Skip to content
UMBREN

DDoS Protection

Attacks are filtered upstream. Legitimate traffic reaches your origin.

UMBREN protects UDP and TCP services at the transport layer. A protected address sits in front of infrastructure you already run. Mitigation policy decides what is dropped there and what is forwarded to your server.

Get ProtectedRead the documentation

What UMBREN protects against

Transport-layer attacks on UDP and TCP services

These are the attack classes the mitigation policy is built around. Each one maps to a component you can configure, observe in monitor mode and roll back.

Volumetric UDP floods

High-rate UDP traffic sent to exhaust bandwidth or packet processing. Flood Guard compares bandwidth and packet rate with a learned baseline and with the absolute ceilings you set.

Reflection and amplification

Responses from third-party services, triggered with a spoofed source address. Packet Guard drops traffic from source ports commonly abused for reflection. The default list is 19, 53, 123, 1900 and 11211.

TCP SYN floods

Connection attempts that are never completed, sent to exhaust state on the target. Flood Guard detects SYN-rate anomalies and applies the SYN rate limit set in your policy.

Protocol abuse

Traffic that passes packet validation but does not behave like the service it targets. Protocol Guard applies a profile to the endpoint and can limit how often one source starts a handshake.

Malformed packets

Packets that fail validation, fall outside the size bounds you define, or arrive as fragments you have chosen not to accept. Packet Guard drops them by policy.

Scope: one address, defined ports

An endpoint is a single origin address, UDP or TCP, on a port or port range. UMBREN defends the address your service is reached on. It does not replace the service.

How mitigation is structured

Six components, one mitigation policy

One versioned policy configures all six components. Each component covers one part of the problem and exposes a small number of settings. Unknown settings are rejected, not ignored.

Packet Guard

Packet validation

Validates packets against the policy. Packets that are malformed, outside the size bounds you set, or sent from source ports commonly abused for reflection are dropped.

drop_malformed
Drop packets that fail validation. Boolean. Default true.
drop_fragments
Drop fragmented packets. Boolean. Default false.
min_packet_bytes
Smallest packet accepted, in bytes. Integer. Default 0.
max_packet_bytes
Largest packet accepted, in bytes. Integer. Default 1500.
blocked_source_ports
Source ports whose traffic is dropped. The defaults are ports commonly abused for reflection. List of ports. Default 19, 53, 123, 1900, 11211.

Flood Guard

Flood and rate anomaly detection

Detects UDP floods, TCP SYN floods and bandwidth or packet-rate anomalies. Traffic is compared with a learned baseline and with the absolute ceilings you set.

pps_threshold
Absolute packet-rate ceiling, in packets per second. Integer. 0 turns it off.
bps_threshold
Absolute bandwidth ceiling. Integer. 0 turns it off.
baseline_multiplier
Flags traffic above this multiple of the learned baseline. Number. Default 4.
sustain_seconds
How long an anomaly must persist before it counts. Integer. Default 60.
udp_rate_limit_pps
Rate limit for UDP traffic, in packets per second. Integer.
syn_rate_limit_pps
Rate limit for TCP SYN packets, in packets per second. Integer.

Flow Guard

Session-aware analysis

Tracks flows per source. Established flows are protected while limits apply to how quickly a source may open new flows and how many it may hold open.

protect_established_flows
Protect flows that are already established while limits are applied to new ones. Boolean. Default true.
max_new_flows_per_source_per_second
New flows one source may open per second. Integer. Default 50.
max_concurrent_flows_per_source
Flows one source may hold open at once. Integer. Default 500.
idle_timeout_seconds
How long a flow may stay idle before it is no longer treated as established. Integer. Default 180.

Protocol Guard

Protocol-aware profiles

Applies a protocol profile to the endpoint: generic UDP, generic TCP or WireGuard-compatible. Game-specific profiles are planned and are not available yet.

profile
The protocol profile applied to the endpoint. generic_udp, generic_tcp or wireguard.
enforce_handshake
Enforce the handshake behaviour the profile describes. Boolean. Default false.
max_handshakes_per_source_per_minute
Handshakes one source may start per minute. Integer. Default 60.

