{"id":415,"date":"2026-09-01T17:04:06","date_gmt":"2026-09-01T17:04:06","guid":{"rendered":"https:\/\/www.vps.tc\/blog\/?p=415"},"modified":"2026-09-01T09:30:37","modified_gmt":"2026-09-01T09:30:37","slug":"ddos-saldirisi-nedir-vps-koruma-rehberi","status":"publish","type":"post","link":"https:\/\/www.vps.tc\/blog\/tr\/ddos-saldirisi-nedir-vps-koruma-rehberi\/","title":{"rendered":"DDoS Sald\u0131r\u0131s\u0131 Nedir? VPS Koruma Rehberi"},"content":{"rendered":"
\u0130\u00e7indekiler<\/strong><\/p>\n
    \n
  1. DDoS sald\u0131r\u0131s\u0131 nedir ve VPS'inizi nas\u0131l etkiler?<\/a><\/li>\n
  2. Sald\u0131r\u0131 t\u00fcr\u00fcn\u00fc ay\u0131rmadan do\u011fru \u00f6nlem se\u00e7ilmiyor<\/a><\/li>\n
  3. \u0130lk be\u015f dakika: yeniden ba\u015flatmadan kan\u0131t toplay\u0131n<\/a><\/li>\n
  4. VPS \u00fczerinde uygulanabilecek savunmalar<\/a><\/li>\n
  5. Sa\u011flay\u0131c\u0131 ve CDN katman\u0131 neden gerekli?<\/a><\/li>\n
  6. \u0130zleme, loglama ve sald\u0131r\u0131 sonras\u0131 temizlik<\/a><\/li>\n
  7. Ne zaman VPS'i b\u00fcy\u00fctmek, ne zaman mimariyi de\u011fi\u015ftirmek gerekir?<\/a><\/li>\n
  8. Yap\u0131lmamas\u0131 gereken k\u0131sa yollar<\/a><\/li>\n
  9. VPS i\u00e7in pratik DDoS kontrol listesi<\/a><\/li>\n
  10. S\u0131k Sorulan Sorular<\/a><\/li>\n<\/ol>\n<\/div>\n

    DDoS sald\u0131r\u0131s\u0131 nedir ve VPS’inizi nas\u0131l etkiler?<\/h2>\n

    Gece vardiyas\u0131nda monitoring ekran\u0131nda ayn\u0131 anda \u00fc\u00e7 alarm g\u00f6rd\u00fc\u011f\u00fcmde elim do\u011frudan reboot<\/code> komutuna gitmiyor. \u00d6nce trafi\u011fin nereden geldi\u011fine, hangi portun doldu\u011funa ve makinenin ger\u00e7ekten ne kadar kaynak t\u00fcketti\u011fine bak\u0131yorum. DDoS olaylar\u0131nda aceleyle at\u0131lan bir yeniden ba\u015flatma komutu sald\u0131r\u0131y\u0131 durdurmayabilir; yaln\u0131zca elimizdeki kan\u0131tlar\u0131 ve aktif ba\u011flant\u0131 tablosunu silebilir.<\/p>\n

    DDoS, yani Da\u011f\u0131t\u0131k Hizmet Engelleme sald\u0131r\u0131s\u0131, bir sunucuya veya servise \u00e7ok say\u0131da kaynaktan yo\u011fun istek g\u00f6ndererek ger\u00e7ek kullan\u0131c\u0131lar\u0131n eri\u015fimini engellemeyi ama\u00e7lar. Hedef yaln\u0131zca web sitesi de\u011fildir. DNS, oyun sunucusu, SSH, API ve do\u011frudan VPS’in IP adresi de sald\u0131r\u0131ya a\u00e7\u0131k olabilir.<\/p>\n

    Buradaki “da\u011f\u0131t\u0131k” kelimesi \u00f6nemli. Trafik tek bir bilgisayardan gelmedi\u011fi i\u00e7in tek bir IP’yi engellemek \u00e7o\u011fu zaman yeterli olmaz. Sald\u0131rganlar botnet ad\u0131 verilen, ele ge\u00e7irilmi\u015f cihazlardan olu\u015fan a\u011flar\u0131 kullanabilir. Baz\u0131 sald\u0131r\u0131lar bant geni\u015fli\u011fini doldurur, baz\u0131lar\u0131 ba\u011flant\u0131 tablolar\u0131n\u0131 t\u00fcketir. HTTP iste\u011fine benzeyen sald\u0131r\u0131lar ise trafik miktar\u0131 \u00e7ok y\u00fcksek g\u00f6r\u00fcnmeden CPU ve veritaban\u0131 kaynaklar\u0131n\u0131 bitirebilir.<\/p>\n

