TCP proxy protection

A Coritan proxy stands between your service and the people who use it. Clients connect to Coritan's edge, and the edge opens its own connection to the server that runs the service, which we call the origin. Clients see only the edge's address, so a flood aimed at your hostname lands on the edge, which forwards only the connections and requests that pass its checks.

You create a join address with Create a join address, and connect an external server with Connect an external server, on the Game Shield page of the dashboard. Game Shield is where you manage proxies. DDoS Shield is a separate product that protects floating IPs. A web proxy is created on its website's Origin tab (Create a web proxy). A join address is a name under coritan.gg. A web proxy serves a domain you hold, or a name under a free coritan.gg name that you claim (Claim a free coritan.gg name).

• A web proxy checks each request with its web application firewall, which blocks a request that looks like an attack or asks the visitor to prove they are human. It also answers 429 to a client that sends too many requests, and 413 to a request body over the limit (How the edge handles a request).
• A join address or an external server limits the connections from each player's address. For Minecraft Java it also checks the handshake and turns away first joins during a flood (How a join address protects a server).
• A TCP service gets the same limits on each address's connections, and closes a connection over a limit without a message. The edge does not read the traffic inside the connection.

The edge's addresses are Coritan's, so your DDoS Shield settings do not apply to the traffic sent to a proxy.

Every connection reaches the origin from one of the edge's addresses. The origin learns the client's own address only from what the edge passes on:

The edge sends PROXY protocol version 2. Turn it on only when the origin expects the header, or every connection fails. What your origin receives and What your server receives give the details.

A proxy protects the origin only from attackers who do not know the origin's own address. A flood sent straight to that address does not pass through the edge.

• Point your public names at the proxy only. Remove DNS records that point at the origin's address, including the records of other services on the same machine.
• If the origin's address has been public, attackers may still know it. Move the origin to a new address that you do not publish.
• For an external server, allow only the Edge addresses through the firewall on the game's port (Set up your server).
• An origin on a Cloud Compute instance has a floating IP, so DDoS Shield also filters the traffic sent straight to it. The shared address of a server on App Deployment is not filtered (How the Coritan network works).

The public Game Shield page describes join addresses and external servers for buyers. These limits apply:

• A TCP service join address forwards only to a server hosted here, on an edge port that Coritan picks, and has no settings for connection limits, bandwidth or timeouts.
• A join address carries Bedrock over NetherNet only, for Bedrock 26.50 and newer.
• No proxy can allow or refuse clients by country, and the edge sends PROXY protocol version 2 only.
• A web proxy can spread requests across several origins, and skips one that keeps failing, but it does not check their health in advance (Origins).
• You claim a free coritan.gg name first, then use the names under it for web proxies and join addresses (Claim a free coritan.gg name).

• How web proxies work
• How join addresses work
• How external servers work
• Game server protection
• How DDoS Shield works