Open the DDoS Mitigation page in my.cubepath.com.

CubePath DDoS Mitigation is always-on protection for your IPs. Inbound traffic is continuously inspected and scrubbed at the network edge, so malicious floods are dropped before they reach your services — no manual trigger needed.

Why this and not a host firewall

A firewall group filters packets at your machine. By the time a volumetric flood arrives there, the bandwidth is already consumed — the machine drops the packets correctly and the link is saturated anyway.

Edge mitigation drops attack traffic before it reaches your port, which is the only place it can actually be stopped. The two are complementary: the edge handles floods, the host firewall handles who's allowed to talk to which service.

Protected IPs

The page lists every IP covered by Premium DDoS protection, split into two tabs:

  • Single IPs — a table with the IP Address, Type (IPv4/IPv6), Location, Profile status and Firewall Rules count.
  • Subnets — each range shown as a card with its prefix, total IPs and protection type. Use Show IPs to expand and manage the individual addresses inside.

The Profile column tells you whether an IP runs a custom setup (Configured) or the platform baseline (Default). Both are protected — Default simply means you haven't customized anything yet.

Protection profiles

Edit Protection Profile tunes the mitigation for an IP:

  • TCP Validation verifies that a connection attempt comes from a real stack rather than a spoofed source. It's the core defence against SYN floods, where the whole attack depends on never completing a handshake.
  • Geo and ASN filtering narrows who can reach the address at all. If you only serve one country, or you know an attack is arriving from one network, this cuts it off at the edge.
  • Prefix List Mode applies your prefix lists as a blacklist (drop the listed networks) or a whitelist (allow only them).

Edge firewall rules

View Firewall Rules defines rules by Protocol, Port and Action Profile, applied at the edge on top of the automatic mitigation.

The action is where this differs from a normal firewall:

ActionWhat it does
AcceptAllow the traffic
DiscardSilently drop it
Rate limitCap the traffic rate rather than blocking it outright

Rate limiting is the useful middle ground for protocols you need but that get abused. Two examples worth copying:

  • Drop ICMP you don't need — protocol ICMP, action discard.
  • Rate-limit UDP on port 53 if you run DNS, so a reflection attack can't saturate the link while legitimate queries still resolve.

Good practice

  • Close everything you don't serve. Every open port is attack surface; a rule set that mirrors your actual services is the cheapest protection there is.
  • Prefer specific sources to 0.0.0.0/0 wherever the service allows it.
  • Watch and adjust rate limits. Set too low they break real users; set too high they don't help. Check them against real traffic in Traffic Capture rather than guessing.
  • Prefix Lists — reusable allow/block lists of IPs and CIDRs you apply across your protection.
  • Traffic Capture — real packet logs hitting your protected IPs, with offending IPs addable straight to a prefix list.
  • DDoS Attacks — the history of what was detected and mitigated.