> ## Documentation Index > Fetch the complete documentation index at: https://docs.gcore.com/llms.txt > Use this file to discover all available pages before exploring further. # Custom protection profile configuration > Create custom protection profiles with rules and policies for DDoS protection based on network traffic and security requirements. Custom protection profiles define rules and policies based on network traffic and security requirements. ## Protection profile access **1. Open protection profiles** In the [Gcore Customer Portal](https://portal.gcore.com), navigate to **DDoS Protection** > **Settings** > **Protection profiles**. **2. Review profiles** Review the list of profiles. Each row shows the profile name, assigned networks, and template. ![Protection profiles](https://mintcdn.com/gcore/kjCBUlCGkJrvR9v9/images/docs/ddos-protection/onboarding-service/custom-protection-profile-configuration/add-protection-profile-1.png?fit=max\&auto=format\&n=kjCBUlCGkJrvR9v9\&q=85\&s=c8fde509e33b0ad9c1f0d7b63925aa30) ## Profile creation **1. Add a protection profile** Click **Add protection profile**. **2. Enter a profile name** In **Name**, enter `my-profile-1`. **3. Select the Basic template** In **Template**, select **Basic**. The template adds four catch-all rules: `tcp` with Default TCP, `udp` with Default UDP, `icmp` with Default ICMP, and `any` with Default Other. ![Add protection profile form](https://mintcdn.com/gcore/kjCBUlCGkJrvR9v9/images/docs/ddos-protection/onboarding-service/custom-protection-profile-configuration/add-protection-profile-2.png?fit=max\&auto=format\&n=kjCBUlCGkJrvR9v9\&q=85\&s=1dd1c8824b75f3480909d6ffe58ad469) ## Rule and policy configuration A protection profile has two configuration areas on the same form. The **Rules** tab matches traffic and chooses a policy. The **Policy** tab sets the GEOIP block list, rate-limiter caps, and lockdown limits that some of those policies use. ### Rules and policies Rules define traffic-matching criteria and apply a selected policy to matching traffic. The Basic template pre-populates four rules that match `tcp`, `udp`, `icmp`, and `any`. Add more rules to layer specific protections above these defaults. Policy names and what each policy does are in the [Policy reference](#policy-reference). ![How rules and policies work](https://mintcdn.com/gcore/1Deidw53r3n2OEiP/images/docs/ddos-protection/onboarding-service/custom-protection-profile-configuration/how-rules-and-policies-work.png?fit=max\&auto=format\&n=1Deidw53r3n2OEiP\&q=85\&s=3e1748dfeb3567dc9929bc28fb896b9e) Once traffic is matched by a rule and processed by a policy, there are two possible outcomes: it is dropped or passed to the final destination. It is not evaluated by the rules again. #### Rule creation Add a rule to match specific traffic and apply a policy to it. > [!WARNING] > > Rules are evaluated from top to bottom, and the first matching rule is applied. Traffic that matches none of the rules is denied. The form labels this as an implicit deny-all at the end of the list. Place a specific rule above the matching catch-all rule, or the catch-all matches first and the specific rule never runs. **1. Add a rule** Click **Add rule**. The **Add ACL Rule** dialog opens. **2. Configure the rule** **Policy** is required. Each match field accepts a list of values: * **Protocol List** * **Source IP List** * **Destination IP List** * **Source Port List** * **Destination Port List** ![Add ACL Rule dialog](https://mintcdn.com/gcore/kjCBUlCGkJrvR9v9/images/docs/ddos-protection/onboarding-service/custom-protection-profile-configuration/protection-profile-save-rule.png?fit=max\&auto=format\&n=kjCBUlCGkJrvR9v9\&q=85\&s=9238c534642d8612e734a9791acc6c3c) **3. Set rule priority** Drag a rule by the handle at the left of the row. The Basic catch-all rules match `tcp`, `udp`, `icmp`, and `any`, so a rule for specific traffic must sit above the matching catch-all rule. **4. Save the rule** Click **Save**. A profile can contain multiple rules. Match `tcp` on destination port `80` and apply **TCP SYN cookie challenge**. ### Policy configuration The **Policy** tab sets profile-level limits for the selected template. Limits on the rate-limiter fields are in thousand packets per second (kpps). ![Protection profile Policy tab](https://mintcdn.com/gcore/kjCBUlCGkJrvR9v9/images/docs/ddos-protection/onboarding-service/custom-protection-profile-configuration/protection-profile-policy-1.png?fit=max\&auto=format\&n=kjCBUlCGkJrvR9v9\&q=85\&s=22a47cd334ed1f2887273c4e14027a4c) For the Basic template, the **Policy** tab includes these fields: * **GEOIP list**: ISO country codes for the **Geo Restriction** policy. The field is a block list. Select the codes before adding a rule that uses **Geo Restriction**. * **Rate limiter low**: destination cap for **Rate Limiter Low**, from 1 to 50 kpps. Default: 50 kpps. * **Rate limiter medium**: destination cap for **Rate Limiter Medium**, from 50 to 150 kpps. Default: 150 kpps. * **Rate limiter high**: destination cap for **Rate Limiter High**, from 