---
title: "DDoS-Guard Protection"
sidebar_label: "DDoS-Guard Protection"
sidebar_position: 3
description: "DDoS-Guard partner protection at L3, L4, and L7 levels"
---

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical';
import EditIcon from '@selectel/docux/icons/edit';
import ShieldOkIcon from '@selectel/docux/icons/shield-ok';
import { TabItemLabel } from '@selectel/docux/components';
import Formbricks from '@theme/MDXComponents/Formbricks';

# DDoS-Guard Protection

DDoS-Guard protection is a solution based on a partner product from the [DDoS-Guard](https://ddos-guard.ru/) company. The following services are available:

* [DDoS-Guard L3-L4 protection](#ddos-guard-l3-l4) — operates at the network (L3) and transport (L4) layers. It protects against DDoS attacks that exploit TCP/IP protocol vulnerabilities and are aimed at exhausting bandwidth and disrupting network infrastructure;

* [DDoS-Guard website protection and acceleration](#ddos-guard-l7) — operates at the application (L7) layer. It allows for blocking attacks on web applications and websites, and accelerates applications or websites using CDN and load balancing. The service can be connected in combination with the DDoS-Guard L3-L4 protection service or separately.

## DDoS-Guard L3-L4 Protection \{#ddos-guard-l3-l4}

### How it works \{#principle-of-operation-l3-l4}

:::info

The service protects only IP addresses assigned to equipment in the Selectel infrastructure. The service can only be connected for addresses from a [public dedicated subnet](/dedicated/networks/public-networks-and-subnets.mdx#order-dedicated-subnet) or a [public subnet](/cloud-servers/cloud-networks/public-subnets.mdx). Connection is not available for addresses from a shared subnet (`/32`) or public IP addresses.

:::

You receive a protected public IPv4 address and use it to configure traffic reception on your server. The address must be assigned to the public network interface as an additional one.

By default, one protected IP address is provided with the service. If you need to protect several servers in a pool, you must order additional protected IP addresses for them.

Incoming traffic directed to the protected address passes through filtering nodes in different parts of the world, where it is analyzed and cleaned. Every incoming packet is filtered. The cleaned traffic is directed to the server's primary address.

### Pricing \{#price-l3-l4}

The service cost consists of:

* from the selected DDoS-Guard L3-L4 Protection plan with the required throughput — 10, 20, 50, or 100 Mbps;
* cost of additional protected IPv4 addresses. The first protected address is provided free of charge; for each additional server in the pool, you must order an additional protected address;
* the cost of a new subnet, if it is required to connect the service.

You can view the DDoS-Guard L3-L4 Protection service plan prices on [selectel.ru](https://selectel.ru/services/additional/ddos-protection/?section=prices).

The service is billed monthly; when ordering the service, the payment for the first month is deducted from the balance, and subsequent payments are deducted automatically at the beginning of each following period.

Depending on the type of balance in your account, a [unified balance](/balance-and-payments/balance.mdx#united-balance) or [master balance](/balance-and-payments/balance.mdx#balances-by-service-type) is used to pay for the service.

### Order the service \{#enable-service}

1. If your server only has a shared public address or a public IP address, or your servers are already under attack, [order and configure a new subnet](#order-and-configure-new-subnet-l3-l4).
2. [Order DDoS-Guard L3-L4 Protection](#order-service-l3-l4).
3. If you need to protect more than one server in the pool, [order additional protected IP addresses](#order-additional-protected-ip-addresses-l3-l4).
4. [Configure the protected IP address on the server](#configure-secure-ip-on-server-l3-l4).
5. If you are connecting protection for a cloud server, [add the protected IP address as an allowed IP address on the port](#add-secure-ip-as-allowed-ip-on-port-l3-l4).

#### 1. Order and configure a new subnet \{#order-and-configure-new-subnet-l3-l4}

A new subnet is required if:

* your server only has a shared public address (`/32`);
* or your servers are under attack and the target IP address is already known to attackers.

