StormWall Protection

StormWall protection is a solution based on a partner product from StormWall. The following services are available:

Network DDoS protection operates at the network (L3) and transport (L4) layers. It protects against DDoS attacks that exploit TCP/IP protocol vulnerabilities and are aimed at exhausting bandwidth and disrupting network infrastructure;
Website DDoS protection operates at the application (L7) layer. It allows you to block attacks on applications and websites and optimizes website loading using HyperCache technology.

Network DDoS Protection

How it works

If you have your own AS (autonomous system) with a /24 prefix or larger, a BGP session is established. StormWall accepts announcements.

If you do not have an AS, specify this in the ticket when ordering the service, and we will select a connection option individually.

All incoming traffic is sent to StormWall filtering nodes, where it undergoes analysis and scrubbing, and is then redirected to the protected server.

All StormWall network nodes operate independently. If the filtering node closest to you becomes unavailable, traffic is automatically redirected to the next closest node.

Pricing

The service cost consists of:

of the selected Network DDoS protection service plan with the required bandwidth. The minimum bandwidth in the plan is 50 Mbps;
the cost of additional protected IPv4 addresses. By default, one protected IP address is provided with the protection service; for each additional server in the pool, you must order an additional protected address;
cost of the volume of legitimate traffic exceeding the amount provided for in the tariff;
cost of a new subnet, if it is required to connect the service.

You can check the prices for the Network DDoS Protection service at selectel.ru.

On the day of activation, a one-time fee equal to the cost of the selected plan is charged. Subsequently, the fee is charged automatically on the first day of each month. An invoice for legitimate traffic bandwidth exceeding the plan limit is generated in the control panel within five business days after the end of the calendar month.

To pay for the service, depending on the type of balance in your account, a universal balance or main balance is used.

Connect service

If your server in the Selectel infrastructure has only a public shared address, a public IP address, or your servers are already under attack, order and configure a new subnet.
Order the Network DDoS Protection service.

1. Order and configure a new subnet

A new subnet is required if:

your server has only a public shared address (/32);
or your servers are under attack and the target IP address is already known to attackers.

Order a subnet and configure an address from it on the server:

for a dedicated server, use the Connect additional public IP addresses section of the Public networks and subnets of a dedicated server guide;
for a cloud server, use the Configure internet access via a public subnet section of the Configure internet access guide.

2. Order the service

Create a ticket. In the ticket, specify:
- service name — StormWall Network DDoS Protection;
- service tariff — Business, Enterprise. You can see a comparison of tariffs at selectel.ru;
- presence or absence of your own AS;
- if you do not have your own AS, specify the IP addresses from the /32 or /24 subnet that need to be protected;
- if your IP addresses are outside the Selectel infrastructure, please specify this;
- services running on the specified IP addresses;
- volume of legitimate traffic;
- connection date;
- the email for registration in the StormWall customer portal. Login credentials for the customer portal will be sent to this email;
- if additional IP addresses are required, specify the quantity. By default, one protected IP address is provided with the protection service. If you need to protect more than one server in the pool, order an additional protected address for each of them.
We will notify you about the connection in a ticket.

Disable service

After disabling the service, traffic will stop passing through StormWall filtering nodes.

If you want to disable the service before the end of the paid month, the payment for the unused remainder of the month is not refunded.

To disable the service, create a ticket.

Website DDoS Protection

How it works

You receive a protected address to which you must redirect your traffic. All traffic to the protected address is sent to StormWall filtering nodes, where it is analyzed and cleaned, and then redirected to the protected server in the Selectel infrastructure.

Activating the service will not protect against a DDoS attack if the target IP address is known to attackers. Before activating, remove all references to the IP addresses you want to protect from external resources. If the addresses are already under attack, you must order a new subnet and configure it on your servers.

Pricing

The service cost consists of:

selected Website DDoS Protection service tariff;
the cost of additional protected IPv4 addresses if you need to protect more than one IP address. One protected address is included in the plan price;
cost of the volume of legitimate traffic exceeding the amount provided for in the tariff;
cost of a new subnet, if it is required to connect the service.

You can check the prices for the Website DDoS Protection service at selectel.ru.

To pay for the service, depending on the type of balance in your account, a universal balance or main balance is used.

Connect service

If the domain's IP address is already known to attackers, order and configure a new subnet.
Order the Website DDoS Protection service.
Specify the protected address in the domain's A record.
Configure settings on the server.
Optional: perform additional configuration.

1. Order and configure a new subnet

A new subnet is required if your servers are under attack and the target IP address is already known to attackers.

Order a subnet and configure an address from it on the server:

for a dedicated server, use the Connect additional public IP addresses section of the Public networks and subnets of a dedicated server guide;
for a cloud server, use the Create a public subnet section of the Public subnets guide.

2. Order the service

Create a ticket. In the ticket, specify:
- service name — StormWall Website DDoS Protection;
- service tariff — Business, Enterprise. You can see a comparison of tariffs at selectel.ru;
- domain to be placed under protection;
- domain IP address. You can specify multiple IP addresses and second-level domains;
- total volume of legitimate traffic for all web resources;
- connection date;
- the email for registration in the StormWall customer portal. Login credentials for the customer portal will be sent to this email.
We will notify you about the connection in a ticket.

3. Specify the protected address in the domain's A record

Open the StormWall control panel.
Enter the username and password you received via email when ordering the service.
Open the Website DDoS Protection service page.
In the Objects block, click Add object.
Enter the domain name.
Click Add. The added domain will appear in the Objects block.
Click the row with the added domain.
Go to the Protection object section.
In the Assigned IPs block, copy the IP address. This is the protected IP address assigned to you.
Open the control panel of the domain registrar where your domain records are stored.
In the domain A record, change the value to the protected IP address you copied in step 9. Do not change the value of the A record intended for mail server or FTP server traffic. DNS records propagate within 24 hours.

4. Configure settings on the server

To add outgoing StormWall addresses to the allowlist, use the instruction in the On your server side section of the Service activation section of the StormWall documentation.

5. Optional: perform additional configuration

You can configure load balancing, caching, redirects, and also issue an SSL certificate according to the Protection object instruction in the StormWall documentation.

Disable service

After disabling the service, traffic will stop passing through StormWall filtering nodes.

If you want to disable the service before the end of the paid month, the payment for the unused remainder of the month is not refunded.

Ensure you have reconfigured traffic reception to the address from your subnet. The protected address provided when the service was activated will be deactivated along with the protection.
Open the control panel of the domain registrar where your domain records are stored.
In the domain's A record, change the value to an address from your subnet.
Create a ticket. In the ticket, state that you want to deactivate the StormWall Website DDoS protection service.