0.0.0.0/32, 127.0.0.0/8, 192.0.2.0/24, 224.0.0.0/3, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
The protection system applies a dynamic traffic threshold based on the network bandwidth provisioned for the server. Incoming traffic that significantly exceeds that capacity is blocked at the targeted IP address. 4 Gbps of incoming traffic to a server with two 1 Gbps NICs is blocked. The duration of the block is determined dynamically.
Advanced DDoS Protection is a paid upgrade for Bare Metal servers. It can be activated during server creation or from the Networking tab on a public or dedicated public interface. Availability depends on the region. The DDoS Protection page lists the locations where Advanced DDoS Protection is available. Where the region does not support the feature, the control is disabled and the tooltip names the region. Advanced DDoS Protection redirects traffic through the Threat Mitigation System (TMS), which filters attack traffic and passes only legitimate traffic to the server. Profile templates set access control lists (ACLs), a GEOIP block list, and rate limiters. With Advanced DDoS Protection enabled, the server IP address is not blocked during an attack, so the server stays operational.
Advantages over basic protection
Basic protection is enabled for all customers at no extra cost. Advanced DDoS Protection operates in always-on mode: traffic passes through TMS at all times, not only during an attack. The system detects attacks within five seconds and forwards only legitimate traffic to the server. Key advantages include:- Improved defense against volumetric (L3), protocol (L4), and application (L7) attacks, which reduces or eliminates service disruption without interrupting uptime.
- During an attack, a higher blocking threshold or no IP blocking at all, depending on the billing plan.
- A lower trigger threshold, so smaller-volume attacks are detected.
Additional key features
Advanced DDoS Protection provides these parameters and capabilities:- Clean Traffic Limit. The limit depends on the data center location.
- Black hole threshold (IP blocking). No limit.
- Time-to-Mitigate (start of mitigation) within five seconds after an attack is detected.
- IP addressing with a dedicated subnet.
- DPI. Deep packet inspection elements analyze traffic as part of DDoS Protection.
- Allowlists. IP addresses added to an allowlist are treated as trusted resources. For Enterprise customers, allowlisted IPs bypass TMS filtering entirely. On public plans, allowlisted IPs remain subject to DDoS traffic filtering.