On Premise Shield
The On Premise Shield is on-premise DDoS protection: rented XDP filtering software that runs on your own hardware and filters attacks in-line, with high accuracy.
It stops attacks without harming legitimate traffic, and its built-in debugging and monitoring tools, paired with our small, fast-moving team, mean new features and fixes ship quickly.
Our filtering works on one principle: only let legitimate traffic through, rather than chasing specific attack patterns. That approach gives you predictable protection with near-zero time-to-mitigation (TTM). See Features for how the filtering works.
Not every network can give us all the traffic data this approach needs, so the Shield is highly configurable. You can run it in symmetric or asymmetric routing, and always in-line or only on demand (for example, switched on by the Out Of Line Shield when it detects an attack), to get the best protection for your specific setup.
Target Groups
This product is built for businesses and enterprises, not consumers.
Two plans cover both large owned networks (with best-practice or custom setups) and game hosts who want extra protection on existing machines:
- Business Plan — our XDP filtering software runs on your hardware, alongside your own applications. The Linux kernel handles routing, so you adjust your network configuration yourself.
- Enterprise Plan — you provide one or more dedicated filtering machines that run our XDP software. We receive and send traffic over dedicated VLANs, which you configure in your routers.
Pricing and Sales Timeline
We know timing and pricing matter, and both depend on your needs.
When you contact our sales team, tell us how urgent your deployment is and we will move as fast as we can.
The On Premise Shield starts at around €600/month for the Business Plan and around €1000/month for the Enterprise Plan. Pricing is based on your 95th-percentile traffic and the number of nodes.
From your first "Hi!" to running in production, the process looks like this:
- You reach out to our sales team, who answer your setup and feature questions and prepare a quote.
- Once you agree on the quote, our engineering team guides the setup over chat or scheduled calls.
- After the software is set up (partly automated, partly with our engineers and support team), engineering reviews the deployment one last time to confirm it is production-ready.
- You test it on a few prefixes or a small share of production traffic, then move to full production.
Hardware Requirements
An On Premise deployment needs at least one management node plus one or more filter (scrubbing) nodes. Some features, such as out-of-line filtering and service discovery, need extra machines.
Every machine in the deployment needs:
- an x86-64 CPU,
- an internet connection,
- a Debian-based operating system (for a new machine, install Debian),
- a TPM 2.0 module (recommended).
Filter nodes must run on bare metal. All other nodes can run in a virtual machine, such as KVM.
TIP
Our team is happy to help with hardware choices and can guide you to the best fit for your use case.
Filter Nodes
Filtering can run on existing machines or on empty ones. Business Plan setups usually use existing machines and Enterprise Plan setups use empty ones, though an empty machine also works for the Business Plan.
On either plan, filter nodes also need:
- a NIC driver that supports XDP native mode,
- 48 GB of total RAM, with at least 20 GB available for the XDP filtering software,
- kernel 6.12.x or 6.18.x (LTS),
- a CPU in the class of the AMD Ryzen 9 9950X (recommended).
Pick the fastest RAM you can, since filtering performance depends heavily on RAM speed.
Other Nodes
Management, service discovery and out-of-line filtering nodes also need:
- 8 GB of total RAM, with at least 6 GB available,
- kernel 6.0 or newer (an LTS kernel is preferred).