Skip to content
SecBeat

Quick Start

Quick Commands

Section titled “Quick Commands”

Development

Section titled “Development”
Terminal window
# Start all services
docker-compose up -d


# View logs
docker-compose logs -f mitigation-node


# Test the proxy
curl -k https://localhost:8443/


# Check metrics
curl http://localhost:9191/metrics


# Stop all services
docker-compose down

Production Build

Section titled “Production Build”
Terminal window
# Build release binaries
cargo build --release --workspace


# Run tests
cargo test --workspace


# Install
sudo cp target/release/mitigation-node /usr/local/bin/
sudo setcap cap_net_raw,cap_net_admin+ep /usr/local/bin/mitigation-node

Monitoring Endpoints

Section titled “Monitoring Endpoints”
ServiceEndpointDescription
Mitigation Nodehttp://localhost:9090/metricsPrometheus metrics
Mitigation Nodehttp://localhost:9191/metricsInternal metrics
Mitigation Nodehttp://localhost:9999/Management API
Orchestratorhttp://localhost:3030/Control API
Orchestratorhttp://localhost:9091/metricsOrchestrator metrics
Prometheushttp://localhost:9092/Metrics dashboard
NATShttp://localhost:8222/NATS monitoring

Configuration Files

Section titled “Configuration Files”
FilePurposeEnvironment
config.dev.tomlDevelopmentLocal testing
config.prod.tomlProductionLive deployment
config.l7.tomlL7 mode with WAFFull features
config.tcp.tomlTCP proxy modeMinimal overhead
config.docker.tomlDocker deploymentContainer environments

Operation Modes

Section titled “Operation Modes”

TCP Mode

Section titled “TCP Mode”
  • Basic proxy with minimal overhead
  • High performance
  • No root privileges required

SYN Mode (Beta)

Section titled “SYN Mode (Beta)”
  • SYN flood protection prototype
  • Requires root or CAP_NET_RAW capability
  • Experimental - use TCP mode for production

L7 Mode

Section titled “L7 Mode”
  • Full WAF + DDoS protection
  • TLS termination
  • Complete security features

Select Mode in Config

Section titled “Select Mode in Config”
[platform]
mode = "l7"  # tcp, syn, l7, or auto

Security Checklist

Section titled “Security Checklist”

Before deploying to production, ensure you:

  • ✓ Change SYN_COOKIE_SECRET in production
  • ✓ Replace default API keys
  • ✓ Use valid TLS certificates
  • ✓ Configure firewall rules
  • ✓ Enable rate limiting
  • ✓ Set up monitoring alerts
  • ✓ Rotate secrets regularly
  • ✓ Review blocklist/allowlist IPs

Performance Tuning

Section titled “Performance Tuning”

High Traffic (100K+ connections)

Section titled “High Traffic (100K+ connections)”
[network]
max_connections = 100000
buffer_size = 65536


[ddos.rate_limiting]
global_requests_per_second = 100000

Low Latency

Section titled “Low Latency”
[network]
buffer_size = 16384
connection_timeout_seconds = 10

Memory Constrained

Section titled “Memory Constrained”
[network]
max_connections = 10000
buffer_size = 8192

Troubleshooting

Section titled “Troubleshooting”

Service won’t start

Section titled “Service won’t start”
Terminal window
# Check logs
docker-compose logs mitigation-node


# Verify ports aren't in use
sudo lsof -i :8443

High CPU usage

Section titled “High CPU usage”
Terminal window
# Check metrics
curl http://localhost:9191/metrics | grep cpu


# Reduce connection limits
# Edit config: max_connections = 5000

TLS errors

Section titled “TLS errors”
Terminal window
# Verify certificates
openssl x509 -in certs/cert.pem -text -noout


# Regenerate if needed
make setup-certs

Permission denied (SYN mode)

Section titled “Permission denied (SYN mode)”
Terminal window
# Set capabilities
sudo setcap cap_net_raw,cap_net_admin+ep /usr/local/bin/mitigation-node


# Or run with sudo
sudo ./target/release/mitigation-node

Next Steps

Section titled “Next Steps”