Skip to Content
DDoS MitigationDDoS Mitigation Configuration

You configure DDoS protection behavior directly. The default action, Geo/ASN filtering, traffic thresholds, and per-port/protocol L7 filters can all be tuned for your attack scenario.

1. General Settings

Default Action

The default action applied to packets caught by a filter. Choose one of Drop, Allow, or Mitigation.

  • Drop — Blocks all traffic except the policies set in Filter.
  • Allow — Allows all traffic.
  • Mitigation — Decides whether to allow after separate processing such as a Challenge. (default)

Symmetric Filtering

Inspects packets in both directions. Set to On or Off.

  • On — Enables finer-grained attack mitigation at the session level.
  • Off — Adaptive Filtering is unavailable.

Note Disabling Symmetric Filtering limits some advanced analysis and response features.

Disable Filtering

Disables all DDoS filtering. Set to On/Off; available on the Enterprise plan only. Use it when traffic must be allowed without filtering, such as during a specific test.

2. Geo/ASN Filtering

Provides IP-based GeoIP and ASN filtering.

  • Country White/Black List — Allows or blocks traffic from specific countries or regions.
  • ASN White/Black List — Allows or blocks traffic by specific ASN (Autonomous System Number).

Note Geo/ASN filtering runs before L3/L4 filtering, so it blocks matching traffic early.

3. Threshold Setting

Triggers automatic RateLimit or filtering based on traffic thresholds.

  • SYN Packets Threshold — Threshold for SYN packets received per second
  • Fragment Packets Threshold — IP Fragment packet threshold
  • AMP Packets Threshold — Amplification-type traffic threshold
  • TCP Packets Threshold — TCP packet threshold
  • UDP Packets Threshold — UDP packet threshold
  • IP Packets Threshold — IP packet threshold

When a threshold is exceeded, RateLimit or filtering (Challenge) is applied to the matching traffic automatically.

4. Filter

You can apply L7 protection filters to specific destination ports and protocols.

  • Destination Port-based Filtering — Sets the L7 filter to apply per port number.
  • Protocol Identification — Identifies the actual protocol of the traffic and applies a matching filter.
  • Application-specific Filters — Applies filters specialized for HTTP, TLS, QUIC, SSH, RDP, and Game Engine traffic.

Examples:

  • TCP port 80/443 → HTTP/TLS filters applied
  • UDP port 19132 → Raknet-based game traffic filter applied
  • TCP port 22 → SSH session verification filter applied

Note You can request that L7 filters not be applied, or be bypassed (Custom Bypass), for specific ports or protocols. (Enterprise only)

DDoS Mitigation Filter TypesDDoS Mitigation Routing