# How Does DDoS Protection Work? Firewall, WAF, CDN, Anti-DDoS and Scrubbing Centres

**URL:** https://securesys.com.tr/en/learning/ddos-simulation/how-ddos-protection-works-waf-cdn-scrubbing

![How Does DDoS Protection Work? Firewall, WAF, CDN, Anti-DDoS and Scrubbing Centres](/images/bilgi-merkezi/covers/cover-ddos-07.webp)

Relying on a single security product to protect against DDoS attacks is usually not enough.

Because DDoS attacks can target different layers.

One attack fills the internet link.

Another exhausts the session table on the firewall.

A third targets the web application's login or API services.

An effective **DDoS protection** architecture must therefore be layered.

In corporate environments, DDoS defence is generally built from these components working together:

- Firewall
- Anti-DDoS
- Scrubbing centre
- CDN
- WAF
- Bot management
- Rate limiting
- DNS protection
- NDR
- SIEM and SOC

The fundamental approach here is this:

**To detect attack traffic as early as possible, filter it as far out as possible, and keep legitimate users served.**

DDoS protection must therefore be treated less as a device and more as a **DDoS mitigation architecture**.

#### What Is DDoS Protection?

**DDoS protection** is the whole set of technical and operational controls used to preserve a system's availability under distributed denial of service attacks.

The aim is not merely to block attack traffic.

The real objective must be;

- to sustain service availability,
- to limit the attack's impact,
- to protect genuine users,
- to prioritise critical services,
- to detect the attack quickly,
- to recover quickly afterwards.

Every one of those matters.

DDoS protection is therefore directly related to the concept of **cyber resilience**.

### What Is the Difference Between DDoS Protection and DDoS Mitigation?

These two terms are often used interchangeably.

But a small distinction can be drawn.

#### DDoS Protection

Refers to the whole security architecture used against DDoS attacks.

#### DDoS Mitigation

Is the active response process aimed at reducing or eliminating the impact of attack traffic once the attack has started.

For example;

using an anti-DDoS service is part of the protection strategy.

Diverting traffic to a scrubbing centre during the attack is a mitigation activity.

### What Should a DDoS Protection Architecture Look Like?

A general corporate DDoS defence architecture can be thought of as follows:

#### Internet

↓

#### ISP / Upstream Protection

↓

#### Anti-DDoS / Scrubbing Centre

↓

#### CDN / Edge Security

↓

#### Firewall

↓

#### WAF / Bot Protection / Rate Limiting

↓

#### Load Balancer

↓

#### Application / API

↓

#### Database / Backend

Each layer in this chain handles a different type of attack.

Volumetric attacks should be stopped as far upstream as possible.

Layer 7 attacks should be analysed in the layers closer to the application.

### What Does a Firewall Do in DDoS Protection?

The firewall is one of the fundamental components of network security.

For DDoS, a firewall can provide mechanisms such as;

IP filtering,

protocol filtering,

connection limiting,

SYN protection,

rate limiting,

session control.

If an abnormal number of connections arrives from one source, the firewall can limit it.

But there is an important boundary:

**Traffic reaching the firewall has already passed through the organisation's internet link.**

If the attack is exhausting the internet link's capacity, the user still cannot reach the service even when the firewall blocks the attack.

The firewall is therefore not enough on its own, particularly against volumetric DDoS attacks.

### Can the Firewall Itself Become a Target in a DDoS Attack?

Yes.

Stateful firewalls hold session information for active connections.

During a heavy attack;

the session table,

the NAT table,

CPU,

memory,

packet processing

resources can be exhausted.

The firewall can then stop being a security control and become the bottleneck.

When assessing DDoS capacity, therefore, not only the firewall's throughput but also its;

PPS,

CPS,

concurrent session,

CPU,

memory

capacity must be examined.

### The Difference Between Stateful Firewalls and Stateless Filtering

A **stateful firewall** tracks the connection's state.

It knows which stage a TCP session is in, for example.

**Stateless filtering**, by contrast, can filter packets against particular criteria without tracking connection state.

In high-volume attacks, state tracking consumes additional resources.

Some DDoS mitigation infrastructures therefore prefer to block attack traffic as early and as cheaply as possible.