    VPS taraf\u0131ndaki savunmay\u0131 iki ayr\u0131 katmanda d\u00fc\u015f\u00fcn\u00fcr\u00fcm: sunucunun i\u00e7indeki kaynak t\u00fcketimini azaltmak ve zararl\u0131 trafi\u011fi veri merkezi ya da upstream sa\u011flay\u0131c\u0131 seviyesinde filtrelemek. \u0130lk katmanda kendi yap\u0131land\u0131rmalar\u0131n\u0131z i\u015fe yarar. \u0130kinci katman i\u00e7in hosting sa\u011flay\u0131c\u0131n\u0131z\u0131n DDoS korumas\u0131na, scrubbing merkezlerine veya CDN hizmetlerine ihtiya\u00e7 duyabilirsiniz.<\/p>\n

    Sald\u0131r\u0131 t\u00fcr\u00fcn\u00fc ay\u0131rmadan do\u011fru \u00f6nlem se\u00e7ilmiyor<\/h2>\n

    Her yo\u011fun trafik DDoS de\u011fildir. Yeni yay\u0131nlanan bir kampanya, arama motoru taramas\u0131, hatal\u0131 \u00e7al\u0131\u015fan bir cron g\u00f6revi veya bir m\u00fc\u015fterinin payla\u015ft\u0131\u011f\u0131 ba\u011flant\u0131 da k\u0131sa s\u00fcreli trafik art\u0131\u015f\u0131 olu\u015fturabilir. Kaynaklara bakmadan “sald\u0131r\u0131 var” demek kadar, ger\u00e7ek sald\u0131r\u0131y\u0131 normal trafik sanmak da pahal\u0131ya patlar.<\/p>\n

    Volumetrik sald\u0131r\u0131lar<\/h3>\n

    Bu sald\u0131r\u0131larda ama\u00e7 internet ba\u011flant\u0131n\u0131z\u0131n kapasitesini doldurmakt\u0131r. UDP flood, ICMP flood ve b\u00fcy\u00fck hacimli DNS yan\u0131t trafi\u011fi bu s\u0131n\u0131fa girer. VPS’inizde nftables<\/code> kural\u0131 yazsan\u0131z bile paketler \u00e7o\u011fu zaman \u00f6nce veri merkezinin uplink’ine ula\u015f\u0131r. Hat dolduktan sonra paketi sunucuda reddetmeniz ger\u00e7ek kullan\u0131c\u0131ya bant geni\u015fli\u011fi kazand\u0131rmaz.<\/p>\n

    Volumetrik sald\u0131r\u0131larda \u00e7\u00f6z\u00fcm genellikle sa\u011flay\u0131c\u0131 taraf\u0131nda ba\u015flar. Trafik VPS’e ula\u015fmadan filtrelenmeli veya temizleme merkezine y\u00f6nlendirilmelidir. K\u00fc\u00e7\u00fck ve k\u0131sa s\u00fcreli bir ta\u015fmada yerel firewall yard\u0131mc\u0131 olabilir; bunu ba\u011flant\u0131 kapasitesini art\u0131ran bir \u00e7\u00f6z\u00fcm gibi g\u00f6rmemek gerekir.<\/p>\n

    Protokol ve ba\u011flant\u0131 t\u00fcketen sald\u0131r\u0131lar<\/h3>\n

    SYN flood, TCP ba\u011flant\u0131 kurulumu a\u015famas\u0131ndaki kaynaklar\u0131 t\u00fcketmeye \u00e7al\u0131\u015f\u0131r. \u00c7ok say\u0131da yar\u0131m a\u00e7\u0131k ba\u011flant\u0131 olu\u015ftu\u011funda backlog ve conntrack tablolar\u0131 bask\u0131 alt\u0131na girebilir. Normal kullan\u0131c\u0131lar da ba\u011flant\u0131 kurmakta zorlan\u0131r.<\/p>\n

