Application and Service DDoS Filter Guide (Path.net)

Introduction

REXE Technology offers application-specific DDoS filters through the Path.net infrastructure, covering game servers as well as VPN servers, media services, web applications, and other TCP/UDP-based services.

Application filters can be selected from the "Filter" field when creating rules in the Path Panel. Available filters may vary depending on the permissions assigned to your account.

VPN Filters

Specialized DDoS filters for VPN servers:

OpenVPN UDP Server

Property	Value
Protocol	UDP
Default Port	1194
Use Case	OpenVPN server protection

The OpenVPN filter validates OpenVPN protocol-specific handshake and data packets, blocking spoofed UDP packets. It ensures your VPN server runs without interruption.

hljs yaml

# Example rule configuration (Path Panel — x.rexe.tr)
Protocol: UDP
Destination Port: 1194
Filter: OpenVPN UDP Server
Description: "OpenVPN server protection"

Wireguard Server

Property	Value
Protocol	UDP
Default Port	51820
Use Case	Wireguard VPN server protection

The Wireguard filter validates the Wireguard protocol's cryptographic handshake mechanism, blocking spoofed packets.

hljs yaml

# Example rule configuration (Path Panel — x.rexe.tr)
Protocol: UDP
Destination Port: 51820
Filter: Wireguard Server
Description: "Wireguard VPN protection"

If your VPN server uses a custom port, change the Destination Port field accordingly.

Other Application Filters

DTLS Server

Property	Value
Protocol	UDP
Use Case	DTLS (Datagram Transport Layer Security) server protection

The DTLS filter is designed for WebRTC, IoT devices, and applications using secure UDP communication.

RTP Server

Property	Value
Protocol	UDP
Use Case	Real-time Transport Protocol server protection

The RTP filter is optimized for VoIP, video conferencing, and media streaming applications. It protects real-time media traffic while blocking spoofed RTP packets.

STUN Server

Property	Value
Protocol	UDP
Default Port	3478
Use Case	STUN (Session Traversal Utilities for NAT) server protection

The STUN filter protects STUN servers used for NAT traversal and WebRTC connections.

QUIC Server

Property	Value
Protocol	UDP
Default Port	443
Use Case	QUIC protocol server protection

The QUIC filter protects the QUIC protocol used by HTTP/3 and modern web applications. It supports QUIC connections from Google Chrome and other modern browsers.

SIP Server

Property	Value
Protocol	UDP
Default Port	5060
Use Case	SIP (Session Initiation Protocol) server protection

The SIP filter is designed for VoIP phone systems and SIP trunks. It provides protection against SIP INVITE flood and registration attacks.

TCP Service

Property	Value
Protocol	TCP
Use Case	General TCP service protection

The TCP Service filter provides general protection for web servers, databases, and other TCP-based services. It is effective against SYN flood, ACK flood, and other TCP attack vectors. Standard (normal) filters do highly successful filtering without false positives.

TCP Service (Symmetric)

Property	Value
Protocol	TCP
Use Case	Symmetric TCP service protection

The TCP Symmetric filter is a hard filter that performs Layer7 filtering. It tracks connection state, ensuring only responses to connections initiated by the user are allowed — blocking spoofed packets. Standard (normal) filters do highly successful filtering without false positives.

The rule creation screen has two modes: standard filter (protocol + port only) and hard filter (Layer7 filters like TCP Symmetric). For SSH, RDP, and most TCP services the standard mode is enough; hard filter (Layer7) options like TCP Symmetric should only be enabled for highly sensitive applications.

Filter Selection Guide

If you're not sure which filter to use, refer to the table below:

Use Case	Recommended Filter
VPN Server (OpenVPN)	OpenVPN UDP Server
VPN Server (Wireguard)	Wireguard Server
Web Server (HTTP/HTTPS)	Standard filter (TCP + port)
SSH/RDP Management	Standard filter (TCP + port)
VoIP / Phone System	SIP Server + RTP Server
Video Conferencing	DTLS Server + RTP Server
Modern Web (HTTP/3)	Standard filter (UDP + port)
Game Server	Relevant game filter

Web Server (HTTP/HTTPS) Configuration

For web servers, the standard filter mode (protocol + port) is enough; standard filters do highly successful filtering without false positives. Hard filter (Layer7) options like TCP Symmetric are only needed for highly sensitive applications.

Websites using Cloudflare: If your website is behind Cloudflare, TCP Symmetric filter cannot be used on ports 80 and 443. Cloudflare uses asymmetric routing, so symmetric filtering does not work on these ports. Instead, use the ready-made Cloudflare preset rule in the Path Panel.

Cloudflare and non-Cloudflare configurations cannot be combined on the same IP. Either all your web traffic goes through Cloudflare and you use the Cloudflare preset rule, or you do not use Cloudflare and apply the standard filter (TCP + port). Both cannot be used simultaneously.

If running multiple services, create separate rules with appropriate filters for each service. This way each service gets protection optimized for its own protocol.

Frequently Asked Questions

Which filter should I choose?

Choose the most appropriate filter based on the protocol your service uses. If unsure, for TCP services the standard filter (protocol + port) is enough; hard filter (Layer7) options like TCP Symmetric are only needed for highly sensitive applications. For UDP services you can use the general UDP filter.

Can multiple filters be applied to the same port?

No, only one filter is selected per rule. Different filters should be applied to different ports.

Can I request a filter for a custom application?

Yes, you can contact our support team to request a custom filter.