Order a subnet and configure an address from it on your server:

* for a dedicated server, use the [Connect additional public IP addresses](/dedicated/networks/public-networks-and-subnets.mdx#add-additional-ips) section of the [Dedicated Server Public Networks and Subnets](//dedicated/networks/public-networks-and-subnets.mdx) guide;
* for a cloud server, use the [Configure internet access via a public subnet](/cloud-servers/cloud-networks/configure-access-to-internet.mdx#internet-access-via-public-subnet) section of the [Configure internet access](/cloud-servers/cloud-networks/configure-access-to-internet.mdx) guide.

#### 2. Order the service \{#order-service-l3-l4}

If you need to protect equipment in different [pools](/infrastructure/locations.mdx#pool), connect a separate protection service for each pool.

Before connecting the service, [top up your balance](/balance-and-payments/manage/top-up-balance.mdx) with the [required amount](#price-l3-l4).

1. In the [control panel](https://my.selectel.ru/network/antiddos), on the top menu, click **Products** and select **DDoS Protection**.

2. Go to the **DDoS Protection** section.

3. Click **Order services**.

4. In the row for the **DDoS-Guard DDoS Protection (L3-L4)** service with the required throughput (10, 20, 50, 100 Mbps), click **Pay**.

5. Verify the details and click **Pay for service**.

6. We will create a [ticket](https://my.selectel.ru/tickets/) to connect the service.

7. In this ticket, send us:

   * IP address to be protected;
   * the email for registration in the DDoS-Guard control panel. Credentials for the control panel will be sent to this email.

8. We will notify you about the connection in the ticket.

#### 3. Order additional protected IP addresses \{#order-additional-protected-ip-addresses-l3-l4}

One protected IP address is provided with the protection service. If you need to protect more than one server in a pool, order an additional protected address for each of them.

1. In the [control panel](https://my.selectel.ru/network/antiddos), on the top menu, click **Products** and select **DDoS Protection**.
2. Go to the **DDoS Protection** section.
3. Click **Order services**.
4. In the row for the **DDoS-Guard DDoS Protection (L3-L4) — additional IP address** service, click **Pay**.
5. Click **Pay for service**.

#### 4. Configure the protected IP address on the server \{#configure-secure-ip-on-server-l3-l4}

<Tabs queryString="configure-secure-ip-on-server-l3-l4">
  <TabItem value="ubuntu" default>
    <TabItemLabel>
      Ubuntu
    </TabItemLabel>

    1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console).

    2. Open the `netplan` utility configuration file using the `vi` text editor:

       ```bash
       vi /etc/netplan/50-cloud-init.yaml
       ```

       or

       ```bash
       vi /etc/netplan/01-netcfg.yaml
       ```

    3. Append the additional address details to the end of the file:

       ```yaml
       <eth_name>:0:
           addresses: [<ip_address>/32]
       ```

       Specify:

       * `<eth_name>` — the name of the network interface to which the additional address should be added;
       * `<ip_address>` — the protected IP address you received in the ticket.

    4. Press the `ESC` key.

    5. Exit the `vi` text editor and save your changes:

       ```bash
       :wq
       ```

    6. Apply the configuration:

       ```bash
       netplan apply
       ```

    7. Optional: reboot the server.

    8. Set all server applications to work with the protected IP address.
  </TabItem>

  <TabItem value="debian">
    <TabItemLabel>
      Debian
    </TabItemLabel>

    1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console).

    2. Open the network interfaces configuration file using the `vi` text editor:

       ```bash
       vi /etc/network/interfaces/
       ```

    3. Append the address details to the end of the content:

       ```bash
       auto <eth_name>:0
       iface <eth_name>:0 inet static
       address <ip_address>/32
       mtu 1500
       ```

       Specify:

       * `<eth_name>` — the name of the network interface to which the additional address should be added;
       * `<ip_address>` — the protected IP address you received in the ticket.

    4. Press the `ESC` key.

    5. Exit the `vi` text editor and save your changes:

       ```bash
       :wq
       ```

    6. Restart the network:

       ```bash
       service networking restart
       ```

    7. Optional: reboot the server.

    8. Set all server applications to work with the protected IP address.
  </TabItem>

  <TabItem value="centos">
    <TabItemLabel>
      CentOS
    </TabItemLabel>

    1. [Connect to the server via SSH](/dedicated/manage/connect-to-server.mdx#connect-via-ssh) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console).

