How to set up DDoS protection for NGINX or Apache?

Question

Nginx

Periodically, very strong delays are noticed on the server and access logs grow from a large number of requests to a particular or several sites. We determine that this is a potential attack by the server's response 499 and by repeated frequent requests from the same IP.

The idea of ​​protection is something like this: If the server responds with 499, then block this IP for 10-20 seconds.

What are the tools/settings to implement such blocking? Or maybe there are other ways and approaches?

Answer 1

With these attack detection parameters, I think fail2ban will suit you.

Answer 2

If you have access to the application code, then it is better to create blacklists and quickly filter out requests already on the application.
fail2ban is a crutch for me.

Answer 3

The idea of ​​protection is something like this: If the server responds with 499, then block this IP for 10-20 seconds.

Stop pissing and cutting, fork out, find a competent specialist and a couple of competent specialists. Either get under protection (do not look at domestic defenders from attacks, one grief).