### What Does a WAF Do in DDoS Protection?

A **web application firewall (WAF)** is an important defensive layer, particularly against **layer 7 DDoS** attacks.

A WAF can inspect HTTP and HTTPS traffic at the application level.

It can analyse information such as;

the URL,

the HTTP method,

headers,

cookies,

the session,

request frequency,

client behaviour.

It can thereby help detect behaviour such as;

HTTP flood,

login abuse,

API request flood,

bot traffic.

### What Is the Difference Between a WAF and a Firewall?

A firewall works mostly at the network and transport layers.

A WAF analyses web application traffic.

Put simply:

#### Firewall: who can connect?

#### WAF: what is this HTTP request trying to do?

The two are therefore not alternatives to one another.

They have different roles in the DDoS protection architecture.

### Can a WAF Stop Layer 3/4 DDoS?

Generally not on its own.

If the organisation's internet connection is 2 Gbps and a 20 Gbps UDP attack arrives, the traffic can exhaust the upstream link before ever reaching the WAF.

The WAF's layer 7 analysis capability is then useless.

In high-volume DDoS attacks, therefore, mechanisms such as:

#### Upstream Anti-DDoS + Scrubbing

are needed.

The WAF comes into play mainly for application layer attacks.

### How Does a CDN Work in DDoS Protection?

A **content delivery network (CDN)** delivers web content to users through distributed edge points.

This structure provides several advantages for DDoS resilience.

First, traffic is not concentrated on a single data centre.

Second, cacheable content can be answered at the edge without reaching the origin server.

Third, large CDN platforms can have very wide network capacity.

A CDN can therefore reduce DDoS impact for web-based services in particular.

### Does a CDN Block Every DDoS Attack?

No.

A CDN protects only the traffic passing through it.

If the attacker can reach services outside the CDN such as;

the origin IP,

the VPN,

the mail server,

DNS,

a different API endpoint,

the attack can continue.

One of the most important security topics when using a CDN is therefore **origin protection**.

### What Is Origin Protection?

The **origin server** is the web application's real backend server.

When running behind a CDN, it is preferable that users cannot reach the origin directly.

The origin can accept traffic only from the CDN's IP ranges, for instance.

The attacker can then not bypass the CDN and reach the server directly.

If the origin IP can be found openly on the internet, CDN protection becomes largely ineffective.

In DDoS security, therefore:

#### Origin IP Exposure

is an important risk area.

### How Can the Origin IP Be Exposed?

The origin IP can become visible from outside for various reasons.

For example;

old DNS records,

mail services,

subdomains,

SSL certificate history,

old hosting records,

other services on the same IP

can give clues about the origin address.

Changing DNS alone is therefore not enough after a CDN migration.

The historical attack surface must be assessed too.

### What Is Anti-DDoS?

**Anti-DDoS** is the general name for the specialised security solutions used to detect DDoS attacks and filter malicious traffic.

Anti-DDoS platforms can use mechanisms such as;

traffic anomaly detection,

signatures,

behaviour analysis,

rate analysis,

protocol validation,

traffic filtering.

Anti-DDoS solutions can be deployed in;

on-premise,

cloud-based,

hybrid

architectures.

### What Is On-Premise Anti-DDoS?

**On-premise anti-DDoS** is a protection system running in the organisation's own data centre or at its network edge.

Its advantages can be;

low latency,

detailed visibility of local traffic,

fast detection.

But it has a critical disadvantage.

If the attack is filling the organisation's internet link, the traffic can exhaust the connection before ever reaching the on-premise anti-DDoS system.

On-premise protection can therefore be effective for low and medium-volume attacks, while high-volume attacks may require cloud scrubbing alongside it.

### What Is Cloud Anti-DDoS?

**Cloud-based anti-DDoS** filters attack traffic in high-capacity cloud or service provider infrastructure.

Its advantage is that attack traffic can be cleaned before reaching the organisation's own internet link.

This approach matters particularly for;

volumetric attacks,

large-scale botnets,

reflection/amplification

attacks.

### What Is Hybrid DDoS Protection?

**Hybrid DDoS protection** is the combined use of on-premise and cloud anti-DDoS systems.

Under normal conditions the on-premise system can detect;

low-volume attacks,

application anomalies,

local traffic behaviour.

