DDoS Shield

DDoS Shield filters the traffic sent to your floating IPs at Coritan's points of presence, so an attack is dropped before it reaches your instance or server. Every floating IP on your account is protected from the moment we assign it, whether or not it is attached. You do not have to turn anything on.

Standard protection and a profile of an address's own cost nothing beyond the floating IP, and a custom profile is a paid service with plans of its own. Your account plan pays for some custom profiles on the Shield Custom Profile plan: 1 on Business and 5 on Enterprise (When your account plan pays for it).

Each floating IP starts on standard protection. It drops packets that attacks use and normal traffic does not, such as IP fragments, packets from private addresses and UDP answers from the ports that reflection attacks use. It also limits how fast one sender, and all senders together, may send to the address. Only TCP, UDP and ICMP reach the address. How DDoS Shield works lists every check.

DDoS Shield does not filter the shared address of a server on App Deployment. To protect a server, attach a floating IP to it (How the Coritan network works).

We email you when an attack on one of your floating IPs starts and when it ends (Attack emails).

• A profile of the address's own, at no charge. On the address's Shield tab, choose how strictly we filter it, set its rate limits and add rules that allow, drop or rate limit traffic by protocol, source and port (Change a floating IP's DDoS protection).
• Blocked sources, at no charge. Drop all traffic from an address or a range to one of your floating IPs, for a set time or until you unblock it (Block a traffic source).
• A custom profile, as a paid service, or at no charge while your account plan pays for it. It holds one set of limits and rules for every address you bind to it (Order and use a custom profile).

In the dashboard, select Security in the sidebar, then Open DDoS Shield on the DDoS Shield card (The Security page). The page that opens has a Security link above its heading, three tabs, Addresses, Events and Profiles, and two buttons. Links to the older /dashboard/ddos addresses forward to the same pages. Protect an address goes to the Shield tab of an address, where its protection is edited. With one floating IP it opens that address, and with several it opens a menu of them, each marked Custom or Standard. An account with no floating IP does not have the button: the page offers Order floating IP instead. Order custom profile opens the order page for a custom profile (Order a custom profile).

The Addresses tab opens first, and the older /overview address of this tab forwards to it. It shows every floating IP on your account, and each one is a card. Nothing on this tab edits protection: Open Shield settings on a card, and the card itself, open the address's Shield tab. The Events and Profiles tabs did not change (Read attack events, Order and use a custom profile).

Four tiles sit above the list. The first two are filters: select one to show those addresses, and select it again to turn the filter off. The other two are facts, and selecting them does nothing. On a phone, a tile shows only its figure.

• Addresses counts every floating IP, with how they are protected in its footer, such as "1 custom, 4 standard". Selecting it clears every filter and the search.
• Under attack counts the addresses with an attack in progress. It turns red while the count is above zero. Its footer reads "2 attacks in progress" or "1 attack in progress", "Nothing under attack", or "Events did not load".
• Attacks in the last 24 hours counts the attack events that started in the last 24 hours, on every address you had at the time. Its footer reads "Last one" and when it started, such as "Last one 25 minutes ago", or "Nothing seen yet". One attack can be several events (How we record an event).
• Filtered traffic in the last 24 hours is an estimate of the traffic we dropped in those events, worked out from each event's peak rate and duration. Its footer names the attack type with the highest peak, such as "Largest: UDP amplification", or reads "From peak rate and duration" when there was none. The figure is a dash until there is something to count.

An attack figure shows a grey bar while the events load. When the events fail to load, a warning reads Could not load your attack events, with Try again, the attack tiles show a dash, and the cards still draw without their attack facts.

An address needs attention when one of these is true:

An address with a suspended profile shows the suspended line and not the passthrough line, because a suspension sets the profile to passthrough. Standard protection never counts as passthrough. A card or a strip line has no button when the row has nowhere to go.

A large attack is not a problem. When an attack on an address has ended and peaked at 1 Gbps or more in the last 24 hours, its card shows a calm note, such as "UDP amplification peaked at 6.4 Gbps in the last 24 hours. We filtered it.", with a See events button that opens the Events tab on that address. The note does not count under Needs attention, show in the strip or turn the card red.

A custom profile that protects no address is a problem of the account and not of an address, so it counts in no tile and on no card, and not in the count of Needs attention in the Show menu. It has a line of its own in the strip: "This custom profile protects no address yet. Bind an address to put it to work." with Bind an address, which opens the Profiles tab, where you bind one (Bind an address). A profile that is still being set up is not a problem.

When something needs attention, a strip under the tiles says "3 addresses need attention", or "1 address needs attention". While a profile that protects nothing is in the strip, it counts it and says "3 items need attention" or "1 item needs attention". The strip lists up to three lines, or one on a phone, each with the address or the profile, its first problem and a button. It lists the worst first: an attack in progress, then a suspended profile or passthrough mode, then a profile that protects nothing. Show all and the number counts the same items as the title, addresses and profile lines together. It turns on the Needs attention choice of Show, which lists the addresses as cards and each profile line as an alert above them, with the profile's name as its title and the same button. "Show all 5" therefore opens 4 cards and 1 alert, while the Needs attention count in the menu is the 4 addresses. The strip is hidden while any filter or the search is on.

