Path Panel Filter Rules Guide

Path Panel is the filtering system that provides network-level DDoS protection in the REXE infrastructure. It filters traffic before it reaches your server, protecting your server resources while delivering legitimate traffic without interruption.

Access Path Panel at: my.rexe.tr → Path Panel or directly at x.rexe.tr.

How to Create a Filter Rule

Log in to Path Panel
Click on your server IP on the IP Management page
Click the Create New Rule button
Fill in the following fields:

Field	Description
Protocol	TCP or UDP
Destination Port	The port number you want to protect
Filter	Select the appropriate filter for your protocol
Description	A short note describing the rule

Save the rule and wait for it to reach propagated status (2-5 min)

Even if the panel shows the rule as not yet propagated (not updated), the rule has most likely already been deployed within 2-5 minutes. The status may update with a delay due to the panel's status-check interval or the time it takes for the rule to be applied across all nodes on the Path side (except ours). This is only a visual delay in the panel; the port has in fact already been opened in the system.

Selecting the wrong filter may block legitimate traffic. Make sure to choose the filter that matches your service.

Default State and Default Block

When an IP address has no rules at all (not a single rule, including filter rules, ICMP/ping, and presets), all ports are open by default. In this state there is no Default Block.

The moment you create your first rule (even a single one), the system automatically adds a Default Block policy. From that point on, only the ports allowed by your rules stay open; all other ports are closed. When you delete all rules (including ICMP/ping and presets, so that not a single rule remains), Default Block is automatically removed and the IP returns to having all ports open.

You need to create a separate filter rule for each port you want to use.

The moment you create your first rule, Default Block kicks in and disallowed ports are closed. Always include a management port such as SSH (22) or RDP (3389) in your first rule set; otherwise you will lose your connection to the server.

Supported Filters

Game Filters

Game filters work by understanding the packet structure of each game protocol. They allow legitimate player connections while blocking attack traffic.

Filter	Protocol	Default Port	Usage
Arma / DayZ	UDP	2302–2306	Arma 3, DayZ servers
HL2 / Source Engine	UDP	27015	Half-Life 2, TF2, CS:Source
HLDS / GoldSrc	UDP	27015	Half-Life 1, CS 1.6
L4D2 / CS:GO	UDP	27015	CS2, CS:GO, L4D2, Portal
GTA SA-MP / FiveM	UDP	7777 / 30120	SA-MP, FiveM
Source Engine Queries	UDP	27015	All Source Engine games
RakNet	UDP	28015 / 19132	Rust, Minecraft Bedrock
Minecraft Java Edition	TCP	25565	Minecraft Java

For FiveM servers, you need to create separate rules for both TCP and UDP port 30120. TCP 40120 must also be opened for txAdmin.

Application Filters

Filter	Protocol	Default Port	Usage
OpenVPN UDP Server	UDP	1194	OpenVPN server protection
Wireguard Server	UDP	51820	Wireguard VPN protection
DTLS Server	UDP	—	WebRTC, IoT, secure UDP
RTP Server	UDP	—	VoIP, video conferencing, media streaming
STUN Server	UDP	3478	NAT traversal, WebRTC
QUIC Server	UDP	443	HTTP/3, modern web apps
SIP Server	UDP	5060	VoIP phone systems
TCP Service	TCP	—	General TCP service protection
TCP Service (Symmetric)	TCP	—	SSH, RDP and all TCP services

Filter Selection Guide

Use Case	Recommended Filter
SSH access	Standard filter (TCP) — Port 22
RDP access	Standard filter (TCP) — Port 3389
Web server (HTTP/HTTPS)	Standard filter (TCP) — Port 80/443
OpenVPN server	OpenVPN UDP Server — Port 1194
Wireguard server	Wireguard Server — Port 51820
VoIP / Phone system	SIP Server + RTP Server
Video conferencing	DTLS Server + RTP Server
Modern web (HTTP/3)	Standard filter (UDP) — Port 443
CS2 / CS:GO	L4D2 / CS:GO — UDP 27015
FiveM	GTA FiveM — UDP+TCP 30120
Minecraft Java	Minecraft Java Edition — TCP 25565
Minecraft Bedrock	RakNet — UDP 19132
Rust	RakNet — UDP 28015
Garry's Mod	Source Engine Queries — UDP 27015

About TCP Symmetric (Hard / Layer7 Filter)

TCP Symmetric is a hard filter that performs Layer7 filtering. It tracks connection state, ensuring that only responses to connections initiated by the user are allowed through; it blocks spoofed packets and TCP flood attacks.

The rule creation screen has two modes: standard filter (protocol + port only) and hard filter (Layer7 filters like TCP Symmetric). For SSH, RDP, and most TCP services the standard mode is enough; hard filter (Layer7) options like TCP Symmetric should only be enabled for highly sensitive applications. Standard (normal) filters do highly successful filtering without false positives.

Websites using Cloudflare: TCP Symmetric filter cannot be used on ports 80 and 443. Because Cloudflare uses asymmetric routing, symmetric filtering does not work on these ports. Instead, use the built-in Cloudflare preset rule in Path Panel.

Example Rule Configurations

SSH Access

Protocol:         TCP
Destination Port: 22
Filter mode:      Standard
Description:      SSH access

RDP Access

Protocol:         TCP
Destination Port: 3389
Filter mode:      Standard
Description:      RDP access

Minecraft Java Server

Protocol:         TCP
Destination Port: 25565
Filter:           Minecraft Java Edition
Description:      Minecraft Java server

FiveM Server

# Rule 1
Protocol:         UDP
Destination Port: 30120
Filter:           GTA FiveM
Description:      FiveM UDP

# Rule 2
Protocol:         TCP
Destination Port: 30120
Filter:           TCP Service (Symmetric)
Description:      FiveM TCP

# Rule 3 (txAdmin)
Protocol:         TCP
Destination Port: 40120
Filter:           TCP Service (Symmetric)
Description:      txAdmin panel

OpenVPN Server

Protocol:         UDP
Destination Port: 1194
Filter:           OpenVPN UDP Server
Description:      OpenVPN VPN server

Path Panel Filter Rules Guide

Table of Contents