When the attack capacity rises, traffic can be diverted to the cloud scrubbing centre.

This model aims to combine the advantages of both approaches.

### What Is a Scrubbing Centre?

A **scrubbing centre** is high-capacity infrastructure that analyses attack traffic, cleans out malicious packets and forwards only legitimate traffic to the target system.

The basic operating model is as follows:

#### Internet Traffic

↓

#### Scrubbing Centre

↓

**Attack traffic → dropped**

**Legitimate traffic → clean traffic**

↓

#### Customer Infrastructure

A scrubbing centre therefore plays a critical role in volumetric DDoS attacks in particular.

### How Does a Scrubbing Centre Engage?

Different methods can be used depending on the architecture.

For example, traffic can be diverted to the scrubbing centre through;

BGP route advertisement,

traffic diversion,

DNS routing,

a proxy architecture.

One of the most critical metrics here is:

#### Time to Mitigate (TTM)

as a value.

How long after the attack starts does the traffic begin to be cleaned?

### What Does Traffic Scrubbing Mean?

**Traffic scrubbing** is the process of separating attack traffic from legitimate traffic.

The system can analyse characteristics such as;

packet characteristics,

source behaviour,

protocol compliance,

rate,

reputation,

known attack signatures.

The aim is not simply to cut high traffic.

Genuine users' connections must be preserved.

### Why Are False Positives Critical in Scrubbing?

An anti-DDoS platform may block all attack traffic.

But if it also blocks a significant proportion of genuine users, it has not succeeded.

For example;

mobile operator NAT IPs,

corporate proxy users,

genuine API customers generating high traffic

can be misclassified as attackers.

Mitigation success must therefore be assessed on:

#### Attack Block Rate

together with

#### Legitimate Traffic Success Rate

as a pair.

### What Is Always-On DDoS Protection?

In the **always-on DDoS protection** model, traffic passes continuously through the DDoS protection infrastructure or is continuously analysed.

Its advantage is that no additional route change is needed when the attack starts.

Mitigation can happen faster.

It can be preferable for highly critical services that must remain continuously available.

### What Is On-Demand DDoS Protection?

In the **on-demand DDoS protection** model, traffic normally reaches the organisation's infrastructure directly.

When an attack is detected, traffic is diverted to the scrubbing centre.

This approach can offer;

lower normal operating cost,

a different routing structure

as advantages.

But detection and diversion time become critical during the attack.

### The Difference Between Always-On and On-Demand

The fundamental difference is how quickly mitigation engages.

#### Always-On

Traffic is already in the protection infrastructure.

#### On-Demand

Traffic is diverted after the attack.

When choosing, the organisation must assess factors such as;

criticality,

latency,

cost,

network architecture,

RTO.

### How Is BGP Used in DDoS Mitigation?

**Border Gateway Protocol (BGP)** is one of the fundamental protocols of the internet's routing system.

In cloud-based scrubbing services, the organisation's IP prefixes can in certain situations be advertised through the DDoS provider.

Internet traffic then goes to the scrubbing centre first.

Clean traffic is subsequently forwarded to the organisation.

This architecture can be critical in high-volume DDoS attacks.

### What Does a GRE Tunnel Do in DDoS Protection?

In some scrubbing centre architectures, the cleaned traffic is delivered to the organisation over a **GRE tunnel**.

The general flow can be:

internet

↓

scrubbing centre

↓

traffic cleaning

↓

GRE tunnel

↓

customer network

in that order.

This approach is seen particularly in on-demand cloud DDoS services.

### Why Is Anycast Powerful in DDoS Defence?

In an **anycast** architecture the same IP address can be announced from different geographic locations.

Traffic can be distributed across different edge points.

Rather than one data centre taking all the traffic during a DDoS attack, the attack can be spread across the global infrastructure.

Anycast is therefore an important architectural advantage in large CDN and anti-DDoS platforms.

But anycast does not clean malicious traffic by itself.

It provides distributed capacity and routing advantage.

### How Is DNS DDoS Protection Achieved?

DNS is a critical availability component.

The web server may be entirely healthy.

But if the user cannot resolve the domain, they cannot reach the service.

For DNS, therefore;

anycast DNS,

multiple authoritative servers,

geo-distributed infrastructure,

rate limiting,

DNS-specific DDoS protection

can be used.