    2. Output information about the network interfaces:

       ```bash
       ip address
       ```

    3. Open the network interface configuration file using the `vi` text editor:

       ```bash
       vi /etc/sysconfig/network-scripts/ifcfg-<eth_name>:0
       ```

       Specify `<eth_name>` — the name of the network interface to which the additional address should be added.

    4. Add the additional address details to the file:

       ```bash
       DEVICE=<eth_name>:0
       ONBOOT=yes
       BOOTPROTO=static
       IPADDR=<ip_address>
       NETMASK=255.255.255.255
       ```

       Specify:

       * `<eth_name>` — the name of the network interface to which the additional address should be added;
       * `<ip_address>` — the protected IP address you received in the ticket.

    5. Press the `ESC` key.

    6. Exit the `vi` text editor and save your changes:

       ```bash
       :wq
       ```

    7. Restart the network:

       ```bash
       service network restart
       ```

    8. Set all server applications to work with the protected IP address.
  </TabItem>

  <TabItem value="windows">
    <TabItemLabel>
      Windows
    </TabItemLabel>

    1. [Connect to the server via RDP](/dedicated/manage/connect-to-server.mdx#connect-via-rdp) or a [KVM console](/dedicated/manage/connect-to-server.mdx#connect-via-kvm-console).
    2. Go to **Ethernet** → **Change adapter settings**.
    3. Open the connection settings and right-click the required device.
    4. Select **Properties** → in the list, double-click **Internet Protocol Version 4 (TCP/IPv4)**.
    5. Ensure that **Use the following IP address** is selected.
    6. Click **Advanced**.
    7. Click **Add**.
    8. In the **IP address** field, enter the protected IP address that you received in the ticket.
    9. Click **Add**.
    10. Click **OK**.
    11. Set all server applications to work with the protected IP address.
  </TabItem>
</Tabs>

#### 5. Add the protected IP address as an allowed IP address on the cloud server port \{#add-secure-ip-as-allowed-ip-on-port-l3-l4}

If you are connecting protection for a cloud server and [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)) is enabled in its public subnet, add the protected address as an allowed IP address on the port where you [configured the protected address](#configure-secure-ip-on-server-l3-l4).

1. Check the traffic filtering (port security) status on the server network:

   1.1. In the [control panel](https://my.selectel.ru/vpc/default/networks-external), on the top menu, click **Products** and select **Cloud Servers**.

   1.2. Go to the **Network** section → **Public networks** tab.

   1.3. View the public subnet card from which you [configured the IP address on the server](#configure-secure-ip-on-server-l3-l4). If the subnet is marked with <ShieldOkIcon />, traffic filtering (port security) is enabled in the network.

2. If traffic filtering is disabled in the subnet, no additional configuration is required. If filtering is enabled, add the protected IP address as an allowed IP address to the cloud server port:

   <Tabs queryString="add-allowed-ip-mac-addresses-on-public-port-l3-l4">
     <TabItem value="panel">
       <TabItemLabel>
         Control panel
       </TabItemLabel>

       2.1. In the [control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

       2.2. Open the server page → **Ports** tab.

       2.3. In the row of the port to which you assigned the protected address, in the **Security groups** field, click <EditIcon />.

       2.4. Click **Add IP/MAC pair**.

       2.5. Enter the protected IP address that you received in the ticket.

       2.6. Enter the MAC address that corresponds to the IP address or leave the default port MAC address. Do not use addresses from the `00:00:5e:00:01:82` – `00:00:5e:00:01:c6` range. These MAC addresses are reserved by Selectel network equipment; using them will result in traffic being blocked on the cloud server interface.

       2.7. Click **Save**.
     </TabItem>

     <TabItem value="openstack">
       <TabItemLabel>
         OpenStack CLI
       </TabItemLabel>

       2.1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

       2.2. Add the allowed address:

       ```bash
       openstack port set \
         --allowed-address ip-address=<ip_address>[,mac-address=<mac_address>] \
         <port>
       ```

       Specify:

