DDoS Protection¶

1 Mitigation Levels¶

Our prefixes are generally in one of two DDoS protection classes:

• Passive: Only basic mitigations (e.g., against volumetric attacks, floods, fragmentation, etc.) are active. This means that no restrictions are expected and latency is optimal due to the use of local peerings and carriers.
• Permanent: All incoming traffic is routed exclusively through active DDoS mitigation. This can lead to restrictions (see below) and increased latency.

We reserve the right to change the mitigation level for a region without prior notice if we detect an attack that affects other customers (primarily volumetric attacks). Permanent application protection is available as an add-on; please contact us for more information.

2 Filterable Attack Patterns¶

The following attack patterns can currently be filtered:

• IPv4+IPv6
• UDP/TCP (+SYN+ACK)/ICMP Floods
• Resource Exhaustion Attacks
• IP Fragmentation Attacks
• Zero Day Attacks¹
• Additional attack patterns based on machine learning

3 SmartMitigate¶

In addition to the standard protection, which detects attacks inline via sFlow/NetFlow, continuous filtering is also possible via SmartMitigate (our provider’s proprietary DDoS protection solution).

SmartMitigate enforces TCP/UDP authentication, which prevents TCP/UDP resets from being triggered during an attack. In addition, SmartMitigate responds more quickly to attacks. Customization of SmartMitigate rules is currently not possible.

We recommend setting frequently attacked IP addresses to permanent SmartMitigate. This can be done either via the BGP community 207252: 100: 50 or by submitting a ticket. An option for ccp.realtoxmedia.de is already in the works.

SmartMitigate is permanently enabled by default for the following port ranges: 30000-32000 (FiveM). The only way to disable filtering is via an IP whitelist. For example, you can have an IP network or an IP permanently unblocked via a ticket.

4 Rate Limits¶

4.1 TCP¶

The following restrictions apply to TCP attacks:

• For applications using ports other than those listed below, “TCP resets” may occur; in such cases, a new connection must be established from the client to the server.
• For connections established after an attack begins, TCP authentication must be performed. This results in the connection being reestablished. Connections that were active before the attack began are not affected by this.

4.2 UDP¶

Similar to TCP, resets may also occur here, though in most cases this does not pose a noticeable problem for UDP.

4.3 DNS¶

DNS traffic is rate-limited. The following public DNS resolvers have higher priority:

5 Port Ranges¶

The following port ranges are specifically intended for the listed applications. If you run other applications within these ranges or a listed service outside of them, the traffic may be dropped at any time.

6 Application-Specific Information¶

6.1 3CX Phone System¶

The UDP ports used by 3CX conflict with the TeamSpeak 3 port range. If you are running a 3CX instance, please contact us to request an exemption.

6.2 IPSEC¶

IPSEC is blocked by default by DDoS mitigation. Activation is possible via a support ticket.