    Bu s\u0131n\u0131fta SYN cookie gibi kernel ayarlar\u0131, ba\u011flant\u0131 limitleri ve sa\u011flay\u0131c\u0131 filtreleri i\u015fe yarayabilir. Rastgele sysctl<\/code> de\u011ferlerini b\u00fcy\u00fctmek ise \u00e7\u00f6z\u00fcm de\u011fildir. Daha b\u00fcy\u00fck tablolar sald\u0131rgan\u0131n doldurabilece\u011fi daha b\u00fcy\u00fck bir alan yaratabilir; RAM t\u00fcketimi de artar.<\/p>\n

    Uygulama katman\u0131 sald\u0131r\u0131lar\u0131<\/h3>\n

    HTTP flood, yava\u015f istekler ve pahal\u0131 API \u00e7a\u011fr\u0131lar\u0131 d\u0131\u015far\u0131dan bak\u0131ld\u0131\u011f\u0131nda normal web trafi\u011fine benzeyebilir. \u0130stekler 443 numaral\u0131 porta gelir, TLS ba\u015far\u0131yla tamamlan\u0131r ve nginx ya da Apache bunlar\u0131 uygulamaya ta\u015f\u0131r. Trafik miktar\u0131 devasa g\u00f6r\u00fcnmese bile her istek bir PHP worker’\u0131, MySQL sorgusu veya harici API \u00e7a\u011fr\u0131s\u0131 ba\u015flat\u0131yorsa VPS k\u0131sa s\u00fcrede nefessiz kal\u0131r.<\/p>\n

    Burada CDN, web sunucusu rate limit’leri, \u00f6nbellek, kimlik do\u011frulama ve uygulama i\u00e7i kota mekanizmalar\u0131 birlikte ele al\u0131nmal\u0131d\u0131r. Yaln\u0131zca IP engellemek genellikle yetersiz kal\u0131r; botnet’in binlerce adresi olabilir.<\/p>\n

    \u0130lk be\u015f dakika: yeniden ba\u015flatmadan kan\u0131t toplay\u0131n<\/h2>\n

    Sald\u0131r\u0131 s\u0131ras\u0131nda ilk hedefim te\u015fhis s\u00fcresini k\u0131sa tutmak. \u00d6nce sa\u011flay\u0131c\u0131n\u0131n panelinde trafik grafi\u011fine, kaynak kullan\u0131m\u0131na ve varsa DDoS alarm\u0131na bakar\u0131m. Ard\u0131ndan SSH ile ba\u011flan\u0131p genel tabloyu \u00e7\u0131kar\u0131r\u0131m. SSH eri\u015fimi de etkileniyorsa sa\u011flay\u0131c\u0131n\u0131n konsolu daha g\u00fcvenli bir yol olabilir.<\/p>\n

