GRE DDoS protection for hosting companies, game server providers and corporate networks: a business-grade DDoS protection service delivered over a GRE tunnel. Phoenix Guard filters domestic and international traffic on a single platform in two layers; it absorbs attacks of 2.37 billion packets per second and protects all the servers you host through a single GRE tunnel.
In our GRE tunnel DDoS protection service, the tunnel is established with the network of the company receiving the service, and all of that network's traffic passes through our protection layers.
Designed for hosting companies and server providers. The GRE tunnel is established between your network and Phoenix Sunucum; your network's traffic passes through Phoenix Guard's international and domestic (XDP/eBPF) layers and reaches you, cleaned, through the tunnel.
For companies that host game servers: XDP/eBPF profiles specific to FiveM, Minecraft, CS2, Rust, Metin2 and other games are assigned to each IP address on your protected network. Even during a 70 million pps attack from within Turkey, the game server kept running without interruption.
Layer 3, 4 and 7 protection for websites, APIs, e-commerce and corporate services, for companies that run their own network. Domestic and international attacks are filtered before they reach your network; all events are recorded in the IDS panel.
The GRE tunnel service requires all the network traffic of the company hosting your server to pass through the protection; it is therefore offered to companies, not to a single game server. For your gaming community, you can look at our DDoS-protected game servers or refer your hosting company to us for this service.
The attack from abroad was stopped at Phoenix Guard's international layer, and the attack from within Turkey at the XDP/eBPF layer in Istanbul.
The real measure of an attack's strength is not Gbps but pps (packets per second). Routers, switches and firewalls process traffic packet by packet; every packet is a separate processing load. Even if the bandwidth is not saturated, an attack sending millions of small packets per second exhausts the processing capacity of network devices and the firewall and brings them all down at once. That is why absorbing 2.37 billion packets per second takes a very powerful network infrastructure. The 70 million pps attack from within Turkey, in turn, was absorbed without interruption by Phoenix Guard's XDP/eBPF layer, which drops packets in the network card driver before they enter the operating system's network stack.
Phoenix Guard is a single protection platform made up of two layers, international and domestic. Traffic from abroad is filtered first at the international layer and then at the XDP/eBPF layer in Istanbul. Attacks from within Turkey are absorbed directly in Istanbul without ever leaving the country.
If traffic comes from abroad
If traffic comes from within Turkey
Attack traffic originating abroad is filtered on Phoenix Guard's global anycast network at points close to the source of the attack. The traffic then passes through Phoenix Guard's second layer, the XDP/eBPF layer in Istanbul.
Attacks from within Turkey are absorbed at our XDP/eBPF layer in Istanbul without ever leaving the country; traffic from abroad passes through this layer too. Layer 3, 4 and 7 attacks are dropped at network card driver level.
Choose a protection profile for each IP address, close your IP address to international traffic when needed, and monitor traffic and attack logs. Get notified on Discord when an attack starts.
Set a clean traffic capacity between 50 Mbps and 1 Gbps according to your needs.
The GRE tunnel is established between your network and Phoenix Sunucum; our technical team does the configuration with you, free of charge.
In the IDS panel, set game or service profiles and international access rules for the IP addresses on your network.
Your network's traffic is filtered in two layers; every event is written to the security logs and reported to your Discord channel.
Full domestic + international protection in five capacities from 50 Mbps to 1 Gbps. Pricing is simple: 1 Mbps of clean traffic = 1 €, metered at the 95th percentile.
Small hosting companies and corporate networks
Growing hosting companies and corporate infrastructures
Mid-sized hosting and game server providers
Hosting companies with many servers
Large hosting infrastructures and data centers
Plan capacity refers to the total clean traffic delivered to your network over the GRE tunnel after filtering, and is measured with the 95th-percentile method. Attack traffic is not counted towards this capacity and there is no extra charge based on attack size. Prices are in euros (€). To order, message us on WhatsApp from the plan's button or open a support ticket.
