Skip to content
Custom DDoS filters and backups for volumes

DDoS Protection

Our DDoS protection is suitable for any server, wherever it runs. If you do not want to move your entire infrastructure right away but still want to benefit from our DDoS protection, a DDoS proxy gets you there: a Seed takes over the public address, our filters at the network edge take over the protection, and only clean traffic reaches your server over an encrypted connection. Your server stays where it is, whether at another provider, in a homelab or in your own data center. If a fresh setup is due anyway, the protection sits directly on your server's address after migrating to a Seed, without a tunnel and without a detour.

100% Made in GermanyGDPR compliantHourly billingNo minimum term
How the proxy works

Your server behind our DDoS protection

Users and attackers

Connect to the Seed’s address

DDoS filter

At our network edge

Proxy Seed

Forwards clean traffic

Your server

Another cloud provider, homelab, data center

Attacks end at the filter. Only traffic that matches your application passes through the tunnel.
  • Only clean traffic reaches your server
  • Your server needs no public address
  • Your server sees the real IPs of your users
01

Put a proxy in front or move the server?

Seed as Proxy

Best choice when your server should stay where it is.

  • Your server stays at the provider, in the homelab or in your own data center
  • Works even without a public address of its own
  • The public address belongs to the Seed, a later move does not change it
  • Your server sees the real IPs of your users
  • Tunnel and forwarding have to be set up on both sides
  • Traffic takes the detour via the Seed
  • Your server's real address has to stay secret

Move the Server to a Seed

Best choice when a change of infrastructure pays off for you, or you are setting up anew anyway.

  • Protection directly on the server's address, without a tunnel
  • No detour and no forwarding
  • One server instead of two
  • Data migration and an address change for your users
  • Existing contract or own hardware stays unused
Conclusion: The proxy is the right choice when your server should stay where it is, for example at home, at a provider with a running contract or on hardware you need. Moving to a Seed pays off when you are setting up anew anyway, or when a change of infrastructure is worth the effort to you: then the protection sits directly on the server's address, without a tunnel and without a detour.
02

Who the proxy is for

Homelab

A game server or voice server at home, often on a connection without a public address of its own. The Seed gives your server a protected address, without a port forward and without a fixed IP on your connection. An attack hits the Seed, not your home internet.

Server at another provider

The protection there does not understand game protocols or blocks the whole address during attacks. The Seed takes over the public address, your server stays where it is and gets the filters of the dataforest cloud.

Your own data center or office

Services that have to be reachable from outside get a protected address. Your own uplink never appears anywhere and does not become the target.

Protect now, migrate later

The address your users know belongs to the Seed. If you move your server later, to a Seed or to another provider, nothing changes for your users. You only have to point the connection at the new server.

03

What the proxy means for your server

Only clean traffic arrives

The DDoS protection checks every packet at our network edge before it reaches the Seed. For applications such as Minecraft Java, FiveM, TeamSpeak 3 or WireGuard, the filters know the protocol and drop everything that does not match it. What does not reach the Seed does not reach your server either.

Your server does not have to be reachable from the internet

Your server opens the connection to the Seed itself. It needs no public address and no port forward on the router. To the outside, only the Seed's address exists, and what nobody can reach, nobody can attack.

Your server sees the real IPs of your users

The Seed passes the sender on unchanged, nothing is masked. Your server sees every player and every user with their real IP address, not the Seed's. Bans, whitelists, rate limits and logs keep working as before.

Even without an IPv4 address of your own

Only the Seed needs a public IPv4 address. Your server opens the connection to the Seed itself, so this also works on a connection without an IPv4 address of its own, as many internet providers hand out at home. Nothing changes for your users, they reach your server as usual.

One Seed, several servers

Behind one Seed, game servers, voice servers and VPNs can run on different servers, each over its own connection. Every service gets an entry among the protected applications and a forwarding rule on the Seed. This also applies to other Seeds: instead of booking custom filters for every address, one Seed can protect several Seeds as a proxy. Depending on the use case, that can reduce your team's costs.

Quick to set up, switched off anytime

A tunnel and a handful of forwarding rules, that is all the proxy needs. The guide walks you through step by step. When the protection is no longer needed, you can delete the Seed. Billing then ends with the hour.

04

In front of your server in three steps

01Step 01

Create a Seed

Choose a model with an IPv4 address. The proxy needs hardly any CPU or memory, what matters is the traffic allowance, because your users' traffic passes through the Seed.

02Step 02

Configure the protection

In the cloud console under DDoS Protection, book the custom filters for the Seed's address, pick your applications from the catalog and close all other ports.

03Step 03

Connect your server

Your server opens an encrypted connection to the Seed, the Seed passes the clean traffic on. After that, your server is reachable only through the Seed and no longer needs a public address. The guide contains every command, for the Seed and for your server.

05

Step-by-step setup

Tested on a current dataforest Seed. Every command explained, accessible without an account.

Networking · approx. 15 minIntermediate

Set Up a DDoS Proxy with WireGuard

Use a Seed as a DDoS proxy to filter incoming traffic and forward the clean traffic to your servers over an encrypted connection.

DDoS ProtectionWireGuardnftablesGame ServerNetworking
Open guide
Getting Started · approx. 10 minIntermediate

Move a Linux server from another provider to the dataforest cloud

Server migration from another provider step by step. Set the services up on a dataforest seed, bring files across with rsync and databases as a dump, test under the real domain and switch the DNS records with only a short downtime.

MigrationrsyncDNSNetworking
Open guide

View all guides →

06

Configure a seed

Billed hourly, no minimum term, no setup fee. The proxy needs hardly any computing power, a small model is usually enough. Custom filters are booked per IPv4 address and billed by the hour. After migrating to a Seed there is no proxy, the custom filters then apply directly to its address.

