Let's discuss the next components, load balancers and routers. The things to consider while configuring load balancers against DDoS attacks would be try to finish SSL at load balancer. This will save some resources from your server, which will prevent server from being overloaded by the incoming TLS requests. If you still need the encryption, though, in other words, if you need to encrypt the traffic between your load balancer and your server, in that case, you can encrypt the traffic between the load balancer and the server with another certificate. It depends on your organization's requirements. You don't have to usually encrypt this traffic since this is an internal traffic.

But if the encryption in that stage, internally is also a requirement, I highly encourage you to first terminate SSL connection between your client and the server at your low balancer. And then create a new encrypted connection between server and the load balancer. And if you're using more than one load balancers, plus you're applying rate controls. At the load balancers. Make sure that the rate control rules that you set are synced across the load balancers. Otherwise, the attackers may exploit it.

For example, if an attacker knows that, you know you're using more than one load balancers, he can then circumvent the rate controls you applied by dividing his attack into multiple load balancers instead of attacking at once. In that case, for example, your rate controls will not trigger just because your load balancers are not synced. When it comes to the routers, make sure you use ACLs for blocking the illegal traffic. The ones we discussed in the previous section. Like the illegal flat combinations of TCP, for instance. And for some of the routers, you can actually use rate controls at router stage as well.

In fact, many modern routers support this functionality. So you can consider applying rate controls at the routers as well. I'm going to also leave you a link from Cisco's website, which gives quite a good guideline on supporting your infrastructure and protecting against DDoS at the router level.