Adaptive Defense

Baselines and escalation

Learns a traffic baseline, scores deviations from it, and selects and escalates the response. You set how sensitive it is and how far it may go on its own.

baseline_window_minutes
Window over which the traffic baseline is learned. Integer. Default 60.
sensitivity
How readily a deviation from the baseline is scored as an anomaly. low, medium or high.
max_escalation_level
Caps the automatic response. It does not cap the severity that is reported. 1 to 3. Default 2.
auto_escalate
Allow the response to escalate automatically, up to the cap. Boolean.

Recovery Guard

Expiry and rollback

Brings mitigation to an end. Automatically applied rules expire, incidents resolve only after traffic has stayed normal, and a failed health check rolls mitigation back.

rule_ttl_minutes
Lifetime of automatically applied rules. They expire when it elapses. Integer. Default 30.
quiet_period_minutes
How long traffic must stay normal before an incident resolves. Integer. Default 10.
rollback_on_health_failure
Roll mitigation back if a health check fails. Boolean. Default true.

Policy reference in the documentation

Monitor and enforce

See what a policy would do before it can drop a packet

Every policy has a mode. The mode decides whether the policy is only observed or can be deployed. Automatic mitigation is a separate decision, and it is yours to make.

A reasonable way to introduce a policy: run it in monitor mode across a period that includes your busiest traffic, read what it recorded, adjust it, and only then move it to enforce.

Monitor

Never deployed

The policy is evaluated and its decisions are recorded. Nothing is deployed to the protection network, so nothing about your traffic changes.

Enforce

Eligible for deployment

The policy becomes eligible for deployment to the protection network. Like every policy change, moving to enforce creates a new version, so the step is recorded and can be reversed.

Automatic mitigation

Opt-in

Automatic mitigation is switched on per policy. It is off until you turn it on, and it requires enforce mode. A policy in monitor mode cannot mitigate automatically.

Versioned policies and rollback

Every change is recorded. Any version can be restored.

Policy is the part of the system that decides what happens to your traffic. It is handled the way configuration for critical systems should be: explicit, versioned and reversible.

Immutable versions

Policies are never edited in place. Every change creates a new version, and a version does not change once it exists.

Rollback moves forward

Rolling back restores an earlier version as a new version. History is added to, never rewritten.

Strict configuration

Unknown configuration fields are rejected. A misspelled setting is an error you see, not a rule that quietly never applies.

Two scopes

A policy applies to one endpoint or to the whole organization, so a default and an exception can both be stated plainly.

Recovery Guard

Rules applied automatically also expire automatically

Mitigation that outlives an attack becomes a problem of its own. Recovery Guard gives every automatically applied rule a lifetime and defines when an incident is over.

The values shown are the defaults. Each one is a policy setting you can change, and each change is a new policy version.

  1. An anomaly has to persist

    Flood Guard flags traffic above a multiple of the learned baseline, 4 by default, or above the absolute ceilings you set. The anomaly must last for sustain_seconds, 60 by default, before it counts.

  2. The automatic response is capped

    max_escalation_level runs from 1 to 3 and defaults to 2. It caps what Adaptive Defense may do on its own. It does not cap the severity that is reported to you.

  3. Rules carry an expiry

    Automatically applied rules expire after rule_ttl_minutes, 30 by default.

  4. Incidents resolve after a quiet period

    Traffic must stay normal for quiet_period_minutes, 10 by default, before an incident is resolved.

  5. A failed health check rolls mitigation back

    rollback_on_health_failure is on by default. If a health check fails, mitigation is rolled back.

Bring your infrastructure under protection

Create an account, register an endpoint and verify ownership. Protection is activated only after every check has passed and you have authorized the change.

Get ProtectedTalk to us