Transcript
The full narration, chapter by chapter. Click a time to play the video from there.
Intro
This is the ESAGAMES Anti-DDoS Manager, the control panel for the Layer 4 protection on your IPs. In this video we go through every screen: what each setting does, what Filter, Drop and Accept really mean, how IP lists work, and the protection wizard, which sets everything up for you if you're just starting out.
How it works
Here's the whole idea in one sentence. Every IP has a mode, which decides what happens to traffic that matches none of your rules. On top of the mode, you add firewall rules: each rule sends one protocol and port range through a preset, which is the filter made for that kind of traffic. Presets and IP lists are the building blocks those rules use.
Overview
The Overview shows every IP on your active services. At the top: how many IPs are protected, how many attacks hit them in the last 14 days, and the biggest peak. Below, one card per IP, with its status. Filtering, Dropping unmatched, Protection off, or Under attack. You also see its protection score, its mode, and when it was last attacked. From each card you can jump straight to its settings, its rules or its attacks.
Protection mode
Open Protection, and pick an IP at the top. The most important setting here is the Mode, the default action for traffic that matches none of your firewall rules. Filter sends that traffic through the general scrubbing engine, so attacks are cleaned and normal traffic gets through. It's the safe default: nothing you forgot breaks. Drop unspecified blocks everything except what a firewall rule explicitly allows. It's the strongest setting, because attacks aimed at any other port never reach your server. And Accept passes all traffic through unfiltered. That means protection is off, so only use it for a short, planned test.
Careful with Drop
Careful with Drop. When you save it by hand on this tab, the panel does not check your rules. If SSH, Remote Desktop or your game port has no rule, it gets closed, and you can lock yourself and your players out. So switch to Drop only once every port you use has a rule, or let the wizard do it, because the wizard checks this for you.
Auto mitigation & score
Auto mitigation lets the protection start mitigating on its own as soon as it detects an attack. Leave it on. The protection score, from 0 to 100, shows how well your filters cover this IP. Points come off for Accept mode, for Filter instead of Drop, for ports without a DDoS filter, for attacked ports without a filter, and for auto mitigation being off. Every deduction comes with a button to fix it.
Maintenance window
Need to test something without the filters? Start a maintenance window. It saves your rules and mode, removes every rule, and turns protection off for the time you choose, from 1 minute up to 24 hours. While it runs, nothing on that IP can be changed. When you're done, press End maintenance now, and your rules and mode come back.
Geo / ASN
The Geo and ASN tab filters traffic by country, or by network. Type two-letter country codes like RO or DE, or network numbers like AS13335. Block listed drops traffic from those countries or networks. Allow only listed does the opposite: only the countries on your list get through. Be careful with that one. A list that's too short can cut off your own players, and the panel asks you to confirm if the list is empty.
Settings, limits & thresholds
Settings, Limits and Thresholds are expert tuning. A limit is a ceiling: traffic above it is dropped. A threshold decides when traffic starts to count as an attack. Here you also find the temporary blacklist, which automatically bans abusive sources for a set time. If you're not sure, leave all three tabs at their defaults. They're already tuned for the network.
Firewall rules
Now, Firewall rules. Each rule takes one protocol and one port, or a range of ports, and sends that traffic through a preset. The port map shows at a glance what's covered. Traffic that matches no rule follows the IP's mode. Rules have no order or priority. Each protocol and port can only have one rule, and one rule covers at most 10,000 ports.
Adding a rule
To add a rule, press Add rule. Pick the protocol, type the port, like 25565, or a range like 27015-27036. Then choose a preset. ESAGAMES presets are ready-made for games and services: Minecraft Java, Source Engine for Counter-Strike, FiveM, Rust, TeamSpeak, SSH, Remote Desktop, websites, and many more. You can also attach an IP list and leave a note.
Filter, Accept or Drop
Every preset has one of three actions. Filter checks the traffic with that preset's filter. For example, the Minecraft filter checks the Minecraft handshake, so bots and floods that don't speak Minecraft are dropped. Accept lets the traffic through without a DDoS filter, so avoid Accept presets on your game ports. And Drop simply discards the traffic, which closes that port completely.