An authoritative DNS structure at a single point poses an availability risk.

### Why Does Secondary DNS Matter?

Dependence on a single DNS provider creates certain risks.

Some organisations use secondary DNS or multi-provider DNS.

The aim is that when one DNS infrastructure becomes unreachable, the other continues serving.

This approach is valuable for DDoS resilience and general availability.

### Why Does Bot Management Matter in DDoS Protection?

In volumetric attacks the traffic looks abnormal more easily.

In layer 7 DDoS, bots can behave like genuine browsers.

**Bot management** is therefore important for HTTP floods and API abuse in particular.

Bot management can analyse signals such as;

client behaviour,

browser fingerprint,

TLS characteristics,

session,

JavaScript execution,

request patterns.

### The Difference Between Good Bots and Bad Bots

Not all bots are bad.

For example;

Googlebot,

monitoring systems,

partner integrations

can be legitimate.

Bad bots, by contrast, can be used for;

credential stuffing,

scraping,

DDoS,

fraud.

The purpose of bot management is therefore not to block all automated traffic but **to separate out unwanted automation**.

### How Is Rate Limiting Used in DDoS Protection?

**Rate limiting** restricts the number of operations a particular source or user can perform in a given period.

Limits such as;

one IP → 100 requests/minute

one user → 10 logins/minute

one API key → 1,000 requests/minute

can be applied.

It is particularly effective against layer 7 and API DDoS attacks.

### Why Is IP Rate Limiting Not Enough on Its Own?

A distributed attack can involve thousands of different IPs.

If each IP sends only a few requests per second, the per-IP limit may never be exceeded.

But the total traffic can still exhaust the application.

For that reason;

IP,

session,

user,

device,

API token,

behaviour

must be assessed together.

### What Is Adaptive Rate Limiting?

**Adaptive rate limiting** applies dynamic thresholds according to traffic behaviour rather than fixed limits.

The system can set thresholds from;

normal RPS,

seasonal traffic,

user behaviour.

This approach helps separate genuine campaign demand from attack traffic.

### How Do Challenge Mechanisms Work?

Additional verification can be applied to suspicious clients.

For example;

a JavaScript challenge,

CAPTCHA,

browser validation

can be used.

But this is not suitable for every traffic type.

API clients cannot complete a browser challenge, for instance.

Challenge mechanisms must therefore be applied according to service type.

### What Does an API Gateway Do in DDoS Protection?

An API gateway can provide;

authentication,

rate limiting,

quotas,

request validation,

routing.

For DDoS, the following are particularly valuable;

per-client rate limits,

API key quotas,

request size limits,

concurrency limits.

But the API gateway has its own capacity limit.

It must therefore be tested.

### Does a Load Balancer Provide DDoS Protection?

A load balancer distributes traffic across different backend systems.

This prevents a single server bearing the whole load.

But a load balancer is not an attack filtering system.

It has its own limits for;

CPS,

connections,

throughput,

TLS processing.

In a DDoS architecture the load balancer is therefore a supporting availability component.

### Is Autoscaling DDoS Protection?

Autoscaling brings new resources online under heavy traffic.

That helps the system stay available.

But if the attacker keeps generating traffic, cloud resources can keep growing.

Autoscaling is therefore:

**a resilience mechanism.**

On its own it is:

**not a security filtering mechanism.**

### Why Does EDoS Matter?

**Economic denial of sustainability (EDoS)** is the risk model in cloud services where the attacker aims to raise costs rather than bring the application down entirely.

The system autoscales under attack.

The service stays up.

But hundreds of new instances start running.

In cloud DDoS protection, therefore;

budget alerts,

maximum scaling limits,

rate limits,

WAF policies

matter too.

### Where Is NDR Used in a DDoS Protection Architecture?

**Network detection and response (NDR)** analyses network behaviour.

During a DDoS attack, data such as;

bandwidth anomalies,

PPS anomalies,

protocol distribution,

source diversity,

flow behaviour

can be assessed.

NDR is particularly valuable for understanding the attack and providing network visibility.

### What Does a SIEM Do in DDoS Defence?

Rather than blocking the attack directly, a SIEM correlates events from different security controls.

