Configure a custom protection profile

Custom protection profiles define rules and policies based on network traffic and security requirements.

Step 1. Open protection profiles

Complete the following steps to view the current protection profiles.

1. In the Gcore Customer Portal, navigate to DDoS Protection > Protection profiles.
2. Review the list of available profiles, shown with their assigned networks and template.

Step 2. Create a protection profile

Complete the following steps to create a new protection profile from a template.

1. Click Add protection profile.
2. Select a template.
   Templates include preconfigured settings for common use cases.
3. Enter a profile name.
   Use a clear and descriptive name for easier identification.

Example: High-security web server profile

Step 3. Configure rules and policies

A protection profile has two connected configuration areas: rules on the Rules tab match traffic and choose which policy to apply, while the Policy tab sets shared thresholds, including rate limits and the GEOIP list, that some of those policies reference.

Configure rules

Rules define traffic-matching criteria and apply a selected policy to matching traffic. Selecting the Basic template pre-populates four default rules that match TCP, UDP, ICMP, and other traffic to the corresponding default policy; add more rules to layer specific protections on top of these defaults. Policy IDs and what each policy does are in the Policy reference.

Add a rule

Add a rule to match specific traffic and apply a policy to it.

1. Click Add rule.
2. Complete the required fields:
   • Protocol: Select the protocol (TCP, UDP, ICMP, or other).
   • Source IP: Enter a source IP address or range.
   • Destination IP: Enter a destination IP address or range.
   • Source port: Enter a port number or range.
   • Destination port: Enter a port number or range.
   • Policy: Select the policy to apply.

Rules are processed from top to bottom, and the first matching rule is applied. Because the Basic template’s catch-all TCP, UDP, ICMP, and other rules match broad traffic patterns, a new rule for specific traffic must sit above the corresponding catch-all rule, or the catch-all matches first and the specific rule never runs. Traffic that matches none of the rules in the profile is dropped.

To change the rule priority, drag the rule up or down.

3. Click Save.

Multiple rules can be added to a protection profile.

Example: match TCP traffic on destination port 80 (HTTP) and apply the tcp-server policy.

Configure policies

The Policy tab sets profile-level rate limits and the GEOIP list. Available fields depend on the selected template.

For the Basic template, the Policy tab includes the following fields. Limits are in kilo packets per second (kpps).

• GEOIP list: countries the geo policy allows or denies.
• Rate limiter low: destination PPS cap for all traffic, up to 50 kpps. Default: 50.
• Rate limiter medium: destination PPS cap for all traffic, up to 150 kpps. Default: 150.
• Rate limiter high: destination PPS cap for all traffic, up to 300 kpps. Default: 300.
• Rate limiter geo: destination PPS cap for Geo Restriction matched traffic, up to 300 kpps. Default: 300.

Set the GEOIP list and rate-limiter thresholds on the Policy tab before selecting the geo or rate-limiter policies in a rule.

To let trusted traffic bypass inspection, add a rule on the Rules tab with the allowlist policy applied to the trusted source IP range. On Enterprise plans, matching traffic bypasses inspection entirely; on public plans, it remains subject to filtering.

Save the profile

Complete the following steps to save the configured profile.

1. Review the configured rules and policies.
2. Click Add protection profile.

The new profile appears in the profile list from Step 1, with its assigned template and name, confirming the save succeeded.

Policy reference

Select a policy ID that matches the traffic when adding a rule. Game policies inspect that game’s protocol. Default and rate-limiter policies cap generic floods. TCP policies run handshake or session countermeasures.

Policy ID	Policy name	Description
minecraft	Minecraft Protection	Minecraft Java and Bedrock (TCP/UDP): handshake, login, ping, and volumetric floods
counter-strike-16	Counter-Strike 1.6	GoldSrc engine (Half-Life 1): UDP floods, query abuse, and malformed packets
counter-strike-go	Counter-Strike GO	Source engine: Steam A2S query floods, connection floods, and high-PPS UDP
counter-strike-2	Counter-Strike 2	UDP floods, query abuse, and abnormal packets
left-4-dead-2	Left 4 Dead 2	Source engine: Steam A2S query floods and volumetric UDP
fivem-tcp	FiveM TCP	TCP connection and handshake floods
fivem-udp	FiveM UDP	High-PPS UDP floods and abnormal packets
samp	San Andreas Multiplayer	SA-MP connection floods, query abuse, and malformed UDP
rust	Rust Game Protection	UDP floods, connection spikes, and abnormal packets
team-speak3	TeamSpeak 3 Voice Chat	UDP floods and connection abuse on voice sessions
rust-a2s	Rust Game A2S Caching	Caches Steam A2S query responses
bf2-query	Battlefield 2 Query Caching	Caches server-browser query responses
bf2	Battlefield 2 Game	UDP floods and malformed packets on gameplay traffic
unity-unet	Unity Engine UNET	Malformed packets and high-PPS floods
unity-utp	Unity Engine UTP	UDP floods on Unity Transport Protocol
geo	Geo Restriction	Allow or deny by client location. Configure on the Policy tab first
ssh-server	SSH Server	SSH connection floods
default-tcp	Default TCP	Generic TCP. Per-IP 20k pps / 50 Mbps; overall 50k pps / 500 Mbps
default-udp	Default UDP	Generic UDP. Per-IP 5k pps / 5 Mbps; overall 50k pps / 50 Mbps
default-icmp	Default ICMP	Generic ICMP. Per-IP 100 pps; overall 1k pps
default-other	Default Other	Other protocols. Per-IP 200 pps; overall 1k pps
ratelimiter-low	Rate Limiter Low	Caps destination rate up to 50 kpps (default 50). Configure on the Policy tab first
ratelimiter-medium	Rate Limiter Medium	Caps destination rate up to 150 kpps (default 150). Configure on the Policy tab first
ratelimiter-high	Rate Limiter High	Caps destination rate up to 300 kpps (default 300). Configure on the Policy tab first
allowlist	Allow List	Matching traffic is forwarded without inspection
tcp-autodetect	TCP auto-detect	Passive TCP countermeasure, triggered only during an attack
tcp-server	TCP Countermeasure	Always-on SYN-cookie challenge for incoming TCP
tcp-server-v2	TCP Flow Track	Experimental full-session tracking when SYN-cookie fails for an application
tcp-private	TCP Ephemeral Ports Protection	Protects ephemeral (client source) TCP ports

Best practices

Keep the following in mind when building and maintaining protection profiles.

• Start with simple rules and expand them as needed.
• Apply a new profile to a non-critical network first, then check the events log before using it on production prefixes.
• Document rules and policies for future maintenance.
• Review and update profiles regularly based on traffic patterns.

Once the profile is saved, continue with applying the profile to a protected network.