This paper provides the contribution of mitigating a Denial-of-Service (DoS) attack via a developed hierarchical defense structure with proactive functionality. An important aspect is the tradeoff between performance and security. This novel hierarchical architecture is presented with lightweight authentication protocols acting as a classifier to deny access to harmful traffic. An empirical test of the proposed structure has been performed and results are reported which display the capability of the structure to filter and separate the attack traffic before reaching the target of an IPSec gateway. Thus, the filtering of traffic is performed without being the target itself for new resource exhaustion attacks. The considered IPSec environment is based on IPSec gateways for the low-end market, i.e., for small businesses or private networks.