150 to 300 kpps. Default: 300 kpps. * **Rate limiter geo**: destination cap for **Geo Restriction**, from 1 to 300 kpps. Default: 300 kpps. * **Lockdown threshold**: range 1-300k. The control shows 10, and the helper text states the default as 10k. * **Lockdown destination limiter**: lockdown rate limiter, range 1-300k. The control shows 10, and the helper text states the default as 10k. Set the GEOIP list and rate-limiter thresholds on the **Policy** tab before selecting **Geo Restriction** or a rate-limiter policy in a rule. To forward trusted traffic without inspection, add a rule on the **Rules** tab with **Allow List** applied to the trusted source addresses. ## Profile saving **1. Review the profile** Review the configured rules and the **Policy** tab. **2. Save the profile** Click **Add protection profile**. The new profile appears in the profile list from [Protection profile access](#protection-profile-access), with its template and name. ## Policy reference Select a policy by the name shown in **Add ACL Rule**. Game policies inspect that game's protocol. Default and rate-limiter policies cap generic floods. TCP policies run handshake or session checks. UDP games that have no named policy in the list use **Default UDP**. The list also includes `udp-arma`, with no description on the form. | Policy | Description | | - | - | | Drop | Drops all matching traffic | | Minecraft Protection | Minecraft Java and Bedrock: handshake, login, ping, and volumetric floods | | Unreal engine Protection | Unreal Engine traffic over UDP | | Garry's Mod Protection | UDP floods, query abuse, and abnormal packets | | Nova-Life Game Protection | Nova-Life UDP traffic | | Counter-Strike 1.6 | GoldSrc: UDP floods, query abuse, and malformed packets | | Counter-Strike Go | Source engine: A2S query floods, connection floods, and high packet rates | | Counter-Strike 2 | UDP floods, query abuse, and abnormal packets | | FiveM TCP | TCP connection and handshake floods | | FiveM TCP 2 | FiveM TCP. TCP protection turns on during an attack and turns off when the attack ends | | FiveM UDP | High packet rates and abnormal packets | | San-Andreas Multiplayer | Connection floods, query abuse, and malformed UDP | | Rust Game Protection | UDP floods, connection spikes, and abnormal packets | | Teamspeak 3 Voice Chat | UDP floods and connection abuse on voice sessions | | Rust Game A2S Caching | Caches Rust Steam A2S query responses | | Steam Query A2S Caching | Caches Steam A2S query responses | | Battlefield 2 Query Caching | Caches Battlefield 2 server-browser query responses | | Battlefield 2 Game | UDP floods and malformed packets on gameplay traffic | | Unity Engine Unet | Malformed packets and high packet rates on Unity UNET | | Unity Engine UTP | UDP floods on Unity Transport Protocol (UTP) | | `udp-arma` | Shown in the list with no description | | Geo Restriction | Allow or deny by client location. Configure **GEOIP list** on the **Policy** tab first | | RageMP test policy | Test policy. The form states that it is not guaranteed to work | | RageMP TCP test policy | Test policy for RageMP TCP. The form states that it is not guaranteed to work | | SSH Server | SSH connection floods | | TCP auto-detect | Passive TCP countermeasure, triggered only during an attack | | TCP SYN cookie challenge | SYN cookie challenge for incoming TCP | | TCP Flow Track | Experimental full-session TCP tracking, for applications where the SYN cookie challenge does not fit | | TCP ephemeral ports Protection | Protects ephemeral client-source TCP ports | | `dns-trust` | Shown in the list with no description | | Allow List | Matching traffic is forwarded without inspection | | Rate Limiter Low | Destination cap from 1 to 50 kpps. Default: 50 kpps. Configure on the **Policy** tab first | | Rate Limiter Medium | Destination cap from 50 to 150 kpps. Default: 150 kpps. Configure on the **Policy** tab first | | Rate Limiter High | Destination cap from 150 to 300 kpps. Default: 300 kpps. Configure on the **Policy** tab first | | General UDP Countermeasure | Turns on when UDP traffic exceeds a threshold. Set the threshold to the maximum expected UDP traffic for the service | | Default TCP | Generic TCP. Per IP 20 kpps / 50 Mbps; overall 50 kpps / 500 Mbps | | Default UDP | Generic UDP. Per IP 5 kpps / 5 Mbps; overall 50 kpps / 50 Mbps | | Default ICMP | Generic ICMP. Per IP 100 pps; overall 1000 pps | | Default Other | Other protocols. Per IP 200 pps; overall 1000 pps | ## Best practices When building and maintaining protection profiles: * Start with simple rules and expand them as needed. * Apply a new profile to a non-critical network first. The [events log](/ddos-protection/events-log) shows the result before the profile is used on production prefixes. * Document rules and policies for future maintenance. * Review and update profiles regularly based on traffic patterns. Once the profile is saved, continue with [applying the profile](/ddos-protection/onboarding-service/apply-a-custom-profile-to-a-protected-network) to a protected network.