Every NimbusVPS plan includes always-on layer 3 and 4 filtering at no charge. Fleet-wide that is 16.5 Tbps of scrubbing capacity, but the number that protects you is the one at your site — up to 6.5 Tbps at the largest, and the per-site figure is printed on every location page. There is nothing to enable and nothing to switch on when an attack starts.
What "always-on" means, and why it matters
Traffic passes through scrubbing continuously rather than being redirected once an attack is detected. Two consequences: there is no detection delay during which your service is down, and there is no BGP re-announcement that leaks the fact you are under attack.
Critically, we do not null-route the customer being attacked. Null-routing is what most budget providers do — it protects their network by making your server unreachable, which from your side is indistinguishable from the attack succeeding.
What the included tier handles
- SYN, ACK, RST and TCP state-exhaustion floods
- UDP amplification — DNS, NTP, SSDP, memcached, CLDAP
- ICMP floods
- Fragmented packet attacks
- Spoofed-source volumetric attacks
This is the overwhelming majority of what actually happens on the internet.
What needs Advanced ($5/month)
- HTTP and HTTPS floods that look like real requests
- Slowloris and slow-POST attacks
- Application-layer attacks against game protocols — Source, Minecraft, FiveM
- Bot traffic requiring JavaScript or TLS-fingerprint challenges
Layer 7 attacks cannot be filtered by packet inspection alone because each request is individually valid. If you run a public game server or a login endpoint that gets abused, this tier is worth the five dollars.
During an attack
- Check the panel. Attack traffic and mitigation state are graphed in real time. Confirm what you are actually seeing.
- Do not change your IP. Attackers re-resolve. It rarely helps and it always breaks DNS for legitimate users.
- Open a ticket. Our NOC can apply a targeted filter profile in minutes.
- Tighten your own firewall. Rate-limit new connections per source; drop protocols you do not serve.
The most common mistake
Running a public service on the same IP as your origin, then adding a CDN in front of it and leaving the origin IP resolvable in DNS history, old certificates or mail headers. The CDN protects the front door while the origin stays wide open. If you put a CDN in front of an origin, firewall the origin to the CDN's ranges only.