       * `<ip_address>` — the protected IP address received in the ticket;
       * optional: `,mac-address=<mac_address>` — the MAC address corresponding to the IP address. The `<mac_address>` parameter is the MAC address value. Do not use addresses from the `00:00:5e:00:01:82` – `00:00:5e:00:01:c6` range. These MAC addresses are reserved by Selectel network equipment; using them will result in traffic being blocked on the cloud server interface. If you do not specify a MAC address, the primary port MAC address will be used;
       * `<port>` — the port ID to which you assigned the protected IP address. You can view the list of ports using the `openstack port list` command.
     </TabItem>
   </Tabs>

### View statistics \{#view-statistics-l3-l4}

1. Go to the [DDoS-Guard personal account](https://netguard.selectel.ru/cabinet/login). You can find the login credentials for your personal account in the service connection ticket.
2. Open the **IP Transit** tab. This displays statistics on total traffic before it is cleaned by filters. The charts are based on five-minute traffic measurements, so peaks may be smoothed out.

### Disable the service \{#disable-service-l3-l4}

1. Ensure that you have reconfigured traffic reception to an address from your subnet. The protected address you received when ordering the service will be disabled along with the protection.

2. In the [control panel](https://my.selectel.ru/network/antiddos), on the top menu, click **Products** and select **DDoS Protection**.

3. Go to the **DDoS Protection** section.

4. In the service <MoreVerticalIcon /> menu, select **Disable monthly payment**. The service will continue to work until the end of the paid period.

5. We will deactivate the service after the end of the paid period.

## DDoS-Guard Website Protection and Acceleration \{#ddos-guard-l7}

### How it works \{#principle-of-operation-l7}

After ordering the service, you receive a protected address to which you must redirect your traffic. All traffic to the protected address is sent to DDoS-Guard filtering nodes, where it is analyzed and cleaned, and then redirected to the protected server in the Selectel infrastructure.

The protection works with HTTP and HTTPS requests only on ports 80 and 443; requests to other ports are not processed.

Connecting the service will not protect against a DDoS attack if attackers know the target IP address. Before connecting, it is necessary to remove mentions of all IP addresses you want to protect from external resources. If the IP addresses are already under attack, you must order a new subnet and configure it on your servers.

### Pricing \{#price-l7}

The following plans are available for ordering the service: Normal, Medium, Premium, and Enterprise. Their main differences are:

* number of protected domains;
* number of servers for load balancing;
* the number of rules for restricting access by IP address. You can purchase an additional package of rules for any plan via a [ticket](https://my.selectel.ru/tickets/create);
* possibility of flexible filtering rule configuration.

The filtering bandwidth and traffic volume, including legitimate traffic, are unlimited.

You can view a detailed comparison of the plans and their costs on [selectel.ru](https://selectel.ru/services/additional/ddos-protection/?section=prices).

The service is billed monthly; when ordering the service, the payment for the first month is deducted from the balance, and subsequent payments are deducted automatically at the beginning of each following period.

To pay for the service, depending on the account balance type, a [unified balance](/balance-and-payments/balance.mdx#united-balance) or [master balance](/balance-and-payments/balance.mdx#balances-by-service-type) is used.

### Order the service \{#enable-service-l7}

The minimum connection time is 1-2 days. If you need protection urgently, [create a ticket](https://my.selectel.ru/tickets/create), and specify the domain and IP address that need protection, as well as an email for registration in the DDoS-Guard personal account. After creating the ticket, [call us](https://selectel.ru/about/contacts/).

1. If the domain IP address is already known to attackers, [order and configure a new subnet](#order-and-configure-new-subnet-l7).
2. [Order the DDoS-Guard website protection and acceleration service](#order-service-l7).
3. [Specify the protected address in the domain's A record](#specify-protected-ip-in-a-record-l7).
4. Optional: [restrict connection to the server from IP addresses](#prohibit-ip-adresses-connection-l7).
5. Optional: [configure additional protection](#make-additional-configurations-l7).

#### 1. Order and configure a new subnet \{#order-and-configure-new-subnet-l7}

A new subnet is required if your servers are under attack and the target IP address is already known to attackers.

Order a subnet and configure an address from it on your server:

* for a dedicated server, use the [Connect additional public IP addresses](/dedicated/networks/public-networks-and-subnets.mdx#add-additional-ips) subsection of the [Public networks and subnets for a dedicated server](/dedicated/networks/public-networks-and-subnets.mdx) guide;
* for a cloud server, use the [Create a public subnet](/cloud-servers/cloud-networks/public-subnets.mdx#create-public-subnet) subsection of the [Public subnets](/cloud-servers/cloud-networks/public-subnets.mdx) guide.

