Path Panel DDoS Protection Management Panel User Guide
Complete REXE Path Panel user guide: Dashboard, My IPs, TR protection status, rule management, attack history, abuse filtered, password change and API access.
15 min
path.netddosfirewall
Back to Category
Application and Service DDoS Filter Guide (Path.net)
Path.net DDoS protection application filters guide: OpenVPN, Wireguard, DTLS, RTP, QUIC, SIP, TCP Symmetric and more — how to choose the right filter.
Read time: 7 min DDoS Protection & Security
ddosfiltervpnopenvpnwireguardtcppath.net
- Author
- REXE Teknoloji Network & Security Team
- Editor
- REXE Teknoloji Technical Editorial
- First published
- Last updated
Introduction
REXE Technology offers application-specific DDoS filters through the Path.net infrastructure, covering game servers as well as VPN servers, media services, web applications, and other TCP/UDP-based services.
Application filters can be selected from the "Filter" field when creating rules in the Path Panel. Available filters may vary depending on the permissions assigned to your account.
VPN Filters
Specialized DDoS filters for VPN servers:
OpenVPN UDP Server
| Property | Value |
|---|---|
| Protocol | UDP |
| Default Port | 1194 |
| Use Case | OpenVPN server protection |
The OpenVPN filter validates OpenVPN protocol-specific handshake and data packets, blocking spoofed UDP packets. It ensures your VPN server runs without interruption.
hljs yaml
# Example rule configuration (Path Panel — x.rexe.tr)
Protocol: UDP
Destination Port: 1194
Filter: OpenVPN UDP Server
Description: "OpenVPN server protection"
Wireguard Server
| Property | Value |
|---|---|
| Protocol | UDP |
| Default Port | 51820 |
| Use Case | Wireguard VPN server protection |
The Wireguard filter validates the Wireguard protocol's cryptographic handshake mechanism, blocking spoofed packets.
hljs yaml
# Example rule configuration (Path Panel — x.rexe.tr)
Protocol: UDP
Destination Port: 51820
Filter: Wireguard Server
Description: "Wireguard VPN protection"
If your VPN server uses a custom port, change the Destination Port field accordingly.
Other Application Filters
DTLS Server
| Property | Value |
|---|---|
| Protocol | UDP |
| Use Case | DTLS (Datagram Transport Layer Security) server protection |
The DTLS filter is designed for WebRTC, IoT devices, and applications using secure UDP communication.
RTP Server
| Property | Value |
|---|---|
| Protocol | UDP |
| Use Case | Real-time Transport Protocol server protection |
The RTP filter is optimized for VoIP, video conferencing, and media streaming applications. It protects real-time media traffic while blocking spoofed RTP packets.
STUN Server
| Property | Value |
|---|---|
| Protocol | UDP |
| Default Port | 3478 |
| Use Case | STUN (Session Traversal Utilities for NAT) server protection |
The STUN filter protects STUN servers used for NAT traversal and WebRTC connections.
QUIC Server
| Property | Value |
|---|---|
| Protocol | UDP |
| Default Port | 443 |
| Use Case | QUIC protocol server protection |
The QUIC filter protects the QUIC protocol used by HTTP/3 and modern web applications. It supports QUIC connections from Google Chrome and other modern browsers.
SIP Server
| Property | Value |
|---|---|
| Protocol | UDP |
| Default Port | 5060 |
| Use Case | SIP (Session Initiation Protocol) server protection |
The SIP filter is designed for VoIP phone systems and SIP trunks. It provides protection against SIP INVITE flood and registration attacks.
TCP Service
| Property | Value |
|---|---|
| Protocol | TCP |
| Use Case | General TCP service protection |
The TCP Service filter provides general protection for web servers, databases, and other TCP-based services. It is effective against SYN flood, ACK flood, and other TCP attack vectors. Standard (normal) filters do highly successful filtering without false positives.
