Kernel blocking and connection protection
Limit connections in the node kernel: per-IP concurrency and new-connection rate, idle connections, malformed TCP, CC bans; XDP or nftables.
What it solves
Floods of idle connections, extreme new-connection rates and TCP packets with forged flags are too late to handle once they reach OpenResty: they fill the node's connection table and CPU. Connection and DDoS protection enforces these limits in the node kernel, where excess clients are dropped or banned, while site and L4 protection keep working.
At install and on every agent start, the node picks its L4 kernel filter in the order native XDP, generic XDP, nftables; nodes without XDP support use nftables. The XDP filter column of the node list shows which one each node uses.
Turning it on
Connection protection comes with the control plane in both editions; the platform administrator sets it for all nodes.
- Open Nodes → Connection protection and fill in what you need (0 turns an item off; with everything off, nodes install no protection rules).
- Save to create a draft, Check it, then Activate and deliver, which pushes it to every node at once.
- Current revision at the top shows active, checked and waiting, or draft.
Per site, the firewall action policy (Firewall configuration → Firewall action policy) switches to a high-load action when attack traffic passes the trigger threshold, blocking chosen networks in the node kernel, and lifts it after the recovery windows.
Main settings
| Setting | What it does |
|---|---|
| Per-client limits | Concurrent connections, new connections per second and per minute, ban time on excess |
| Port limit | Total concurrent connections per port |
| Idle connection detection | A connection that sends no data within the set time is idle; enough of them within the window bans the client and closes them |
| Malformed TCP filtering | NULL, Xmas, SYN+FIN, SYN+RST on by default; orphan FIN and ALL off by default |
| Drop invalid packets | Drops packets the kernel judges invalid, such as ACK/RST that belong to no connection |
| Sync CC bans to the kernel | Off / only ports the site uses alone / every port of the site |
| Allowlist | One address or network per line; every node's own addresses are exempt automatically |
Typical uses
- Worn down by idle connections: turn on idle detection so repeat offenders are banned within the window.
- Port scans: keep the default malformed-flag types to drop the combinations scanners use.
- A CC attack hopping between ports: sync CC bans to the kernel so banned IPs are stopped there.
Limits and notes
- Counting is per client: an IPv4 address or an IPv6 /64.
- UDP (including HTTP/3) is not limited here; L4 UDP forwards use their own rate limits.
- "Every port of the site" also affects other sites on a shared port.
- XDP needs kernel 5.9 or later; if the XDP program fails to load the node falls back to nftables, and sites and other protection are unaffected.
- The firewall action policy's high-load action runs on a tenant's own nodes only.