It works partially. Your server still sends a reply though – which is not the expected outcome when you want to deter a DDoS attack.
Others here are correct: you should enforce that with a really well-made router/switch configuration. Or offload the responsibility to the likes of Cloudflare.
You should offload this, as others said.
NGINX has a http status code for that, and your rule / CSP / Elixir response can reply that code.
https://httpstatuses.com/444
Though all the work that has to be done in the application to decide if a request should be “dropped” that way already costs.
Also the connection has already been accepted at this point in time.
A much more effective way against (D)DoS attacks is to just drop their packets as early in the network as possible.
If the package gets to your server and an ack/syn is sent, you already lost the battle
wrt ‘A much more effective way against (D)DoS attacks is to just drop their packets as early in the network as possible.’ - this is the actual use case we are trying to do. The first D in DDoS is distributed and the ‘as early in the network’ is the many billions of end devices or the billions of edge routers. Assuming the trends of the last 25 years continue, this will only get worse. OpenC2 is the standard to do the command & control you mention. The standard does, at the moment, call for this capability and I’d like to meet it if possible. Note I’m trying to build a proof of concet for the server to send the billions of messages wo hanging it waiting for replies (and more importantly not dealing with the few percent that either won’t reply or will reply with errors - if I block 90% that would be great). But if it works with replies, maybe I should lobby to change the OpenC2 standard instead.
It sounds like you are trying to build the Firewall layer everyone is talking about. Sounds like a cool project. Most likely you’re going to have to drop down to the Ranch layer, maybe lower.
I’d check out writing a custom Ranch Protocol, Nine Nines: Protocols
Specifically, you could probably return an :ignore from your init callback to just drop the connection.