How to Use the Anti-DDoS Manager (Video Guide)

The Anti-DDoS Manager in your client area controls the Layer 4 protection of every IP on your services. This guide explains each screen: the three modes, firewall rules, presets, IP lists and the protection wizard, which sets everything up for you if you are just starting.

Quick answer

Open the Anti-DDoS Manager from the client area and start the Protection wizard. Tick everything that runs on your server — your game and SSH or Remote Desktop — keep the recommended filters, choose Drop and Add on the review step, and apply. Then turn on attack alerts under Notifications.

How the protection is built

• Mode (default action) — what happens to traffic that matches none of your rules: Filter, Drop or Accept.
• Firewall rules — each rule sends one protocol and port range (for example UDP 27015) through a preset.
• Presets and IP lists — the building blocks rules use: a filter made for a game or service, and lists of addresses to block, allow or trust.

Filter, Drop or Accept: the IP mode

• Filter — unmatched traffic is scrubbed by the general mitigation engine and normal traffic passes. The safe default: nothing you forgot breaks.
• Drop unspecified — unmatched traffic is dropped, so only ports with a rule are reachable. The strongest setting, once every port you use has a rule.
• Accept — traffic passes unfiltered, so protection is off. Only for a short, planned test.

Auto mitigation lets the protection start mitigating on its own when it detects an attack — leave it on. The DDoS protection score (0–100) shows how well the filters cover the IP: points come off for Accept mode (−60), Filter instead of Drop (−40), ports without a DDoS filter (−15 each, up to −30), attacked ports without a filter (−10 each, up to −20) and auto mitigation off (−5). Every deduction has a button to fix it.

Maintenance window

A maintenance window saves your rules and mode, removes every rule and turns protection off for 1 minute to 24 hours — for example while you test a new service. Nothing on that IP can be changed while it runs. Press End maintenance now when you finish and your rules and mode come back.

Geo / ASN, settings, limits and thresholds

The Geo / ASN tab filters by country (two-letter codes such as RO or DE) or by network (ASN, such as AS13335). Block listed drops traffic from the list; Allow only listed lets only the list through — a list that is too short can cut off your own players. Settings, Limits and Thresholds are expert tuning: a limit is a ceiling (traffic above it is dropped), a threshold decides when traffic counts as an attack. If you are not sure, leave them at their defaults.

Firewall rules and presets

1. Open Firewall rules, pick the IP and press Add rule.
2. Choose the protocol and type one port (25565) or a range (27015-27036).
3. Choose a preset. The ESAGAMES presets are made for games and services: Minecraft Java, Source Engine, FiveM, Rust, TeamSpeak 3, SSH, Remote Desktop, websites (HTTP / TLS) and many more.
4. Optionally attach an IP list and a note, then press Add rule.

Rules have no order or priority. Each protocol and port can have one rule, and one rule covers at most 10,000 ports. Traffic that matches no rule follows the IP's mode. Every preset has one of three actions: Filter checks the traffic with the preset's filter (the Minecraft filter, for example, checks the Minecraft handshake, so bots and floods are dropped), Accept lets it through without a DDoS filter — avoid it on game ports — and Drop discards it, closing the port.

IP lists: blacklist, whitelist and trust

An IP list is a named group of addresses. It does nothing on its own: it only works where you attach it, on a firewall rule or a preset. Lists belong to your account, so one list can be reused on rules across all your IPs.

• Blacklist — traffic from these addresses is blocked on the rule the list is attached to. Use it for attackers and abusers.
• Whitelist — these addresses are allowed on that rule. The wizard uses it to say who may connect to an admin port.
• Trust — these addresses skip the checks and even get through a rule set to Drop. Use it only for addresses you control: your servers, your office, your monitoring.

Type addresses in CIDR form: a single IP is 1.2.3.4/32, and 1.2.3.0/24 covers 256 addresses. TTL is optional — the number of seconds before the entry expires; empty means permanent. You can import up to 500 lines at once and export a list as a text file.

The protection wizard, step by step

1. IPs — pick one, several or all of your IPs. Nothing changes until you confirm.
2. Services — tick everything that runs on the server: games, remote access, websites, control panels, mail, databases. Each service brings its ports and the right filter. Tick SSH or Remote Desktop too.
3. Ports — the defaults fit a standard install; keep the filter marked Recommended.
4. Security — optional tips, such as limiting an admin port to your own addresses with an IP list.
5. Review — choose Drop and Add (both Recommended), check exactly which rules change and how the score moves.
6. Apply — one IP at a time: new rules first, the mode last, so services stay reachable. If a step fails, that IP's old rules are put back.
7. Result — the new score for every IP.

Attacks, notifications and reports

Attacks lists every attack with its severity (low under 100 Gbps, medium from 100 Gbps, high from 1 Tbps, critical from 6 Tbps), vectors, time and peak. Details shows the traffic chart, each signature, and a breakdown of the sampled packets by source, port and size, plus a PCAP download. If an attack hit a port without a rule, the panel offers to add the right one. Under Notifications, email alerts tell you when an attack starts and ends; you can also send alerts to Discord or to your own system with a signed webhook. Reports gives a monthly report per IP as a PDF or by email, and API access lets you manage the protection from your own scripts.

Common mistakes

• Switching to Drop by hand before every port you use has a rule.
• Leaving an IP in Accept — it turns DDoS protection off.
• Adding a single IP to a list without /32.
• Expecting a list to work before it is attached to a rule or preset.
• Trusting addresses you do not control.
• Putting an Accept preset on a game port instead of the game's own filter.