The toolbar narrows and orders the list:

• The search box, "Search by address, profile or server", finds an address by the address with its prefix, a custom profile's name, or the name of the server it is attached to.
• The Show menu holds All addresses, Under attack, Needs attention, Custom profile, Standard and Unattached, each with a count. Unattached holds the addresses that are not attached to anything. A subnet is not in it, because a subnet answers for its own hosts.
• The Sort by menu holds Address, A to Z (the default), Most attacks (24 hours) and Problems first. Address, A to Z sorts by number, every IPv4 address before every IPv6 one, so 51.89.6.200 comes before 51.89.44.8. The other two keep that order among addresses that tie. In the table, selecting the heading of Address or Attacks · 24h sorts by it.
• Clear filters appears while Show or the search is on, and turns them off.
• Cards and Table switch how the list looks, and Refresh reads the list and the attack events again. Your choice of cards or table stays in your browser. A phone always shows cards and has neither control.

The search, Show, the sort and the page stay in the address, so a reload or a shared link brings them back. The address words are q, status (attack, attention, custom, standard or unattached), sort (-attacks or attention, and none for the default) and page.

The list shows 24 addresses a page. When there are more, page buttons appear below it. A search or filter that matches nothing says "No matches", with Reset filters. Under the list, a note says "Blocked sources shared across addresses come with a custom DDoS profile." and links to the Profiles tab. The tab reads your latest 500 attack events. When it fills that limit inside the last 24 hours, a line says "Shield shows your latest 500 attack events, so the counts for the last 24 hours may be higher."

A card shows the address with its prefix, such as 51.89.6.200/32, and a line under it that says "IPv4 address", "IPv4 block", "IPv6 address" or "IPv6 block". Next to the address is a badge: Standard, Custom, or Custom · Passthrough for a custom profile in that mode (Custom · Standard for one in standard mode). Under them, a red or amber line says each problem from the table above, up to two, or the calm note about a large attack. Facts follow:

The two attack facts are left out when the events did not load.

The footer of a card holds two buttons at most. The buttons for the problems come first, and Open Shield settings follows on every card. A card with a large-attack note also has See events, when there is room. A card with two problems has two problem buttons and no more, and the card itself opens the Shield tab. The ... menu, named "More actions for" and the address, holds Events for this address, Order a profile for this address, Open floating IP and, for an unattached address, Attach. Order a profile for this address opens the order page for a custom profile with the address chosen. Select a card to open the address's Shield tab, where you change its protection (Change a floating IP's DDoS protection).

Table shows one row for each address:

The last column is the ... menu from the card. Select a row to open the address's Shield tab.

With no floating IP, the Addresses tab says Nothing to protect yet: "Shield scrubs the floating IPs on your account. Order one and it is protected from the moment we assign it." It offers two cards, Order floating IP and Order custom profile (Order a floating IP). The Events and Profiles tabs of such an account say that there is no floating IP yet. When the tab cannot read your addresses, it says Could not load the protection status, with Try again.

• How DDoS Shield works: what DDoS Shield checks, and how profiles, protection modes, rules and rate limits decide what passes.
• Change a floating IP's DDoS protection: give one address its own profile, then set its mode, limits and rules.
• Read attack events: what DDoS Shield dropped, when, how much and why, and the emails we send about attacks.
• Block a traffic source: drop all traffic from an address or a range to one of your floating IPs.
• Order and use a custom profile: share one profile between addresses.
• Game server protection: how to protect a game server hosted here or elsewhere.
• TCP proxy protection: how a web proxy or a join address hides your server's own address.
• Get help during an attack: what to do while an attack is taking a service down.

The public DDoS Shield page describes DDoS Shield for buyers, with the profiles' prices from the catalogue. DDoS Shield filters traffic to floating IPs and to an instance's IPv6 /64, and it drops GRE in the Standard and Custom modes.

GET /api/v1/client/shield/status returns every floating IP on your account with the profile that filters it:

curl https://api.coritan.com/api/v1/client/shield/status \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "ips": [
    {
      "ip_service_id": 214,
      "inventory_id": 5120,
      "address": "203.0.113.10",
      "prefix_len": 32,
      "version": "ipv4",
      "attached": true,
      "attachment": {"target_type": "vps", "target_service_id": 1042},
      "protection": {
        "mode": "custom",
        "profile_id": 57,
        "profile_slug": "user-18-ip-214",
        "profile_name": "Customer IP 214",
        "protection_mode": "custom"
      }
    },
    {
      "ip_service_id": 215,
      "inventory_id": 5121,
      "address": "203.0.113.11",
      "prefix_len": 32,
      "version": "ipv4",
      "attached": false,
      "attachment": null,
      "protection": {
        "mode": "platform_default",
        "profile_id": 1,
        "profile_slug": "platform-standard",
        "profile_name": "Platform Standard",
        "protection_mode": "standard"
      }
    }
  ],
  "protect_unattached": true
}

The list holds each floating IP that we have assigned to you and that is not cancelled, oldest first.

protect_unattached is always true, because DDoS Shield filters floating IPs that are not attached as well. The DDoS Shield API reference lists every field.