DDoS Mitigation

Create Firewall Rule

post/ddos-mitigation/firewall-rules

Create a firewall rule for an IP or network.

If you provide a subnet (for example a /24), a separate rule is created for each individual IP in it.

Actions (with protocol restrictions):

0: DROP - Drop packets (TCP/UDP/ICMP)
1: ACCEPT - Accept packets (TCP/UDP/ICMP)
2: FILTER - Continue filtering (TCP/UDP/ICMP)
10: FiveM TCP L1 - Monitor only (TCP only)
11: FiveM TCP L2 - Require auth (TCP only)
12: FiveM TCP L10 - Auth + rate limit (TCP only)
15: FiveM UDP L1 - Monitor only (UDP only)
16: FiveM UDP L2 - Require auth (UDP only)
17: FiveM UDP L3 - Self-auth getinfo (UDP only)
20: RDP TCP - Full auth + rate limit (TCP only)
21: RDP UDP - Require auth (UDP only)
30: DNS UDP - Validate DNS header (UDP only)
31: DNS TCP - Validate header + length (TCP only)
40: Minecraft Java - Handshake validation (TCP only)
50: TLS - TLS record validation (TCP only)
60: Source rate limit in packets per second, per source IP to the destination port (any protocol)
61: Source rate limit in megabits per second, per source IP to the destination port (any protocol)

IPv6: only a single address (bare or /128) is accepted, with actions 0, 1 and 2 and protocols 0, 6, 17 and 58 (ICMPv6, dst_port 0; protocol 1 is stored as 58). The rule is stored, but it is not applied to customer traffic until IPv6 is routed through the scrubbers.

For actions 60 and 61, set the limits in tcp_syn, tcp_ack, tcp_synack, tcp_rst, tcp_fin, tcp_all, udp and icmp.

Authorization

Authorization*string

Bearer YOUR_API_TOKEN with an API token. The X-API-Key: YOUR_API_TOKEN header works too.

Request body

Schema for creating a firewall rule.

application/jsonRequired

network*string

Range1 ≤ length ≤ 45

protocol*integer

Range0 ≤ value ≤ 255

dst_port*integer

Range0 ≤ value ≤ 65535

action*integer

Range0 ≤ value

tcp_syn?integer