Appearance

On Premise Shield - Features ​

We built the On Premise Shield on three principles:

  • never allow traffic that is clearly invalid,
  • work as expected in any routing scenario,
  • treat even a few packets per second as a threat worth stopping.

It does all of this while staying customizable, API-first, and scalable enough to drop very large packet volumes.

Our core filtering guarantees that:

  • no invalid L3/L4 packet gets through (RFC compliance and similar checks),
  • no state-invalid packet passes, as far as your setup physically allows us to track state.

On top of that, we apply different mechanisms to different kinds of incoming traffic.

Profile System ​

Profiles classify legitimate traffic per destination port and IP. Profile Presets bundle one classification so you can apply it across many Profiles at once, meaning many IP and port pairs.

This lets you classify traffic by application and apply application-specific filters dynamically and at scale.

Each Profile gives you:

  • several matching algorithms you can enable separately,
  • pre-built, application-specific L7 protocol enforcement,
  • IP lists to whitelist, blacklist, or trust an IP range at scale,
  • per-connection and per-source limits,
  • automatic scanning to detect where a Profile Preset should apply.

TCP Mitigation ​

Our first rule is to never disrupt an ongoing TCP connection. State-invalid packets are dropped, and only in-session packets pass the filter.

SYN packets can go through CRA verification (Challenge-Response Authentication). In symmetric routing we use a SYN-proxy-style approach that scales even across distant regions; otherwise we verify on a reconnect basis after the first connection. In-session packets are then checked against RFC-compliance algorithms to confirm they belong to the session.

Other CRA-based algorithms ​

For many L7 and UDP-based protocols, we use CRA to reject spoofed or incapable sources.

This includes (ask support for the current list):

  • RakNet Connect
  • any A2S query
  • TeamSpeak 3
  • GoldSource / Source Engine

Other advanced algorithms ​

We also validate how packets are transmitted, watch for known anomalies, apply rate limits, and use connection information gathered from symmetric routing. Together with the techniques above, these let the On Premise Shield's filtering go beyond what filtering usually achieves.