DDoS Shield

DDoS Shield filters the traffic sent to your floating IPs at Coritan's points of presence, so an attack is dropped before it reaches your instance or server. Every floating IP on your account is protected from the moment we assign it, whether or not it is attached. You do not have to turn anything on.

The platform default profile and a profile of an address's own cost nothing beyond the floating IP, and a custom profile is a paid service with plans of its own.

Each floating IP starts on the platform default profile. It drops packets that attacks use and normal traffic does not, such as IP fragments, packets from private addresses and UDP answers from the ports that reflection attacks use. It also limits how fast one sender, and all senders together, may send to the address. Only TCP, UDP and ICMP reach the address. How DDoS Shield works lists every check.

DDoS Shield does not filter the shared address of a Container Apps server. To protect a server, attach a floating IP to it (How the Coritan network works).

• A profile of the address's own, at no charge. On the address's Shield tab, choose how strictly we filter it, set its rate limits and add rules that allow, drop or rate limit traffic by protocol, source and port (Change a floating IP's DDoS protection).
• A custom profile, as a paid service. It holds one set of limits and rules for every address you bind to it, and lets you block traffic sources (Order and use a custom profile).

In the dashboard, select DDoS Shield in the sidebar. The page has three tabs, Overview, Events and Profiles, and two buttons: Refresh reloads the page's data, and Order custom profile opens the order page for a custom profile (Order a custom profile).

The Overview tab opens first. When the account has no floating IP yet, it shows Nothing to protect yet and Order floating IP instead (Order a floating IP). Otherwise it starts with four figures:

Protected addresses

How many floating IPs DDoS Shield filters, with how many are attached and how many are not. Both kinds are filtered.

Attacks · 24h

How many attack events started in the last 24 hours. The line under it says how many DDoS Shield is still mitigating, when the last one started, or Nothing seen yet.

Mitigated traffic · 24h

An estimate of the traffic we dropped in those events, worked out from each event's peak rate and duration. The line under it names the attack type with the highest peak.

Current mode

Platform default when every address is on the platform default profile. Otherwise it reads Custom on with the number of addresses that have a profile of their own or a custom profile, such as Custom on 2.

When an attack is in progress, a warning lists each one with the address it targets and when it started. Open Events opens the Events tab (Read attack events).

The Addresses card lists every floating IP on the account:

• Address: the address, which links to the floating IP's page.
• Attached to: the instance or server it is attached to, Not attached, or Per host for a subnet.
• Protection: Platform default, or Custom for an address with its own profile or a custom profile, followed by · Standard or · Passthrough when that profile uses one of those modes. The profile's name is under it.
• Attacks · 24h: how many attack events on the address started in the last 24 hours.
• Manage: opens the address's Shield tab, where its mode, rate limits and rules are.

• How DDoS Shield works: what DDoS Shield checks, and how profiles, protection modes, rules and rate limits decide what passes.
• Change a floating IP's DDoS protection: give one address its own profile, then set its mode, limits and rules.
• Read attack events: what DDoS Shield dropped, when, how much and why.
• Order and use a custom profile: share one profile between addresses, and block traffic sources.
• Game server protection: how to protect a game server hosted here or elsewhere.
• TCP proxy protection: how a web proxy or a join address hides your server's own address.
• Get help during an attack: what to do while an attack is taking a service down.

The public DDoS Mitigation page describes DDoS Shield for buyers. It mentions IPv6 and GRE, but DDoS Shield filters IPv4 only, and it drops GRE in the Standard and Custom modes. The page's Order a Shield profile button opens the order page for a custom profile, and Discuss Protection Requirements opens the contact page.

GET /api/v1/client/shield/status returns every floating IP on your account with the profile that filters it:

curl https://api.coritan.com/api/v1/client/shield/status \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "ips": [
    {
      "ip_service_id": 214,
      "inventory_id": 5120,
      "address": "203.0.113.10",
      "prefix_len": 32,
      "version": "ipv4",
      "attached": true,
      "attachment": {"target_type": "vps", "target_service_id": 1042},
      "protection": {
        "mode": "custom",
        "profile_id": 57,
        "profile_slug": "user-18-ip-214",
        "profile_name": "Customer IP 214",
        "protection_mode": "custom"
      }
    },
    {
      "ip_service_id": 215,
      "inventory_id": 5121,
      "address": "203.0.113.11",
      "prefix_len": 32,
      "version": "ipv4",
      "attached": false,
      "attachment": null,
      "protection": {
        "mode": "platform_default",
        "profile_id": 1,
        "profile_slug": "platform-standard",
        "profile_name": "Platform Standard",
        "protection_mode": "standard"
      }
    }
  ],
  "protect_unattached": true
}

The list holds each floating IP that we have assigned to you and that is not cancelled, oldest first.

protect_unattached is always true, because DDoS Shield filters floating IPs that are not attached as well. The DDoS Shield API reference lists every field.