Overview

Edge Proxy protects applications from DDoS attacks by routing traffic through the Gcore CDN edge network.

Protection is typically active within minutes, without deploying additional infrastructure or configuring complex networking.

Traffic flow

Edge Proxy uses the CDN edge network to receive and filter incoming traffic before forwarding it to the origin server.

Incoming traffic is routed through Anycast IP addresses to the nearest Point of Presence, where DDoS filtering runs at the edge. Clean traffic is forwarded to the origin server. Each protected application receives a dedicated IP address and port that clients connect to instead of the origin directly.

Edge Proxy suits game servers, APIs, backend services, and any TCP or UDP application that requires DDoS protection:

• High availability — traffic distributed across multiple PoPs removes regional bottlenecks and enables multi-terabit filtering capacity.
• Lower latency — processing at the nearest PoP reduces round-trip time and improves responsiveness.
• Simple setup — configured in a few steps without managing virtual machines or networking components.
• Efficient IP usage — multiple services share the same Anycast infrastructure, reducing the need for dedicated public IP addresses.
• Flexible configuration — multiple applications and ports can be protected behind a single protected IP address.

Core concepts

Term	Description
Origin server	The backend server that receives filtered traffic.
Protected IP	A public IP and port assigned by Gcore; clients connect here instead of to the origin.
Translation rule	Maps one origin IP, port, protocol, and application type to one protected endpoint.
Application type	A predefined countermeasure profile optimized for a specific application.

Once configured, Edge Proxy assigns a protected IP and port, starts filtering traffic immediately, and exposes traffic metrics in Traffic Overview.