A GRE tunnel lets you put enterprise-grade DDoS protection in front of a server you can't (or don't want to) move — a home box, a remote dedicated server, or a whole network. Traffic is routed through a filtered, protected IP; attacks are scrubbed before they ever reach your real one. Here's how it works and when to use it.
Quick answer
A GRE tunnel puts DDoS protection in front of a server you cannot or do not want to move — a home server, a remote dedicated server or a whole network. Players connect to a protected IP; that traffic is filtered on the anti-DDoS network and forwarded to your real server through the tunnel, so attacks are scrubbed before they reach it and your real IP stays hidden.
GRE (Generic Routing Encapsulation) builds a virtual point-to-point link between your server and our anti-DDoS network. Players and clients connect to a protected IP we give you; that traffic is filtered and forwarded to your server through the tunnel, and your replies go back the same way. Your real IP stays hidden, and floods are scrubbed on our side.
When to use a GRE tunnel
- You have a dedicated or home server with a great spec but no DDoS protection, and don't want to migrate it.
- You run a game, voice or web server that keeps getting knocked offline and need a filtered IP in front of it.
- You want to protect a whole network or several services behind one protected route.
- You need extra clean IPs or IPv6 in front of an existing box.
How it protects you
| Layer | What happens |
|---|---|
| Protected IP | Clients connect to the filtered IP we assign, never your real one. |
| Scrubbing | Traffic is profiled and Layer-4 floods (SYN, UDP, GRE-abuse, amplification) are dropped at the edge. |
| GRE tunnel | Clean traffic is forwarded to your server over the tunnel; your real IP stays masked. |
| Return path | Your server's replies route back through the tunnel, so the protection is transparent to players. |
What you keep
- Your existing server — no migration; the box stays exactly where it is.
- Low latency — a European scrubbing edge keeps the added hop small.
- Your real IP hidden — attackers only ever see the protected IP.
- Flexibility — protect one service, a full port range, or an entire network.
Because the filtering happens on our network before the tunnel, a DDoS aimed at your protected IP is absorbed on our side — your server (and your home or office connection) never sees the flood. That's the whole point of a GRE tunnel versus hosting an unprotected IP directly.
Related networking & protection
Prefer a fully-hosted protected server instead of tunnelling your own? See our game server hosting and Anti-DDoS options — every IP we deliver already runs behind the same filtered network.