Entry

The entry point for low CPU load

Shared vCPUs
For low CPU load
Xeon Gold class CPU
DDR4 ECC RAM
3-way replication via Ceph
10 TB traffic included
Up to 1 Gbit/s connectivity
from
3,65 €
/ Month
from
0,005848 €
/ Hour

Standard

All-rounder for variable production load

Shared vCPUs
For variable production load
AMD EPYC 9655 (Turin)
DDR5 ECC RAM
3-way replication via Ceph
20 TB traffic included
Up to 2.5 Gbit/s connectivity
from
8,93 €
/ Month
from
0,014303 €
/ Hour

Performance

Exclusive compute for sustained load

Dedicated vCPUs
For sustained load
AMD EPYC 9575F (Turin)
DDR5 ECC RAM
3-way replication via Ceph
20 TB traffic included
Up to 10 Gbit/s connectivity
from
44,03 €
/ Month
from
0,070561 €
/ Hour

All prices incl. 19% VAT

07

Why dataforest cloud?

Data sovereignty

Your data stays in Germany. All seeds run in certified data centers in Frankfurt. No data transfers to third countries, full GDPR compliance.

Deployed in seconds

Seeds are provisioned automatically. From configuration to a running server takes only seconds. No waiting, no tickets.

Hourly billing

You only pay for what you use. No minimum terms, no setup fees. Seeds can be created and deleted at any time.

Full control

Root access, public API and full transparency. You decide what runs on your seed. No vendor lock-in, no hidden restrictions.

08

Before you get started.

What is a DDoS proxy?

A server that sits between the internet and your actual server. It accepts all connections under its own address, has the traffic filtered and passes only clean packets on to your server. To your users it looks as if the service ran directly on the proxy. In the dataforest cloud a Seed takes this role, protected by the DDoS protection at our network edge.

Put a proxy in front or move the server?

Both ways lead to the same DDoS protection, the difference is where your server runs. If it should stay where it is, it gets a Seed as a proxy in front of it. If you are setting up anew anyway, the contract with your current provider is ending, or a change of infrastructure is worth the effort to you, moving to a Seed is the better way: then the protection sits directly on the server's address, without a tunnel and without a detour. There is a guide for each way, for the proxy and for the migration. Both can also be combined: the proxy first, the migration later. The Seed's address stays the same, only the forwarding target changes.

Why does my server's address have to stay secret?

The proxy only protects the traffic that passes through it. If an attacker knows your server's real address, they can attack it directly and bypass the Seed. The safest server is one that has no public address at all. If it has one, it accepts connections only from the Seed, and old DNS records pointing at it disappear. For an address that has been public for a long time, in the end only a new one helps.

Does my server see the real IP address of my users?

Yes. The Seed passes the sender on unchanged, your server replies directly to the user's address, and the reply takes the way back via the Seed. Bans, whitelists and logs keep working as before. The guide describes the setup for which this holds.

Which applications are suitable?

Anything that runs on fixed TCP or UDP ports: game servers such as Minecraft Java, FiveM or DayZ, voice servers such as TeamSpeak 3, VPN servers with WireGuard or OpenVPN, SSH and Remote Desktop. For these applications there are filters that know the respective protocol. For other TCP and UDP services there are generic filters.

Do I need technical knowledge?

Basic Linux knowledge is required: connecting to a server via SSH and running commands. The setup consists of two configuration files and a few commands on the Seed and on your server. Our step-by-step guide explains each of them. With some experience on a Linux server, the setup is well within reach.

What does the proxy cost in total?

You need a Seed and custom filters for its IPv4 address. For the Seed, a small model is enough in most cases, since neither much CPU nor memory is required. The included traffic and the network connection are the more interesting points when choosing. The current prices are shown in the configurator and in the cloud console. Both are billed hourly. If you come to the conclusion that the automatic filtering is sufficient, you can change that at any time.

Is the proxy also suitable for websites?

Technically yes, the proxy forwards HTTP and HTTPS like any other TCP service. The DDoS protection filters on layers 3 and 4, that is network and transport layer. It does not detect attacks consisting of many valid HTTP requests (layer 7). For websites, a reverse proxy with a web application firewall is therefore the more fitting addition.

How much latency is added?

The traffic takes the route via the Seed. If your server is in a German data center, that is usually a few milliseconds. For a home server it depends on your connection. The forwarding itself costs hardly measurable time.

How is traffic billed?

As with every Seed, only outgoing traffic counts. For the proxy that is the replies to your users and the forwarded traffic to your server. Every Seed comes with a traffic allowance, additional usage is billed per terabyte. Game servers and voice servers usually stay well below it.

Can one Seed protect several servers?

Yes. Each service gets an entry among the protected applications and a forwarding rule on the Seed. Behind one Seed, Minecraft, TeamSpeak and a Valheim server can run on three different servers. Each port is assigned once per address; for two services on the same port you can book an additional IPv4 address for the Seed and transfer the configuration to it. The protected servers may be Seeds as well: instead of booking custom filters for every address, one Seed as a proxy with a single set of filters is enough. Depending on the use case, that can reduce your team's costs.

What happens if the Seed fails?

Then your service is unreachable until the Seed is running again, because it is the only public address. A reboot of the Seed or your server restores the connection automatically. A snapshot of the Seed preserves the configuration so you can set up the proxy again at any time.

Our cloud newsletter

Stay up to date and get valuable tips by subscribing to our newsletter.

Any questions?

Our experts are happy to help. You'll be surprised how fast we are.

Visit FAQsContact an expert