What Shield is#
Shield is the DDoS protection and traffic intelligence built into your Game Panel. The page header describes it as
DDoS protection and traffic intelligence for your server,
and that is exactly what it gives you: a live read on the traffic
hitting your ports, a record of past attacks, and a few controls for
shaping what gets through. Most of the page is read-only monitoring.
The parts you can change are the per-port filter, the allowlist, and
the blocklist, all covered further down.
Open it from the Shield entry in your server's sidebar.
Two controls sit at the top right. The first is a time-range switch
with Live, 1h, 6h,
24h, and 7d buttons that set the window for
the stats, chart, and map below. The second only appears when your
server has more than one allocation: a Port selector that
picks which port the whole page reports on. The colored dot on the
selected port mirrors its protection state.
Shield service unavailable. Live data will return when it reconnects.
The page recovers on its own once the service is back, so there is
nothing to restart on your end.Protection status and live stats#
A status indicator sits just under the header. The label and dot tell
you the current state: Active when protection is running
and quiet, Learning while Shield builds a traffic
baseline (with a percentage progress bar next to it),
Under Attack while one or more attacks are live, and
Unavailable when traffic intelligence is off for the
server. Loading... shows briefly before the first data
arrives.
Below the status are four stat cards. Traffic shows the
live packet rate with the bit rate underneath. Bandwidth
totals the bytes seen over the selected window, labelled
last followed by the range you picked. Drop Rate
is the share of traffic Shield is dropping, shown green, amber, or red
as it climbs. The fourth card,
Attacks with the time range in brackets, counts attacks in
that window and notes how many are
active right now.
When an attack is in progress a red banner appears above everything
else. It reads Attack Detected followed by the attack type,
the port, and the peak rate, and if more than one attack is live it
adds a +N more tag.
Traffic origins and the chart#
The Traffic Origins panel maps where traffic is coming
from. Arcs run from each source toward your server marker, thicker and
brighter for heavier sources, and tinted by how much of that source is
being dropped. Hover a point to see the source IP or country with its
packet and byte totals; a small legend in the corner lists the top
countries by share. If your browser cannot draw the map, Shield falls
back to a plain table split into By country and
Top sources. Before any traffic is recorded it shows
No traffic origins recorded yet.
The traffic chart underneath plots passed against dropped traffic over
time, with the two series labelled Pass and
Drop. Toggle between Packets and
Bandwidth to switch the y-axis between packet rate and bit
rate. Both the map and the chart only render once a port is selected.
Attack history and analysis#
The attack list records every attack Shield has seen on the selected
port. Search by typing in the Search attacks... box, narrow
by kind with the type dropdown (which ranges from
All Types through entries like SYN Flood,
UDP Amplification, Volumetric, and
DNS Amplification), and reorder with the
Newest, Duration, and
Peak Traffic buttons. A live attack shows an
Ongoing marker instead of a duration. When nothing has
happened the list reads No attacks recorded and notes how
long Shield has been running.
Click any attack to expand its detail. The
Attack Metrics card lists Peak PPS,
Peak BPS, Duration, Total Packets,
Total Bytes, Unique Sources, an
Anomaly Score, and the start and end times. The
Attack Analysis card shows a classification, a severity
badge (Critical, High, Medium,
Low, or Info), a confidence meter, and a
written summary once analysis is complete; while it runs
you see Analyzing this attack... or
Analysis queued. A Fingerprint card gives a
copyable hash plus average packet size and destination port count, and
if a packet capture exists a Packet Capture card lists its
size and marks it Available on request. Use
Collapse to close the detail.
Per-port filter configuration#
The Filter Configuration section lists each allocation as
a row showing its address and port. The dropdown on each row sets which
Shield filter protects that port. None means no filter, and
the other options are the filters available to your server, each tagged
with its protocol. When a server type ships a default filter you will
see Default: with its name, and choosing anything else
marks the row with an Override tag and adds a
Reset button that returns the port to that default. While
Shield is still learning, a small Learning: progress bar
and sample count appear under the row.
None on a port that had one prompts you to confirm, because
that port will no longer be protected by any filter. Whether you can
edit these at all depends on your permissions; without the Shield write
permission the controls are read-only.IP rules: allowlist and blocklist#
The IP Rules section has two tabs. The
Allowlist holds trusted IPs that bypass rate limiting and
DDoS filters, described in the panel as
Allowlisted IPs bypass rate limiting and DDoS filters. Use for trusted IPs.
The Blocklist holds IPs that are
dropped immediately at the network level. The active tab
decides which list you are editing.
Add entries in the box reading
IP address or CIDR (e.g. 1.2.3.4 or 10.0.0.0/24). You can
paste several at once separated by spaces, commas, or semicolons, and
each must be a valid IPv4 address or CIDR range or you get an
Invalid IP or CIDR message. Press Add to save.
CIDR ranges get a CIDR tag, every entry shows when it was
added, and a Remove button takes it back off the list. A
count of entries sits at the bottom. As with filters, adding and
removing need the Shield write permission. To control who has that, see
users and permissions.