Presets
Presets are reusable. On the Presets page you can build your own: choose the protocol, the action, a filter, an optional challenge, which checks new connections before letting them in, and limits like packets per second and bandwidth. Most people never need a custom preset. The ESAGAMES presets cover the common games and services.
IP lists
IP lists are named groups of addresses. And here's the key point: a list does nothing on its own. It only works where you attach it, on a firewall rule or on a preset. Lists belong to your account, so one list can be reused on rules across all your IPs.
Blacklist, whitelist, trust
Every entry in a list has one of three actions. Blacklist blocks traffic from those addresses on the rule the list is attached to. Use it for attackers or abusers you want gone. Whitelist marks addresses as allowed on that rule. It's what the wizard uses when you list who may connect to an admin port. Trust goes one step further. Trusted addresses skip the checks, and they even get through a rule set to Drop.
Whitelist or trust?
So what's the difference between whitelist and trust? Whitelist says these addresses are allowed. Trust says these addresses are mine, don't check them. That's why you should only trust addresses you control, like your own servers, your office, or your monitoring. And here's a proven recipe to lock a port, like a database, to your own IPs only: add a rule with the drop preset, and attach a trust list with your addresses. Everyone else is dropped. Your IPs get through.
Adding addresses
To add an entry, type the address in CIDR form. For a single IP, add /32 at the end, for example 1.2.3.4/32. A /24 covers a whole range of 256 addresses. TTL is optional: it's the number of seconds before the entry expires. Leave it empty, and the entry is permanent. You can also import up to 500 lines at once, and export a list as a text file.
The protection wizard
Just starting out? Use the protection wizard. It builds everything for you in seven steps, and nothing changes until you confirm. Step one: pick your IPs, one, several, or all of them. Step two: tick everything that runs on the server. Games, remote access, websites, control panels, mail, databases, and more. Each service brings its own ports and the right filter. Important: also tick SSH or Remote Desktop, so you keep access to your server.
Ports, tips & review
Step three shows the ports and filters. The defaults fit a standard install, so keep the filter marked Recommended. Step four gives optional security tips, like limiting an admin port to your own addresses with an IP list. Step five is the review. Choose Drop as the mode and Add for existing rules, both marked Recommended. You see exactly which rules are added or replaced, and how your score will change. If nothing keeps SSH or Remote Desktop open, the wizard warns you before you can apply.
Apply
Press Apply. The wizard works one IP at a time. It creates the new rules first and changes the mode last, so your services stay reachable. If a step fails, that IP's old rules are put back automatically. On the result screen, you see the new score for every IP.
Attacks
The Attacks page lists every attack on your IPs. The chart shows the last 14 days, coloured by severity: low under 100 Gbps, medium from 100 Gbps, high from 1 Tbps, and critical from 6 Tbps. The attack log shows each attack's target, its vectors, like UDP or fragmentation, the time window, and the peak.
Attack details
Press Details for the full picture. The traffic chart, every attack signature, and a breakdown of the sampled packets: source IPs, networks and countries, the ports and protocols that were hit, and packet sizes. If an attack hit a port with no rule, the panel tells you, and offers to add the right rule in one click. You can also download the packet capture, as a PCAP file.
Notifications
Under Notifications, turn on email alerts, and you get a message when an attack starts, and another when it ends. You can add up to two extra addresses. You can also post alerts to a Discord channel, or send signed JSON to your own system with a webhook. For each one, choose the events: attack started, attack ended, peak updates, rule and mode changes, maintenance, and more. Alerts arrive within about a minute.
Reports & API
Reports gives you a monthly report per IP: attacks per day, severity, vectors, the most targeted ports, your biggest attacks, and every protection change. You can download it as a PDF, or get it by email every month. And with API access, you can manage your protection from your own scripts, with read-only or read-and-write keys.
Common mistakes
Before you go, the most common mistakes. Don't switch to Drop by hand before every port you use has a rule. Don't leave an IP in Accept, because that turns protection off. When you add a single IP to a list, end it with /32. Remember that a list only works once it's attached to a rule or a preset. Only trust addresses you control. And never put an Accept preset on your game port. Use the game's own filter.
Recap
Quick recap: start with the wizard, keep SSH or Remote Desktop in your rules, choose Drop once every port is covered, and turn on attack alerts. Questions? Open a support ticket, or find more guides at esagames.ro.
