Skip to content
PURPLEDUEL

DDoS and Firewall

DDoS is one of the six attack types of the card duel, and Firewall is the defence that counters it. Here you will find what they stand for in real security, how they face each other in the game and all 19 of their cards.

The attack: DDoS

A DDoS (Distributed Denial of Service) attack does not want to steal anything: it wants to make a service unreachable, flooding it with requests or traffic from thousands of devices at once, often infected computers, cameras and routers gathered in a botnet. The result is a site or app that no longer answers real customers, sometimes used as a smokescreen for another attack.

The defence: Firewall

A firewall decides which traffic may enter and leave a network or a computer, following rules: ports open only for the services that are needed, administrative access only from trusted networks. Against DDoS it works together with upstream filters, request rate limits and content delivery networks (CDNs) able to absorb huge traffic peaks before they reach the server.

What stops what

  • Firewall against DDoS: half damage. Filters, request limits and absorbing networks stop the excess traffic before it reaches the server.
  • DDoS against EDR: double damage. A wave of traffic runs no program on the computers: for EDR there is nothing to block.
  • DDoS against IDS: double damage. The IDS sees the attack and raises the alarm, but detecting it is not enough: the connection stays clogged anyway.
  • Phishing against Firewall: double damage. The email arrives through normal, allowed channels, and it is a person who lets the attacker in from the inside: port rules see nothing strange.
  • Malware against Firewall: double damage. The malware is already inside the network and talks over allowed ports, blended into normal web traffic.

In every other match-up damage is normal.

Combos with DDoS

  • Storm (DDoS → DDoS, +2 damage): waves of traffic one after another add up their effects.
  • Diversion (DDoS → Exploit, +2 damage): while defenders are busy with the DDoS, an exploit slips through unnoticed.

DDoS attack cards (8)

SYN flood

#014 · Attack · DDoS · ◆2 · power 3 · Common · Arena 1 (Laboratory)

Floods the server with half-open connections to exhaust its resources.

Ping flood

#021 · Attack · DDoS · ◆1 · power 2 · Common · Arena 1 (Laboratory)

A burst of pings to saturate the connection. The simplest DDoS there is.

Slowloris

#040 · Attack · DDoS · ◆1 · power 1 · Common · Arena 3 (Data center)

The opponent has 1 less bandwidth for 1 turn.

#178 · Attack · DDoS · ◆2 · power 2 · Common · Arena 3 (Data center)

The data center’s connection is filled until it stutters. Limited by several providers and anti-DDoS filtering. For 1 turn the opponent draws one card less.

DNS amplification

#041 · Attack · DDoS · ◆4 · power 6 · Rare · Arena 5 (Cloud)

Lots of damage for its cost.

Multi-vector DDoS

#098 · Attack · DDoS · ◆4 · power 4 · Rare · Arena 5 (Cloud)

Hits the network, protocols and application at once: the defense can’t tell where the blow comes from. The weakest enemy defense loses 3 toughness and every enemy defense takes 1 damage.

Botnet

#015 · Attack · DDoS · ◆6 · power 10 · Epic · Arena 6 (Dark web)

Thousands of infected devices attacking together. The most powerful DDoS.

Mirai

#042 · Attack · DDoS · ◆7 · power 13 · Legendary · Arena 6 (Dark web)

The strongest attack in the game.

Firewall defence cards (11)

Perimeter firewall

#053 · Defense · Firewall · ◆2 · toughness 4 · Common · Arena 1 (Laboratory)

Filters traffic entering and leaving the network.

Firewall rule

#056 · Defense · Firewall · ◆1 · toughness 2 · Common · Arena 1 (Laboratory)

A rule that closes a useless port. Small, but cheap.

Segmented VLAN

#173 · Defense · Firewall · ◆2 · toughness 3 · Common · Arena 2 (Corporate network)

The network split into separate segments: getting into one doesn’t show you the others, and a fault or an intruder stays contained. Regenerate: +1 toughness at turn start.

Web application firewall

#061 · Defense · Firewall · ◆3 · toughness 5 · Rare · Arena 3 (Data center)

Taunt: must be hit first.

Anti-DDoS CDN

#054 · Defense · Firewall · ◆4 · toughness 7 · Rare · Arena 5 (Cloud)

A distributed network that absorbs malicious traffic spikes.

Microsegmentation

#065 · Defense · Firewall · ◆5 · toughness 6 · Epic · Arena 5 (Cloud)

Shield: −1 to every hit on your core.

CDN accelerator

#103 · Defense · Firewall · ◆3 · toughness 4 · Rare · Arena 5 (Cloud)

A CDN brings content closer to users and takes load off the servers, freeing up capacity. Bandwidth: +1 bandwidth at turn start.

Reactive shield

#107 · Defense · Firewall · ◆4 · toughness 6 · Rare · Arena 5 (Cloud)

A firewall that adapts its rules in real time to suspicious traffic. Taunt: must be hit first. Armor: −1 to every hit taken.

Security group

#196 · Defense · Firewall · ◆2 · toughness 3 · Common · Arena 5 (Cloud)

The virtual firewall of every cloud instance: open only to the ports that are needed. Shield: −1 to every hit on your core.

Landing zone

#203 · Defense · Firewall · ◆6 · toughness 9 · Legendary · Arena 5 (Cloud)

The starting area of every cloud account, with rules and protections already in place. Taunt: must be hit first. Shield: −1 to every hit on your core. Regenerate: +1 toughness at turn start.

Data diode

#219 · Defense · Firewall · ◆5 · toughness 6 · Epic · Arena 7 (Cyber range)

A one-way physical link: data goes out, but nothing can come back in. Used in industrial and classified networks. Taunt: must be hit first. Armor: −1 to every hit taken.

Related guides

To learn the technical side there are the simulated labs:

The other card groups

All cards and the type chart