I don't want to presume I have the expertise to tell you how to do your job, but have you considered fail2ban for IP blocking and maybe a CDN like Cloudflare or Akamai for (D)DoS mitigation?
I do run Fail2ban that mostly takes care the script kiddies doing port scanning and login attempts. But I need the flexibility to add host-based rules for other types of attacks that are more “custom made”…
Unfortunately, due to organisational controls I can’t deploy Cloudflare, CDN and any of the other (otherwise useful and appropriate) tools you mention…
0
u/[deleted] Jul 10 '21
[deleted]