener audit, and logging) with the exact commands for Debian/Ubuntu and the RHEL family, plus an honest list of what not to waste your first hour on.

Connecting multiple office sites or datacenters securely and efficiently is a critical challenge for modern businesses. Traditional VPN solutions like IPsec or OpenVPN can be complex to configure and maintain, especially in multi-site environments. WireGuard offers a lightweight, fast alternative that's easier to set up. VyOS 1.5 fully supports WireGuard, making it an excellent choice for organizations looking to interconnect multiple datacenters or sites. In this guide, we'll show you how to set up a site-to-site WireGuard tunnel on VyOS 1.5. We'll cover routing, firewall configuration, and best practices. By the end, your sites will be securely connected over the internet with traffic routed effectively between LANs.