#### 2. Order the service \{#order-service-l7}

Before connecting the service, [top up your balance](/balance-and-payments/manage/top-up-balance.mdx) with the [required amount](#price-l7).

1. In the [control panel](https://my.selectel.ru/network/antiddos), on the top menu, click **Products** and select **DDoS Protection**.

2. Go to the **DDoS Protection** section.

3. Click **Order services**.

4. In the row for the required **DDoS-Guard. Website protection and acceleration** plan (Normal, Medium, Premium, Enterprise), click **Pay**.

5. Check the information and click **Pay for service**.

6. We will create a [ticket](https://my.selectel.ru/tickets/) to connect the service and confirm the connection date.

7. In this ticket, send us:

   * the domain to be protected;
   * Domain IP address. You can specify multiple IP addresses if they point to the same domain and load balancing between them is required;
   * the email for registration in the DDoS-Guard control panel.

8. We will notify you when the service is connected.

#### 3. Specify the protected IP address in the domain A record \{#specify-protected-ip-in-a-record-l7}

1. Go to the [DDoS-Guard personal account](https://my.ddos-guard.net/auth/login).
2. Enter the login and password you received via email when [ordering the service](#order-service-l7).
3. Open the **Website Protection and Acceleration** service page.
4. Open the **Domains** tab.
5. Save the protected IP address specified in the **Protected IP** field.
6. Go to the control panel of the domain registrar where your domain records are stored.
7. In the domain A record, change the value to the protected IP address you copied in step 5. Do not change the A record value intended for mail server or FTP server traffic.
8. If AAAA records are specified for the domain, delete them. DDoS-Guard does not work with IPv6 addresses; they can be attacked bypassing protection.
9. If you want to protect subdomains, add an A record with the protected IP address for each of them. You can protect an unlimited number of subdomains.

#### 4. Optional: restrict connection to the server by IP addresses \{#prohibit-ip-adresses-connection-l7}

You can restrict connection to the server from all IP addresses except for trusted DDoS-Guard IP addresses. Read more about configuration in the [Configuring a firewall](https://ddos-guard.ru/tutorials/general/l7-settings#firewall) subsection of the [Configuring L7 protection](https://ddos-guard.ru/tutorials/general/l7-settings) guide in the DDoS-Guard documentation.

#### 5. Optional: configure additional protection \{#make-additional-configurations-l7}

You can configure additional protection in your [DDoS-Guard personal account](https://my.ddos-guard.net/auth/login). For example, configure traffic filtering rules, enable geoblocking, or other options. A full list of options can be found in the [Website protection](https://ddos-guard.net/ru/tutorials/website-protection) section of the DDoS-Guard documentation.

To configure additional protection:

1. Log in to your [personal account](https://my.ddos-guard.net/auth/login). To log in, use the username and password you received via email when [ordering the service](#order-service-l7).
2. Perform configuration according to the required instructions in the [Website protection](https://ddos-guard.net/ru/tutorials/website-protection) section of the DDoS-Guard documentation.

### View statistics \{#view-statistics-l7}

1. Go to your [personal account](https://my.ddos-guard.net/auth/login). To log in, use the username and password you received via email when [ordering the service](#order-service-l7).
2. View statistics according to the [L7 attacks and attack reports](https://ddos-guard.ru/tutorials/website-protection/attacks-period) guide in the DDoS-Guard documentation.

### Disable the service \{#disable-service-l7}

1. Ensure that you have reconfigured traffic reception to an address from your subnet. The protected address you received when ordering the service will be disabled along with the protection.
2. Open the control panel of the domain registrar where your domain records are stored.
3. In the domain A record, change the value to an address from your subnet.
4. In the [control panel](https://my.selectel.ru/network/antiddos), on the top menu, click **Products** and select **DDoS Protection**.
5. Go to the **DDoS Protection** section.
6. In the service <MoreVerticalIcon /> menu, select **Disable monthly payment**. The service will work until the end of the paid period.
7. We will deactivate the service after the end of the paid period.