What Firewalls Can Block
Protocol-Based Attacks: Filters out exploited protocol vulnerabilities like ICMP floods (ping floods) or spoofed packet floods using IP/port rules.
Basic Connection Limits: Standard firewalls can rate-limit incoming TCP connections from a single IP to prevent connection exhaustion.
Stateful Inspection: Next-Generation Firewalls (NGFW) can drop incomplete or suspicious connection attempts (such as SYN floods) before they hit internal servers.
Where Firewalls Fail Against DoS/DDoS
Volumetric Attacks: If an attacker sends 100 Gbps of traffic and your network pipe is 10 Gbps, the link saturates upstream before traffic even hits the firewall.
Resource Exhaustion: Stateful firewalls track active connections in a state table. Flooding millions of request IPs exhausts the firewall's own CPU/RAM, causing the firewall itself to crash or drop legitimate traffic.
Application-Layer (Layer 7) Attacks: HTTP GET/POST floods mimic legitimate user behavior. Standard firewalls cannot easily distinguish valid web traffic from malicious requests.
Effective Defense Strategy For complete protection, firewalls must be combined with dedicated DDoS mitigation systems:
Cloud-based Anycast Scrubbing: Services (like Cloudflare, AWS Shield, or Akamai) absorb massive volumetric traffic upstream before it reaches your network interface.
Web Application Firewalls (WAF): Specifically inspect Layer 7 traffic to filter out malicious HTTP requests, botnets, and rate-limit specific endpoints.
ISP-Level Rate Limiting: Routers at the ISP level drop BGP blackhole or rate-limited traffic during high-volume spikes.
CDN: Absorbs massive volumetric traffic spikes using Anycast networks and integrates Edge Web Application Firewalls (WAF).