    date\nhostname\nuptime\nfree -h\nip -s link\nss -s<\/code><\/pre>\n
    Buradaki hostname<\/code> sat\u0131r\u0131n\u0131 atlamay\u0131n. Production prompt’lar\u0131m\u0131 k\u0131rm\u0131z\u0131 kullanmam\u0131n nedeni de bu t\u00fcr kontrolleri g\u00f6r\u00fcn\u00fcr k\u0131lmak. ip -s link<\/code> aray\u00fcz seviyesindeki paket ve hata saya\u00e7lar\u0131n\u0131, ss -s<\/code> ise TCP durumlar\u0131n\u0131n kaba da\u011f\u0131l\u0131m\u0131n\u0131 g\u00f6sterir. Tek ba\u015f\u0131na hi\u00e7biri sald\u0131r\u0131n\u0131n kesin kan\u0131t\u0131 de\u011fildir.<\/p>\n
    Belirli bir portu incelemek i\u00e7in:<\/p>\n
    ss -Htan state syn-recv | wc -l\nss -Htan '( sport = :80 or sport = :443 )' | head -20\nss -Huan | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head<\/code><\/pre>\n
    \u0130lk komut yar\u0131m a\u00e7\u0131k TCP ba\u011flant\u0131 say\u0131s\u0131n\u0131 verir. \u0130kinci komut HTTP ve HTTPS ba\u011flant\u0131lar\u0131ndan \u00f6rnek g\u00f6sterir. \u00dc\u00e7\u00fcnc\u00fc komut UDP u\u00e7lar\u0131n\u0131 kabaca sayar; IPv6 adresleri veya farkl\u0131 \u00e7\u0131kt\u0131 bi\u00e7imleri i\u00e7in bu k\u0131sa awk<\/code> zincirine k\u00f6r\u00fc k\u00f6r\u00fcne g\u00fcvenmeyin. Ben olay s\u0131ras\u0131nda \u00e7\u0131kt\u0131y\u0131 dosyaya da al\u0131r\u0131m:<\/p>\n
    ss -s > \/root\/incident-ss-$(date +%F-%H%M).txt\njournalctl -k --since \"10 minutes ago\" > \/root\/incident-kernel.log<\/code><\/pre>\n
    Kernel log’unda drop, SYN flood, conntrack veya network driver uyar\u0131lar\u0131 g\u00f6r\u00fclebilir. Log yoksa sald\u0131r\u0131 yok demek de\u011fildir; baz\u0131 saya\u00e7lar log \u00fcretmeden y\u00fckselir.<\/p>\n
    VPS \u00fczerinde uygulanabilecek savunmalar<\/h2>\n
    Gereksiz portlar\u0131 kapat\u0131n<\/h3>\n
    D\u0131\u015far\u0131ya a\u00e7\u0131k her servis sald\u0131r\u0131 y\u00fczeyinin bir par\u00e7as\u0131d\u0131r. \u00d6nce dinleyen servisleri g\u00f6r\u00fcn:<\/p>\n
    sudo ss -lntup<\/code><\/pre>\n
    Burada \u00f6zellikle 0.0.0.0<\/code> veya ::<\/code> \u00fczerinde dinleyen servisleri incelerim. PostgreSQL, Redis ve MySQL gibi servislerin internete a\u00e7\u0131k olmas\u0131 \u00e7o\u011fu kurulumda gereksizdir. MySQL kurulumu ve g\u00fcvenli yap\u0131land\u0131rma s\u0131ras\u0131nda bind adresini ve firewall eri\u015fimini birlikte kontrol etmek gerekir; yaln\u0131zca g\u00fc\u00e7l\u00fc parola yazmak yeterli g\u00fcvenlik sa\u011flamaz.<\/p>\n
    Firewall taraf\u0131nda yaln\u0131zca ger\u00e7ekten kulland\u0131\u011f\u0131n\u0131z portlara izin verin. SSH, HTTP ve HTTPS kullanan basit bir nftables<\/code> ba\u015flang\u0131c\u0131 \u015f\u00f6yle olabilir:<\/p>\n
    table inet filter {\n  chain input {\n    type filter hook input priority filter; policy drop;\n\n    iifname \"lo\" accept\n    ct state established,related accept\n    ip protocol icmp accept\n    ip6 nexthdr ipv6-icmp accept\n    tcp dport 22 ct state new limit rate 15\/minute accept\n    tcp dport { 80, 443 } accept\n  }\n\n  chain forward { type filter hook forward priority filter; policy drop; }\n  chain output { type filter hook output priority filter; policy accept; }\n}<\/code><\/pre>\n
    Bu \u00f6rnek da\u011f\u0131t\u0131ma, uzaktan eri\u015fim politikan\u0131za ve IPv6 kullan\u0131m\u0131n\u0131za g\u00f6re de\u011fi\u015ftirilmelidir. SSH i\u00e7in sabit y\u00f6netim IP’niz varsa kural\u0131 onunla s\u0131n\u0131rland\u0131rmak daha iyi olur. Uzaktan firewall de\u011fi\u015fikli\u011fi yaparken ikinci bir oturum a\u00e7ar\u0131m. \u00d6\u011frendim ki a\u00e7\u0131k kalan tek SSH oturumu, yanl\u0131\u015f kural\u0131n bedelini \u00e7ok h\u0131zl\u0131 hat\u0131rlat\u0131yor.<\/p>\n
