About DDoS Protection

Gcore DDoS Protection offers free Basic and paid Advanced modes, comparing detection speed, traffic coverage, attack types, and pricing.

Gcore DDoS Protection safeguards networks, servers, and instances against distributed denial-of-service (DDoS) attacks. Two protection modes are available: Basic (free, enabled by default) and Advanced (paid, always-on filtering via a Threat Mitigation System (TMS)).

This article covers Basic protection for Gcore-hosted resources and Advanced protection for customer networks onboarded through Generic Routing Encapsulation (GRE). Basic protection is applied automatically to all Gcore-hosted resources with no enrollment required. Advanced protection is a paid service activated through the GRE-based onboarding flow.

Bare Metal servers and dedicated servers are not covered here; they use separate procedures with different specifications and pricing:

• Advanced DDoS Protection for Bare Metal servers
• DDoS protection for dedicated servers

Protection modes

The two modes differ in detection speed, traffic coverage, and cost.

Feature	Advanced protection	Basic protection
Pricing model	Paid	Free
Attack detection time	Under 1 second	3 minutes
Attacks it protects from	Common amplification attacks, IP spoofing attacks, volumetric attacks (L3), connection attacks (L4), application-layer attacks (L7)	Common amplification attacks, IP spoofing attacks
Protection technology	1. All network traffic passes through TMS. 2. In case of an attack, TMS immediately filters the traffic. 3. TMS forwards legitimate traffic to the protected network.	1. Attack is detected. 2. The attacked IP is null-routed for 12 hours.
Best for	Networks attacked frequently, networks hosting services that require continuous availability, or use cases where application-layer (L7) attacks are a concern	Networks rarely attacked, or where short-term unavailability during an attack is acceptable

Detection times apply to network protection. Advanced DDoS Protection for Bare Metal servers and dedicated servers detects attacks within 5 seconds.

Basic protection

Basic protection is applied automatically to all Gcore-hosted resources. No additional enrollment or network submission is required.

Access control list (ACL) rules

Basic protection uses predefined ACL rules to block the following traffic types:

• Reflection attacks: DNS, NTP, SSDP, MSSQL, LDAP, SNMP, CharGen, Memcache, Echo, RIP, ARMS
• Fake source IP attacks: 0.0.0.0/32, 127.0.0.0/8, 192.0.2.0/24, 224.0.0.0/3, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

Volumetric filtering on Basic protection does not apply to floods below 200 Mbit/s per destination IP.

To customize ACL rules, upgrade to Advanced protection.

Null-routing

When Basic protection detects a DDoS attack, the system temporarily blocks the targeted IP address. This mechanism is known as null-routing: the targeted IP address is protected from attack traffic but becomes unreachable from the internet for 12 hours.

To keep the service available during an attack, upgrade to Advanced protection.

Advanced protection

Advanced protection keeps the TMS active at all times, including when no attack is underway, so filtering starts the moment traffic turns malicious instead of only after an attack begins.

Activate Advanced protection in the Gcore Customer Portal using the self-service setup flow. Start with service activation, which covers plan activation, network submission, Network Operations Center (NOC) review, and network configuration.

Allowlists

IP addresses added to an allowlist are treated as trusted resources. For Enterprise customers, allowlisted IPs bypass DDoS Protection analysis entirely and are not inspected by TMS. For customers on public plans, allowlisted IPs remain subject to DDoS traffic filtering.

DDoS attack statistics

Traffic Analytics in the Gcore Customer Portal shows live traffic on resources with Advanced DDoS Protection. The Clean (P95) value shows the 95th percentile of clean traffic volume, which is used for Advanced protection billing.

For filters, summary cards, and Advanced Analytics, see Traffic Analytics. For the measurement period and billing rules, see Plan activation.

Pricing

Advanced network protection pricing depends on the plan tier and the data center location.

• Plan tier. Plan activation lists the available tiers — pay as you go (PAYG), Start, Pro, and Pro+ — based on the clean traffic volume and number of network prefixes to protect.
• Data center location. Prices vary by data center. Contact the Gcore sales team for pricing at a specific location.

Every tier covers L3–L7 attacks by default. For custom configurations, contact the Gcore sales team to request a tailored plan.

For Bare Metal and dedicated server protection, pricing depends on the data center location, the traffic capacity, and the protected OSI layers. See Advanced DDoS Protection for Bare Metal and DDoS protection for dedicated servers for details.