For example:

an anti-DDoS alert

a firewall CPU increase

a WAF HTTP flood alert

application 503 errors

can all be parts of the same attack.

The SIEM can bring them together under a single incident.

### What Does the SOC Do During a DDoS Attack?

The SOC's job is not merely to see the alert.

In the DDoS incident response process the SOC;

verifies the alert,

classifies the attack type,

identifies the affected services,

informs the network team,

coordinates with the anti-DDoS provider,

investigates other attack indicators in the SIEM,

checks whether the incident relates to other attacks.

DDoS is therefore not merely a network operation.

### Can a DDoS Attack Be Used as a Distraction?

Yes.

Some attacks are carried out to draw security teams' attention to an availability problem.

Another security incident may be under way at the same time.

Activity such as;

credential compromise,

data exfiltration,

unauthorised access

must be investigated separately.

During a DDoS attack the SOC must therefore not ignore its other security telemetry entirely.

### What Is a DDoS Mitigation Playbook?

The document defining in advance what will be done during a DDoS attack can be called a **DDoS mitigation playbook**.

For example:

#### \1. Detection

The attack is verified.

#### \2. Classification

Volumetric, L3/L4 or L7 is distinguished.

#### \3. Escalation

Network and application teams are informed.

#### \4. Mitigation

Scrubbing, WAF rules or rate limits are engaged.

#### \5. Monitoring

Genuine user access is checked.

#### \6. Recovery

The system is returned to normal.

#### \7. Post-Incident Review

The incident is analysed.

This process can reduce response time.

### Should DDoS Protection Be Tested?

Absolutely.

An organisation using;

an anti-DDoS subscription,

a CDN,

a WAF,

a scrubbing centre

has no guarantee the system will work during a real attack.

The routing may be wrong.

The threshold may be too high.

The origin may be exposed.

The WAF may be badly tuned.

The SOC may not be seeing the alert.

The defensive chain must therefore be verified through a controlled **DDoS attack simulation**.

### What Should Be Measured in a DDoS Protection Test?

For example;

#### Detection Time

How long did it take for the attack to be noticed?

#### Time to Mitigate

How long did filtering take to begin?

#### Attack Traffic Block Rate

What proportion of malicious traffic was blocked?

#### Legitimate Traffic Success Rate

How many genuine users continued to receive service?

#### Application Response Time

What happened to service performance under attack?

#### False Positive Rate

How many genuine users were wrongly blocked?

#### Recovery Time

How long did the system take to return to normal?

These metrics show the real effectiveness of the DDoS defence.

### How Should Anti-DDoS Capacity Be Assessed?

Looking only at the statement:

**“It provides 1 Tbps of protection.”**

is not enough.

These questions must also be asked:

#### What is the PPS capacity?

#### What is the CPS capacity?

#### Does it provide layer 7 protection?

#### Is there DNS protection?

#### Where are the scrubbing locations?

#### What is the time to mitigate?

#### Is an always-on option available?

#### Does it provide API and portal visibility?

#### Is there SOC integration?

These questions reveal the service's real scope.

### What Should Be Considered When Choosing a DDoS Protection Vendor?

Attack capacity should not be the only criterion.

The organisation can assess characteristics such as;

global network capacity,

scrubbing locations,

local peering,

latency,

L3/L4 protection,

layer 7 protection,

WAF integration,

bot management,

DNS protection,

reporting,

SLA,

SOC support.

Scrubbing and edge points close to the geography where the organisation's user base sits can matter particularly for latency.

### What Is Managed DDoS Protection?

Rather than managing DDoS systems with their own teams, some organisations use a **managed DDoS protection service**.

In this model the service provider can manage processes such as;

monitoring,

attack analysis,

mitigation,

incident support,

reporting.

It can be valuable particularly for organisations without a 24/7 network security team.

But responsibilities and escalation processes must be clearly defined in the SLA.

### What Should a DDoS SLA Look Like?

An SLA for a DDoS service should not be an uptime commitment alone.

Metrics such as;

detection time,

mitigation time,

support response time,

scrubbing availability,

attack notification

can also be defined.

**Time to mitigate SLA** is an important criterion for critical services in particular.

### What Is Multi-Layer DDoS Protection?

The strongest DDoS defence does not depend on a single layer.

