I feel like there's a bunch of other things in play, like for example if you're running a public API, one api key should not be able to take you down - you shou

I feel like there's a bunch of other things in play, like for example if you're running a public API, one api key should not be able to take you down - you should be rate limiting them against repeated hits, for instance. I'm not saying iptables is bad per se, but this article in particular is just some overpriced hosting provider's blog that tells you to set things like kernel.panic in sysctl. The article also claims all of this to be a defense against DDoS, which really will probably just eat through your pipe completely most of the time, not single-person DoS.