For networks and services whose users are mostly abroad or that do not need protection inside Turkey, we also offer the Phoenix Guard international protection layer on its own. Let's set the capacity and price together according to your needs.
| Feature | Full PlanDomestic + International | International OnlyStandalone service |
|---|---|---|
| Attacks originating abroad | Phoenix Guard international layer | Phoenix Guard international layer |
| Attacks from within Turkey | Phoenix Guard domestic XDP/eBPF layer | Not covered |
| Real attacks blocked | 2.37 Gpps international + ~70M pps domestic | 2.37 Gpps international |
| Best suited to | Hosting companies, game server providers and corporate networks serving users in Turkey | Networks and services whose users are mostly abroad |
| Price | From 50 € for 50 Mbps (1 Mbps = 1 €) | By quote |
With solutions that only filter abroad, attack traffic from within Turkey can reach your network without ever passing through those filters. The 70 million pps attack on 2 September 2026 was exactly such a domestic attack, and it was stopped by Phoenix Guard's domestic XDP/eBPF layer.
Create a protection profile for each IP, monitor your traffic, review attack logs and get a Discord notification the moment an attack starts.
Assign a game or service profile to your IP addresses; create a custom profile for your international services or close your IP address to international traffic.
Monitor your inbound and outbound traffic with charts.
Review the records of domestic and international attacks against your IP addresses.
Manage reverse DNS (PTR) records for your IP addresses from the panel.
Web application firewall module; currently in development.
Manage your MAC addresses one by one or in bulk.
Monitor your servers and services with PRTG sensors.
Get an automatic notification in your Discord channel when an attack starts.
Keep a record of panel logins and manage your trusted devices.
Manage your panel users and account settings in one place.
In the My IP Profiles section of the IDS panel, you can assign each IP address on your GRE-protected network one of the XDP/eBPF profiles built around the network protocols of individual games.
A short explanation of how DDoS attacks work and why proper protection needs two layers.
A DDoS (Distributed Denial of Service) attack aims to make a server, network or service unreachable with fake traffic sent from many sources at the same time. Attackers mostly use botnets made up of compromised devices and amplification techniques that multiply traffic. The goal is to exhaust bandwidth, the server's processing capacity or the application itself. Game servers, e-commerce sites and corporate services are among the most frequently targeted systems.
XDP (eXpress Data Path) is a high-performance data path that runs on the eBPF technology in the Linux kernel and processes network packets the moment they reach the network card driver. Because packets are evaluated before they enter the operating system's network stack, malicious traffic is dropped at a very early stage and at very low processing cost. Traditional software firewalls struggle at millions of packets per second, while XDP can carry that load; this architecture is what lies behind our stopping a 70 million pps attack without interruption.
International DDoS protection filters traffic coming from abroad in international scrubbing centers. Attacks launched from within Turkey, however, often reach the target directly over domestic links without ever passing through those centers. For a server serving users in Turkey, real protection requires filtering both directions. In our full plan, traffic from abroad is filtered first at Phoenix Guard's international layer and then at the XDP/eBPF layer in Istanbul; attacks from within Turkey are absorbed in Istanbul without leaving the country.
Gbps measures the volume of data an attack carries, while pps (packets per second) measures the number of packets arriving each second. Because network devices and firewalls process traffic packet by packet, the real bottleneck is pps: an attack made of small packets can generate millions of packets per second even at low bandwidth and lock up the firewall and network equipment. That is why the strength of a DDoS protection should be measured not in Gbps but in the pps it can process. The Mbps value in our plans is the clean traffic capacity delivered to your server after the attack has been filtered.
| Attack type | Layer | What does it do? | Protection |
|---|---|---|---|
| UDP Flood | L3/L4 | Exhausts bandwidth and processing capacity by sending masses of UDP packets to random ports. | Phoenix Guard (domestic + international) |
| SYN Flood | L4 | Fills the server's connection table with TCP connection requests that are never completed. | Phoenix Guard (domestic + international) |
| ACK / RST Flood | L4 | Strains existing connections and firewalls with spoofed TCP packets. | Phoenix Guard (domestic + international) |
| ICMP Flood | L3 | Exhausts network resources with masses of ping packets. | Phoenix Guard (domestic + international) |
| Amplification (DNS, NTP, Memcached) | L3/L4 | Uses open servers as reflectors to multiply traffic volume. | Phoenix Guard (international + domestic) |
| Game protocol attacks | L4/L7 | Tries to take down the game server by imitating query and connection packets. | Phoenix Guard game profiles |
| HTTP Flood | L7 | Overwhelms the web server with HTTP requests until it can no longer respond. | Phoenix Guard XDP/eBPF |
The most common questions about plans, pricing, setup and protection layers.
We offer end-to-end consulting and fast solutions for your DDoS mitigation, VDS, game server or server colocation needs.
We build strong partnerships with the industry's leading companies.
