00h 00m 00s UP TO 19% OFF your server with usyour server
Menu
MiamiProtected node
FrankfurtProtected node

DDoS protection for everything you host

Always-on data-center mitigation against attacks of millions of packets per second, plus our own filter on every node that understands the protocol of what you host: game servers, VPS, websites, bots, APIs and any TCP or UDP service.

View servers How it works
FilteringPer protocol
DetectionWithin seconds
Protection24/7
LocationsMiami · Frankfurt

Illustrative map

UNDER ATTACK Your current host is not stopping the attacks? Emergency migration with one-to-one follow-up
Protocol-aware filtering

A generic filter stops the attack. And your users.

A generic filter only looks at how much traffic arrives: during an attack it cuts attackers and legitimate users alike. Astrol Shield understands the protocol of each service, whether it is a game, a website or an application, and lets through whoever behaves like a real user.

Volume-based cutGeneric filter
Users disconnected
VOLUMEN USERS AND ATTACK YOUR SERVICE
Protocol-aware filterAstrol Shield
Users connected
PROTOCOLO USERS AND ATTACK YOUR SERVICE

Illustrative animation

Defense in depth

Three layers. One defense.

Every packet goes through three filters, in order, before reaching your server. Whatever fails one never reaches the next: the attack stops before it touches your machine.

One attack, layer by layer

4.98 M pps in · 1,200 pps of clean traffic reach your server

Illustrative
L3·L4

Data-center network

The first line: drops volumetric attacks before they reach the node, at no cost and with no configuration.

  • UDP, ICMP and GRE floods
  • Reflection and amplification attacks
  • Millions of packets per second
  • Mitigation within seconds, always on
mitigation always on
capacity millions of pps
XDP

Astrol Shield on the node

Our filter on the network card. It knows the protocol of each game and service, and only lets through traffic that behaves like a real user.

  • Profiles: FiveM, Minecraft, RakNet, TCP and UDP
  • Protocol handshake required during attacks
  • Per-source and per-port limits
  • Impossible packets and stray fragments
"profile": "fivem", "port": 30120
"enet_check": true, "src_pps": 1000
SYN

Connection verification

During an attack, every new connection passes a check before entering. Spoofed addresses never pass it.

  • Challenge on the network card itself
  • Stateless: handles millions of attempts
  • About 1 s more on the first connection only
  • Enabled per rule from the panel
"profile": "mc_java", "ports": "25565"
"rst_cookie": true
Customizable

You decide what gets in. From the panel.

Per-service profiles and your own rules, without opening tickets or touching the console. Changes apply in seconds, with nothing to restart.

Per-service profilesGames, VPS, websites and applications: FiveM, Minecraft, RakNet or generic TCP and UDP.
Port rulesUp to 12 rules per service, per port or per range.
On or monitoring onlyChoose each service's mode at any time.
Real-time alertsEmail when each attack starts and ends, plus a notice in the panel.
astrolnodes.net/services/2731/anti-ddos
OverviewRulesAttacksAlerts
StatusProtection on
Attacks · 30 days37
Recorded peak2.4 M pps
Rules
+ Add rule

Illustrative panel mock-up: the switches and tabs work; the figures are examples.

Live mitigation

This is how it works. Second by second.

Every attack is detected, classified and stopped at the right layer. This is how you would see it in the panel, with example data.

Incoming trafficsimulated
TotalFilteredDelivered
Eventssimulated
How it works

From detection to alert, hands-free.

01Detection

The filter measures every port second by second, all the time.

02Classification

It identifies the type of attack and the affected service profile.

03Mitigation

Only legitimate connections pass; new ones are verified.

04Alert

Email to the customer, notice in the panel and a 90-day report.

Profiles

How the filter sees your service's traffic.

Pick a service and watch, packet by packet, what Astrol Shield lets through and what it drops, with the reason for each decision.

astrol-shield · FiveM
0 PASS0 DROPPED

Illustrative inspector · documentation addresses

07
Questions

Frequently asked questions

If your case is not listed here, you can ask support from your client area.

Is there any additional cost?
No. The protection described on this page is included with every service. Some products also offer an extended protection option that can be added at checkout.
Does it add latency?
Not noticeably. Astrol Shield filters on the node's own network card, before traffic reaches the operating system, without rerouting traffic through another network.
Do I need to configure anything?
No. If you host a game on a VPS, you can add a rule with its port to apply that game's specific filter.
What do my users notice during an attack?
Connected users and players carry on as normal. With connection verification enabled, a newcomer's first connection takes about one second longer, only while the attack lasts.
Does it also work for websites, bots and applications?
Yes. Everything you host on a VPS or dedicated server has network and node protection against floods, reflection attacks and connection floods, and you can add per-port rules for your TCP or UDP services. The filter works at layers 3 and 4: application attacks, such as mass HTTP requests to a website, are handled on the server itself.
How do I know my service is under attack?
You will receive an email when each attack starts and another with the summary when it ends. The Anti-DDoS section of your service shows it in real time.
Which locations is it available in?
On every node in Miami and Frankfurt. New nodes join with the same protection.

Your service, protected from minute one

Protection is included with every plan, with no configuration or additional cost.

Astrol Shield includedView servers