Layer-4 protection
Rules for TCP/UDP forwarding: judge new connections by first packet, TLS name, IP, carrier and country, then drop, ban or allow; plus per-IP rate limits.
What it solves
Layer-4 forwarding for games, databases and custom protocols has no HTTP to inspect, so the usual layer-7 protection does not apply. L4 protection judges each new connection: the first packet the client sends, the name in the TLS handshake, the client address and where it comes from. Suspicious connections are dropped or banned before they reach the forward.
Turning it on
L4 forwarding and protection rules come with the control plane in both editions.
- Open Forwarding list and edit the forward to protect.
- Under Protection rules click Add rule, fill in at least one condition and pick an action; move rules up or down, they are evaluated in order.
- Set per-IP new connections per second, ban on excess, and region limits as needed.
- Save and publish. Every node must run a version that supports L4 protection rules, or publishing is refused with the list of nodes.
Main settings
| Setting | What it does |
|---|---|
| First packet | Hex prefix, contains text or regex; TCP waits up to 2.5 s and reads the first 4096 bytes, UDP uses the first datagram |
| SNI | Matches the TLS handshake name, *.example.com allowed; TLS passthrough forwards only, up to 32 |
| Client IP | One range per line, can be negated (matches when not in the list) |
| Carrier / IDC, country | Looked up in the IP intelligence library on the node |
| Action | Drop, drop and ban, or allow; bans can require a hit count within a window |
| Per-IP new connections per second | Shared by every port of the forward, 0 for no limit; burst and ban time on excess |
| Region limits | Blocked regions; allow or block unknown regions |
| Client IP to origin | Off, PROXY protocol v1 or TOA, one of them, TCP only; PROXY protocol needs support in the origin program, TOA needs a TOA kernel module on the origin and no application change |
Typical uses
- A game port that should only accept your own client: allow by first-packet prefix, drop everything else.
- A TLS passthrough service for your own domains: allow by SNI, drop the rest.
- A data-centre range scanning ports: "drop and ban" by carrier / IDC, banning only after 3 hits to limit collateral damage.
Limits and notes
- Protocols where the client does not speak first (SSH, MySQL, SMTP…) are let through as no-match after the 2.5 s wait, so the first connection waits 2.5 s longer.
- Use SNI conditions for TLS names: contains text and regex only see the first 4096 bytes, and an allow rule that misses falls through to later drop rules.
- Allow only ends rule evaluation; region limits and per-IP rates still apply.
- Until a node has loaded a verified IP intelligence library, publishing rules with carrier, IDC or country conditions is refused; it publishes automatically once the library arrives.
- While banned, an IP's new connections to the forward are all refused; ports used only by this forward are also blocked in the node kernel.