I had a think and basically even iptable blocking the third world isn't entirely effective. The packets have to get to your iptables rules to even get dropped. Say the device directly on the IP drops connections from the third world; it's all well and good until there's 5 million of them and it's taking in the packet, reading the IP header, checking the ruleset, and then deciding to drop the packet. Holding the packet in a buffer while it does so etc etc. I haven't done the napkin maths but I would wonder how much hardware you'd even need to cope with a couple million a second. Would even the intermediate infrastructure handle that? Your ISP hardware would get flooded too.
There's basically nothing you can do without big investment into intermediate hardware in a bunch of anti-ddos techniques. And that's where big, centralised services like cloudflare come in.
>>106549144
What is rolling around my head at the moment is if there's any fundamental redesign of networking technology, starting from the physical layer upwards, that could actually handle a coordinated DDoS attack. My initial instinct is to basically say.. no. Like I wrote above, even the lightest protocol possible would have to physically be spending time reading signals coming down the wires, which takes time. And a coordinated attack can just consume all the 'time' your hardware can use.
