# TCP proxy protection

> How Coritan's proxies hide your server's own address and check traffic on its way to your server.

Source: https://www.coritan.com/docs/ddos-shield/tcp-proxy/

In the dashboard:

- /security/tcp-proxy: https://www.coritan.com/security/tcp-proxy

A Coritan proxy stands between your service and the people who use it. Clients connect to Coritan's edge, and the edge opens its own connection to the server that runs the service, which we call the *origin*. Clients see only the edge's address, so a flood aimed at your hostname lands on the edge, which forwards only the connections and requests that pass its checks.

## The three kinds of proxy

| Proxy | Carries | Origin | Set it up |
|---|---|---|---|
| Web proxy | HTTP and HTTPS for a hostname | A server hosted here, or any public address | [Create a web proxy](/docs/proxies/web-proxies/create-a-web-proxy/) |
| Join address | Minecraft Java, Minecraft Bedrock, or another game over TCP as a **TCP service** | A server hosted here | [Create a join address](/docs/proxies/join-addresses/create-a-join-address/) |
| External server | Minecraft Java or Minecraft Bedrock | A server you host elsewhere | [Connect a server you host elsewhere](/docs/proxies/external-servers/connect-an-external-server/) |

You create each of them with **New proxy…** on the [Edge Proxy](https://www.coritan.com/dashboard/proxies) page of the dashboard. A join address is a name under `coritan.gg`. A web proxy serves a domain you hold, or a name under a free coritan.gg name that you claim ([Claim a free coritan.gg name](/docs/proxies/coritan-gg-names/)).

## What the edge checks

- A web proxy checks each request with its web application firewall, which blocks a request that looks like an attack or asks the visitor to prove they are human. It also answers `429` to a client that sends too many requests, and `413` to a request body over the limit ([How the edge handles a request](/docs/proxies/web-proxies/#how-the-edge-handles-a-request)).
- A join address or an external server limits the connections from each player's address. For Minecraft Java it also checks the handshake and turns away first joins during a flood ([How a join address protects a server](/docs/ddos-shield/game-protection/#how-a-join-address-protects-a-server)).
- A **TCP service** gets the same limits on each address's connections, and closes a connection over a limit without a message. The edge does not read the traffic inside the connection.

The edge's addresses are Coritan's, so your DDoS Shield settings do not apply to the traffic sent to a proxy.

## What your origin receives

Every connection reaches the origin from one of the edge's addresses. The origin learns the client's own address only from what the edge passes on:

| Proxy | Where the client's address arrives |
|---|---|
| Web proxy | The `X-Forwarded-For` and `X-Real-IP` headers, and a PROXY protocol header with **PROXY protocol to origin** on |
| Minecraft Java join address or external server | A PROXY protocol header with **PROXY protocol** on, or else the Minecraft handshake |
| **TCP service** | A PROXY protocol header with **PROXY protocol** on |
| Minecraft Bedrock join address or external server | Nowhere, so the origin sees the edge's address for every player |

The edge sends PROXY protocol version 2. Turn it on only when the origin expects the header, or every connection fails. [What your origin receives](/docs/proxies/web-proxies/#what-your-origin-receives) and [What your server receives](/docs/proxies/join-addresses/#what-your-server-receives) give the details.

## Keep the origin's address private

A proxy protects the origin only from attackers who do not know the origin's own address. A flood sent straight to that address does not pass through the edge.

- Point your public names at the proxy only. Remove DNS records that point at the origin's address, including the records of other services on the same machine.
- If the origin's address has been public, attackers may still know it. Move the origin to a new address that you do not publish.
- For an external server, allow only the **Edge addresses** through the firewall on the game's port ([Set up your server](/docs/proxies/external-servers/connect-an-external-server/#set-up-your-server)).
- An origin on a Cloud Compute instance has a floating IP, so DDoS Shield also filters the traffic sent straight to it. The shared address of a Container Apps server is not filtered ([How the Coritan network works](/docs/platform/network/#traffic-to-a-shared-address)).

## The TCP Proxy page

The public [TCP Proxy](https://www.coritan.com/security/tcp-proxy) page describes the proxies for buyers. Some of what it says differs from what you can set up:

- Its four protocol handlers are the web proxy for HTTP and HTTPS, and the three editions of a join address: Minecraft Java, Minecraft Bedrock and **TCP service**.
- It describes Bedrock filtering as RakNet. A join address carries Bedrock over NetherNet only, for Bedrock 26.50 and newer.
- Its Custom TCP handler is the **TCP service**. It forwards only to a server hosted here, on an edge port that Coritan picks, and has no settings for connection limits, bandwidth or timeouts.
- It lists GeoIP filtering and access lists. No proxy can allow or refuse clients by country.
- It lists PROXY protocol versions 1 and 2. The edge sends version 2 only.
- It lists load balancing with health checks. A web proxy can spread requests across several origins, and skips one that keeps failing, but it does not check their health in advance ([Origins](/docs/proxies/web-proxies/#origins)).
- It says every account includes a free coritan.gg name, such as `www.you.coritan.gg`. You claim the name first, then use the names under it for web proxies and join addresses ([Claim a free coritan.gg name](/docs/proxies/coritan-gg-names/)).

**Set up a proxy** on the page opens the **Game** tab of [Edge Proxy](https://www.coritan.com/dashboard/proxies/game). **Get Protected** and **Contact Sales** open the contact page, whose form sends nothing. To ask about a TCP service that runs elsewhere, email [sales@coritan.com](mailto:sales@coritan.com).

## Related

- [How web proxies work](/docs/proxies/web-proxies/)
- [How join addresses work](/docs/proxies/join-addresses/)
- [How external servers work](/docs/proxies/external-servers/)
- [Game server protection](/docs/ddos-shield/game-protection/)
- [How DDoS Shield works](/docs/ddos-shield/how-ddos-shield-works/)