Curator protection

Last update: October 05 2026Open in Markdown

DDoS protection in partnership with Curator is provided as an additional service for Selectel products:

• Dedicated servers;
• Colocation;
• Cloud servers;
• Managed Kubernetes;
• Container Registry;
• Managed Databases;
• VMware-based Public Cloud.

Curator protection works at all levels of the network model, including the application layer (L7). Additionally, you can connect Curator WAF to protect against targeted attacks on web applications.

How it works

You receive a protected address to which you need to redirect your traffic. All traffic to the protected address is sent to Curator filtering nodes, where it is analyzed and cleaned, and then redirected to the protected server in the Selectel infrastructure.

All Curator network nodes operate independently of each other. If the filtering node closest to you becomes unavailable, traffic is automatically redirected to the next closest node.

Activating the service will not protect against DDoS attacks if the attackers know the target IP address. Before activation, you must remove all references to the IP addresses you want to protect from external resources. If the IP addresses are already under attack, you must order a new subnet and configure it on your servers.

Pricing

Service pricing includes:

• of the selected service tariff plan;
• the cost of additional protected IPv4 addresses if you need to protect more than one IP address. The first protected address is provided free of charge;
• payment for additional bandwidth if it exceeds 10 Mbps;
• the cost of a new subnet if it is required to connect the service.

You can check prices for the Curator Protection plans on selectel.ru.

On the day of connection, a one-time payment equal to the cost of the selected plan is debited. Then, the payment is debited automatically on the first day of each month. An invoice for additional bandwidth is generated in the Control Panel within five business days after the end of the calendar month.

To pay for the service, depending on the balance type in your account, the unified balance or main balance is used.

Before enabling the service, top up your balance.

Calculating legitimate traffic bandwidth

Only legitimate traffic — cleared of malicious requests — is billed.

To calculate the bandwidth, the volume of incoming and outgoing traffic cleaned by the filtering system is measured every minute. The maximum value for each minute is selected from the obtained values. At the end of the calendar month, all maximum values are sorted in descending order. The top 90 maximum values are excluded from the calculation. The 91st maximum value is rounded down to the nearest whole Mbps — this number is the bandwidth value. If the value exceeds 10 Mbps, each additional Mbps is billed separately.

Calculating attack traffic bandwidth

Attack traffic is not billed.

To calculate the attack bandwidth, the volume of attack traffic is measured every three minutes. The top 30 maximum values per month are ignored; the 31st maximum value is the bandwidth value. If an attack exceeds the bandwidth provided by the plan, the quality of traffic filtering may degrade. In this case, we will offer you to switch to the next pricing plan for a period of at least three months. If you do not want to switch to the next plan but want to maintain the filtering quality, you can limit all incoming traffic, including legitimate traffic, to the bandwidth specified in the plan.

Activate service

1. Order and configure a new subnet if your server only has a shared public IP address or a public IP address, or if the server is already under attack.
2. Order the service.
3. Specify the protected IP address in the domain's A record.
4. Add a TLS (SSL) certificate.

1. Order and configure a new subnet

A new subnet is required if your server only has a shared public IP address or a /32 public IP address, or if the server is under attack and the target IP address is already known to attackers.

Order a subnet and configure an address from it on your server:

• for a dedicated server, use the Connect additional public IP addresses⁠ subsection of the Public networks and subnets of a dedicated server guide;
• for a cloud server, use the Create a public subnet subsection of the Public subnets guide.

2. Order service

1. In the Control Panel, in the top menu, click Products and select DDoS Protection.

2. Go to the DDoS Protection section.

3. Click Order services.

4. In the row with the required Curator plan (Professional, Business, Corporate), click Pay.

5. Check the data and click Pay for service.

6. We will create and send a ticket about the service order.

7. In this ticket, please send us:

   • the domain to be protected (subdomains will be protected automatically);
   • The IP address to which filtered traffic should be sent;
   • an email address for registration in the Curator Control Panel. Login credentials for the Control Panel will be sent to this email address.

8. We will notify you about the activation in a ticket. Activation takes up to one business day.

3. Specify the protected IP address in the domain's A-record

1. Go to the control panel of your domain registrar where your domain records are stored.
2. In the A record, change the value to the protected IP address received in the ticket when ordering the service.

4. Add a TLS(SSL) certificate

1. Open the Curator control panel. To log in, use the username and password received by email when ordering the service in step 2.

2. Go to the Certificate Storage section.

3. Click Add Certificate.

4. If you do not have a TLS(SSL) certificate, you can issue a free Let's Encrypt® certificate that protects one domain:

   4.1. Open the Use Let's Encrypt tab.

   4.2. Click Next.

   4.3. Select the domain that will be used to obtain the certificate.

   4.4. Enter one or more domain names for which you need to issue a certificate.

   4.5. Click Create Certificate.

5. If you have a TLS(SSL) certificate or want to protect multiple domains with the same IP address, add a certificate. A certificate for protecting multiple domains must be multi-domain: SSL or UCC with the SAN option for protecting different domains, or a Wildcard certificate for protecting a domain and its subdomains.

   5.1. Open the Upload Certificate tab.

   5.2. Select the file.

   5.3. Click Upload.

View statistics

After connecting and configuring the service, you can view traffic statistics.

1. Log in to the Curator control panel. To log in, use the username and password received by email when ordering the service.

2. Go to the Documents section and select Reports. Here you can view statistics on incoming and filtered traffic. When generating statistics, you can use filters:

   • by type (traffic, packets, requests, etc.);
   • by time (five hours, day, week, month, etc.).

Disconnect service

If you disconnect the service before the end of the paid month, the payment for the remaining unused days is non-refundable.

1. Ensure that you have reconfigured traffic reception to the address from your subnet. The protected address issued when activating the service will be disabled along with the protection.
2. Open the control panel of your domain registrar where your domain records are stored.
3. In the domain's A-record, change the value to an address from your subnet.
4. In the Control Panel, in the top menu, click Products and select DDoS Protection.
5. Go to the DDoS Protection section.
6. From the service menu, select Disable monthly payment.