    SSH’yi sald\u0131r\u0131n\u0131n merkezinden \u00e7\u0131kar\u0131n<\/h3>\n
    SSH portunu 22’den ba\u015fka bir porta almak g\u00fcvenlik de\u011fildir. Otomatik taramalar\u0131n bir k\u0131sm\u0131n\u0131 azaltabilir; as\u0131l kontroller anahtar tabanl\u0131 kimlik do\u011frulama, root giri\u015finin kapat\u0131lmas\u0131, g\u00fcncel OpenSSH ve firewall k\u0131s\u0131tlamas\u0131d\u0131r.<\/p>\n
    sudoedit \/etc\/ssh\/sshd_config<\/code><\/pre>\n
    PermitRootLogin no\nPasswordAuthentication no\nMaxAuthTries 3<\/code><\/pre>\n
    Yap\u0131land\u0131rmay\u0131 yeniden y\u00fcklemeden \u00f6nce kontrol edin:<\/p>\n
    sudo sshd -t && sudo systemctl reload ssh<\/code><\/pre>\n
    Ubuntu ve Debian sistemlerinde servis ad\u0131 \u00e7o\u011funlukla ssh<\/code> olur; baz\u0131 da\u011f\u0131t\u0131mlarda sshd<\/code> kullan\u0131l\u0131r. Mevcut oturumu kapatmadan yeni anahtarla giri\u015f testini yap\u0131n. Ben bir firewall de\u011fi\u015fikli\u011finden sonra ikinci terminali a\u00e7may\u0131 unuttu\u011fum i\u00e7in, mevcut SSH oturumunu bak\u0131m bitene kadar dikkatle a\u00e7\u0131k tutmak zorunda kalm\u0131\u015ft\u0131m. K\u00fc\u00e7\u00fck bir ihmal.<\/p>\n
    Web sunucusunda rate limit kullan\u0131n<\/h3>\n
    HTTP katman\u0131nda nginx’in limit_req<\/code> ve limit_conn<\/code> mod\u00fclleri belirli endpoint’leri koruyabilir. Giri\u015f, arama ve pahal\u0131 rapor API’lar\u0131 i\u00e7in genel sayfalardan farkl\u0131 limitler tan\u0131mlamak daha mant\u0131kl\u0131d\u0131r.<\/p>\n
    http {\n    limit_req_zone $binary_remote_addr zone=login_limit:10m rate=5r\/m;\n    limit_conn_zone $binary_remote_addr zone=addr:10m;\n\n    server {\n        limit_conn addr 30;\n\n        location = \/wp-login.php {\n            limit_req zone=login_limit burst=3 nodelay;\n            include fastcgi_params;\n            # Uygulaman\u0131z\u0131n mevcut PHP-FPM ayarlar\u0131 burada kal\u0131r.\n        }\n    }\n}<\/code><\/pre>\n
    Bu kural her kurulumda kopyalan\u0131p uygulanacak bir WordPress re\u00e7etesi de\u011fildir. NAT arkas\u0131ndaki \u00e7ok say\u0131da ger\u00e7ek kullan\u0131c\u0131 ayn\u0131 public IP’yi payla\u015fabilir; IP ba\u015f\u0131na limit bu kullan\u0131c\u0131lar\u0131 da etkileyebilir. API anahtar\u0131, oturum veya kullan\u0131c\u0131 hesab\u0131 baz\u0131nda kota uygulamak, uygulama katman\u0131nda daha do\u011fru sonu\u00e7 verebilir.<\/p>\n
    Yap\u0131land\u0131rma sonras\u0131:<\/p>\n
    sudo nginx -t\nsudo systemctl reload nginx<\/code><\/pre>\n
    nginx -t<\/code> ba\u015far\u0131l\u0131 olmadan reload yapmay\u0131n. Rate limit yaz\u0131p cache kurmamak da s\u0131k g\u00f6rd\u00fc\u011f\u00fcm bir hata. Her iste\u011fi PHP’ye ve veritaban\u0131na g\u00f6ndermek yerine anonim, cache’lenebilir i\u00e7erikleri edge veya nginx seviyesinde kar\u015f\u0131lamak sunucu y\u00fck\u00fcn\u00fc ciddi bi\u00e7imde azaltabilir.<\/p>\n
    Sa\u011flay\u0131c\u0131 ve CDN katman\u0131 neden gerekli?<\/h2>\n
    VPS’iniz saniyede y\u00fczlerce megabit trafik al\u0131yorsa sunucudaki firewall kurallar\u0131 paketi i\u015fleyebilir. Fakat VPS’e ayr\u0131lm\u0131\u015f ba\u011flant\u0131 kapasitesi sald\u0131r\u0131 y\u00fcz\u00fcnden dolmu\u015fsa ger\u00e7ek kullan\u0131c\u0131 trafi\u011fi i\u00e7eri giremez. Bu noktada yerel kural\u0131n etkisi s\u0131n\u0131rl\u0131d\u0131r; filtreleme trafi\u011fin kayna\u011f\u0131na daha yak\u0131n yap\u0131lmal\u0131d\u0131r.<\/p>\n
    Hosting sa\u011flay\u0131c\u0131n\u0131za bildirirken “site yava\u015f” demek yerine \u00f6l\u00e7\u00fclebilir bilgiler g\u00f6nderin:<\/p>\n