Gatekeeper: Open Source DDoS Protection System

Gatekeeper stands as the pioneering open-source solution for Distributed Denial of Service (DDoS) protection, developed to handle the unpredictable bandwidth peaks associated with contemporary and future attack scenarios. This robust system is capable of scaling across geographically distributed architectures, providing a centralized network policy framework that enables efficient management against multiple, multi-vector DDoS threats.

Key Features of Gatekeeper:

• Scalability: Designed to handle any peak bandwidth, making it resilient against evolving DDoS attack strategies.
• Centralized Policy Management: Allows network operators to leverage distributed algorithms without high latency drawbacks, enabling quicker response times to threats.
• Multi-vector Attack Handling: Proficient in addressing simultaneous multifaceted DDoS attacks through a unified defensive strategy.

Intended Users: Gatekeeper is aimed at network operators within institutions, service and content providers, and enterprise networks. It is specifically designed for larger network infrastructures rather than individual Internet users.

Learn More: Detailed information about Gatekeeper can be found on the Gatekeeper Wiki.

Technical Prerequisites and Configuration

Hugepages Configuration: Gatekeeper relies on DPDK (Data Plane Development Kit), which necessitates the use of hugepages. Comprehensive guidance on configuring hugepages can be found in the DPDK System Requirements.

Kernel Module and BIOS Configuration: The Linux vfio-pci kernel module must be enabled for NIC binding with DPDK/Gatekeeper. Ensure that VT-d is enabled in the BIOS and verify kernel support for IOMMU (Input-Output Memory Management Unit) with commands provided in the README.

Package Availability and Configuration: Gatekeeper can be installed via Debian packages available on the Releases page. Post-installation, configuration is required within /etc/gatekeeper, including adjustments to the net.lua file and setting network interface variables.

Source Building Option: Alternatively, Gatekeeper can be built from source. Dependencies must be installed, and the repository cloned recursively to include necessary submodules. A comprehensive setup script is provided to compile dependencies such as DPDK, LuaJIT, and BIRD.

Running Gatekeeper: Once configured, Gatekeeper operations are managed via systemctl or command line methods, ensuring it operates efficiently and persistently across system reboots.

Gatekeeper is a strategic tool for network operators seeking an open-source, scalable, and centralized solution to DDoS protection challenges, equipping them with the capability to maintain service integrity and performance in the face of adversaries.