TCP Service (Symmetric)
| Property | Value |
|---|---|
| Protocol | TCP |
| Use Case | Symmetric TCP service protection |
TCP Service (Symmetric) is one of the Layer7 filters that can be selected as a hard filter. On symmetric traffic paths it tracks connection state and blocks spoofed packets. Note that state tracking is not exclusive to this filter — every filter, including standard filter mode, tracks connection state.
The rule creation screen has two modes: standard filter (you enter only protocol and port) and hard filter (you pick one of the game or application filters). Both operate at Layer7 and track connection state. The only difference with a hard filter is that application-specific packets are inspected from the application's first connection onward; standard filters are roughly 99.99% effective, so a hard filter is rarely needed.
Filter Selection Guide
If you're not sure which filter to use, refer to the table below:
| Use Case | Recommended Filter |
|---|---|
| VPN Server (OpenVPN) | OpenVPN UDP Server |
| VPN Server (Wireguard) | Wireguard Server |
| Web Server (HTTP/HTTPS) | Standard filter (TCP + port) |
| SSH/RDP Management | Standard filter (TCP + port) |
| VoIP / Phone System | SIP Server + RTP Server |
| Video Conferencing | DTLS Server + RTP Server |
| Modern Web (HTTP/3) | Standard filter (UDP + port) |
| Game Server | Relevant game filter |
Web Server (HTTP/HTTPS) Configuration
For web servers the standard filter mode (protocol + port) is enough. Standard filters operate at Layer7, track connection state and are roughly 99.99% effective without false positives. A hard filter is only needed when application-specific packet inspection is required.
Websites using Cloudflare: If your website is behind Cloudflare, TCP Symmetric filter cannot be used on ports 80 and 443. Cloudflare uses asymmetric routing, so symmetric filtering does not work on these ports. Instead, use the ready-made Cloudflare preset rule in the Path Panel.
Cloudflare and non-Cloudflare configurations cannot be combined on the same IP. Either all your web traffic goes through Cloudflare and you use the Cloudflare preset rule, or you do not use Cloudflare and apply the standard filter (TCP + port). Both cannot be used simultaneously.
If running multiple services, create separate rules with appropriate filters for each service. This way each service gets protection optimized for its own protocol.
Frequently Asked Questions
Which filter should I choose?
Choose the most appropriate filter based on the protocol your service uses. Every filter operates at Layer7 and tracks connection state; if unsure, the standard filter (protocol + port) is enough for TCP services. A hard filter is chosen when application-specific packet inspection is required. For UDP services you can use the general UDP filter.
Can multiple filters be applied to the same port?
No, only one filter is selected per rule. Different filters should be applied to different ports.
Can I request a filter for a custom application?
Yes, you can contact our support team to request a custom filter.
Frequently Asked Questions
Which filter should I use for my VPN server?
Use 'OpenVPN UDP Server' for OpenVPN, or 'Wireguard Server' for Wireguard.
What does the TCP Symmetric filter do?
The TCP Symmetric filter is a hard filter that performs Layer7 filtering. It tracks connection state, ensuring only responses to connections initiated by the user are allowed — blocking spoofed packets. It should only be enabled for highly sensitive applications; for standard services like SSH and RDP, protocol + port (standard filter) is enough.
My website uses Cloudflare, which filter should I use?
For websites behind Cloudflare, TCP Symmetric filter cannot be used on ports 80 and 443 because Cloudflare uses asymmetric routing. Instead, use the ready-made Cloudflare preset rule in the Path Panel.
Related Articles
Game Server DDoS Filter Selection Guide (Path.net)
Path.net DDoS protection game filters guide: Arma/DayZ, Source Engine, CS:GO, CS2, FiveM, Minecraft, Rust and more — how to apply each filter.
8 min
ddosfiltergames
Does REXE Apply Null Route? DDoS Protection Policy
REXE Technology and Path.net null route policy: With 12 Tbps capacity, your server stays protected regardless of attack size — no null routing ever applied.
5 min
null-routeddosprotection
Network TrafficInbound— GbpsOutbound— Gbps