Docs / VPS protection
VPS protection (beta)
An agent on your server cuts floods, bans scanners and shows its traffic in your account.
The protection agent runs on your own server and filters traffic right there: it cuts SYN and UDP floods, bans addresses that hammer ports and reports to your account. The section is in beta; the server can be with any host.
Install
- In your account open VPS protection → Add a server and give it a name.
- Copy the install command and run it on the server as root.
- Within a minute the server shows up in the list as online.
curl -fsSL https://turtleguard.cloud/api/v1/shield/install.sh | sudo sh -s tgs_...Before installing, the script checks from outside which of the server's ports answer and whether it has outbound internet, from Docker containers too, and repeats the same check once the agent is running. If anything stopped working, the protection is removed at once, the server is put back as it was, and the script says so plainly. For 10 more minutes the server rechecks itself and removes the protection on its own if something breaks. On servers with Docker or port forwarding the modes that break them stay off.
The token in the command is shown once. Lost it? Press Rotate on the server page and run the new command; the old token stops working. Reinstalling keeps the settings.
You need x86-64 Linux with systemd and nftables. Agent 0.8.7 and newer updates itself: when a new version is out it downloads it, checks the checksum and restarts without dropping protection. Older versions cannot; update them once by hand with the command from the server page:
curl -fsSL https://turtleguard.cloud/api/v1/shield/bin -o /tmp/tgshield.new && chmod +x /tmp/tgshield.new && sudo tgshield upgrade /tmp/tgshield.newProtection stays on, and the settings and token are kept.
What the server page shows
- Load: packets and dropped packets per second, SYN and UDP, inbound and outbound traffic, connections against the table limit, CPU and steal, banned and trusted clients. Charts cover the last hour, per minute.
- Traffic breakdown: a packet snapshot from the network card. The agent takes one during an attack, and Analyze now takes one on request. It shows the attack type, the share of SYN, ACK, UDP and other packets, top sources and networks, destination ports and the heaviest addresses.
- Bans: who is banned, for how long and why. You can ban an address by hand or unban it; the command reaches the server in seconds.
- Rules that fired and the log: which filters are dropping traffic now and what the agent did: attacks, bans, settings changes, updates.
During an attack a live card with the numbers arrives in Telegram and closes when the attack ends.
Settings
Settings are changed on the server page and applied on the server within a minute.
| Setting | What it does |
|---|---|
| Mode | Observe only counts, Auto turns filters on during an attack, Always protect keeps them on all the time. |
| Trusted IPs | Addresses and networks that are never limited or banned. Put your own address and your other servers here. |
| TCP and UDP ports, Close other ports | With the box ticked only the listed ports stay open. The SSH port is added on its own. |
| Attack thresholds | The packet and new-connection rates above which attack mode turns on. The attack ends when the rate falls below half the threshold. |
| SSH only from trusted IPs | The SSH port is closed to everyone else. It cannot be saved while the trusted list is empty. |
The two buttons on top set ready thresholds. Regular server fits websites and VPN. NAT relay is for servers that forward ports to another server or hold many connections from one address: thresholds are higher and the new-address budget is unlimited. Presets leave ports and trusted addresses alone.
Fine tuning holds per-address limits, connection budgets during an attack and the port-scan auto-ban. Every field has a hint; wrong values can cut off normal clients.
Docker and port forwarding
SYN proxy and stateless mode break Docker and port forwarding (DNAT). If the agent sees them on the server, these boxes are unavailable.
Removing the protection
If a site or VPN stopped opening after the install, remove the protection with one command on the server:
curl -fsSL https://turtleguard.cloud/api/v1/shield/install.sh | sudo sh -s removeIt stops the agent, drops its rules and deletes it from the server. Remove on the server page takes the server out of your account; agent 0.8.7 and newer then removes the protection itself on its next report. With an older agent or an offline server, run the command above.