For example:

#### L3/L4

Anti-DDoS / scrubbing.

#### Layer 7

WAF / bot management / rate limiting.

#### Content

CDN / cache.

#### DNS

Anycast DNS / secondary DNS.

#### Infrastructure

Firewall / load balancer.

#### Operations

SOC / SIEM / incident response.

This structure is the **defence in depth** approach.

### Why Does Defence in Depth Matter for DDoS?

One defensive layer can fail.

The attack may get past the CDN.

The WAF can catch it.

If it gets past the WAF, application rate limiting can engage.

The failure of a single control therefore does not leave the whole system defenceless.

That is the core value of layered defence in DDoS security.

### Is Zero Trust Used in DDoS Protection?

Zero Trust is not a DDoS mitigation technology as such.

But in authenticated applications;

authenticated access,

device trust,

identity-based controls

can reduce the anonymous attack surface.

Not leaving management panels and critical applications open to the general internet in particular reduces DDoS and abuse risk.

### The Relationship Between DDoS Protection and Business Continuity

The ultimate purpose of DDoS protection technologies is not technically to “block packets”.

The purpose is to sustain the business service.

Even if an e-commerce platform is under attack, its;

login,

shopping cart,

payment

services must remain available.

DDoS protection decisions must therefore be made alongside business priorities.

### How Are Critical Services Prioritised?

Not every service needs the same level of protection.

During an attack;

the marketing site,

the blog,

the reporting system

can be temporarily limited.

But;

the payment API,

customer login,

the transaction service

can be protected.

This approach can be used alongside **graceful degradation and load shedding** mechanisms.

### How Is the Success of DDoS Protection Measured?

Success is not:

**“We blocked the attack.”**

alone.

Real success is:

**“Our genuine users continued to receive service during the attack.”**

as an outcome.

One of the most critical metrics can therefore be **service availability under attack**.

Even if DDoS mitigation is technically working, the defence must be improved if user experience is degraded.

### Corporate DDoS Protection Checklist

When assessing its DDoS readiness level, an organisation can answer these questions:

- Have the critical internet services been identified?
- Are the origin IPs protected?
- Is volumetric anti-DDoS in place?
- Is there L3/L4 protection?
- Is there layer 7 WAF protection?
- Is bot management applied?
- Is API rate limiting active?
- Is DNS redundant?
- Is there access to a scrubbing centre?
- Is the always-on or on-demand model decided?
- Has SOC alert integration been done?
- Is the DDoS playbook ready?
- Is the ISP communication process defined?
- Has a DDoS resilience test been carried out?
- Has the recovery plan been verified?

Answering “no” to any of these does not necessarily mean a vulnerability.

But it does point to a risk area that needs assessing.

### Conclusion: DDoS Protection Is Not a Single Device

Because DDoS attacks target different layers, it is not possible for a single security technology to solve every scenario.

The firewall provides network security.

The WAF analyses web application traffic.

The CDN distributes load.

Anti-DDoS filters volumetric and protocol attacks.

The scrubbing centre cleans attack traffic before it reaches the organisation's link.

Bot management separates automation behaviour.

Rate limiting restricts resource consumption.

DNS protection protects the critical name resolution infrastructure.

And the SOC and SIEM bring together the signals from all these systems.

Corporate DDoS defence should therefore be thought of through this equation:

**DDoS protection = network capacity + traffic filtering + application protection + visibility + incident response + recovery**

And the most important point:

**The entire chain must be tested.**

Because the organisation may have a 1 Tbps anti-DDoS service.

But if the origin IP is exposed, the attacker can go straight to the system.

The WAF may be strong.

But if DNS sits at a single point, the user cannot reach the service.

The firewall may be strong.

But if the upstream link is 1 Gbps, a volumetric attack can saturate it.

DDoS security must therefore be assessed not product by product but through **end-to-end architecture and business continuity**.

But today many organisations are moving from classic data centre architectures to cloud environments.

Azure, AWS, Google Cloud and SaaS-based structures are becoming widespread.

That raises the question:

#### Does moving to the cloud solve the DDoS problem?

The answer is not always yes.

Cloud infrastructure provides high scalability, but it can create new risk areas such as;

APIs,

public IPs,

load balancers,

autoscaling,

cloud cost.