DDoS filtering: how it works and what to do during an attack

What happens automatically

Every IP address is protected by always-on filtering at our network edge. Volumetric floods (UDP, ICMP), SYN floods and amplification attacks (DNS, NTP, memcached, CLDAP, SSDP) are dropped before they reach your port. You do not need to enable anything, and there is no extra charge.

What you must handle yourself

Application-layer attacks — HTTP floods, login brute force, expensive search queries — look like normal traffic to a network filter. Protect them at the application:

# nginx: at most 10 requests per second per client IP, bursts of 20
limit_req_zone $binary_remote_addr zone=perip:10m rate=10r/s;
server {
    location / { limit_req zone=perip burst=20 nodelay; }
}

Add fail2ban for login endpoints, cache aggressively, or put a reverse proxy or WAF in front of the site.

During an attack

1. Check what reaches the server: iftop -i eno1 or nload.
2. If legitimate users are affected, open a ticket with the target IP, the start time and what you observe.
3. For game servers, keep the application’s own protections (query rate limits, connection caps) enabled.

We only drop traffic to an address as a last resort, when an attack threatens other customers — and we tell you immediately if it happens.