Protections
The Protections tab of the Edge Firewall has 16 ready-made protections. Each one has an on/off switch, and some have settings. They are grouped in Network, TCP, Rate limits, Access and Payload.
Open it from Security > Firewalls, click the firewall and open Protections.
When you turn a protection on, the rules it needs appear in the Rules list, locked and marked “From” and the protection name. You manage them here, not from the list. Protection rules count toward the limit of 50 rules per firewall.
Network
| Protection | What it does | Settings (default) |
|---|---|---|
| Bogon sources | Drops traffic from private and reserved addresses | None |
| IP fragments | Drops fragmented IP packets | None |
| Invalid packets | Drops malformed packets and ones that belong to no connection | None |
| ICMP rate limit | Limits ping and other ICMP traffic | Rate (1/s), Burst (5) |
TCP
| Protection | What it does | Settings (default) |
|---|---|---|
| TCP flags | Drops packets with impossible TCP flag combinations | None |
| New without handshake | Drops new TCP connections that do not start with a handshake | None |
| Suspicious MSS | Drops connection attempts with an unusual or missing segment size | Minimum MSS (536), Maximum MSS (65535) |
| RST rate limit | Limits TCP resets | Rate (2/s), Burst (2) |
| SYN proxy | Answers connection handshakes for your server during SYN floods | None |
SYN proxy and New TCP connections cannot be on at the same time.
Rate limits
| Protection | What it does | Settings (default) |
|---|---|---|
| Connections per IP | Caps open TCP connections per source address | Max connections (111) |
| New TCP connections | Limits how many new TCP connections arrive per second | Rate (60/s), Burst (20) |
| UDP rate limit | Limits incoming UDP packets | Rate (100/s), Burst (200) |
Set the UDP limit above your game's traffic
Access
| Protection | What it does | Settings (default) |
|---|---|---|
| Close access | Only your own IP and your allowlist can reach the server | Your IP and the allowlist (see below) |
| SSH brute force | Blocks addresses that keep trying to log in over SSH | Attempts (10), Window (60 seconds) |
| Port scans | Slows down and blocks port scanners | None |
Close access
When you turn Close access on, your current IP is added for you. If your IP changes, click Use my current IP to update it. You can add more IPs or ranges, for example the office of a teammate. Everyone else is dropped.
Payload
| Protection | What it does | Settings (default) |
|---|---|---|
| Payload match | Drops packets whose payload contains a text you choose | Protocol (UDP or TCP), Port, Text to match, Action (Drop or Allow) |
Settings and rates
- Rates are written as a number per second, minute or hour:
10/s,100/mor5/h. - Changing a protection’s settings and saving applies it again.
Like rules, every change is applied to the server right away, and the panel shows Applying until the server confirms. If something fails you see the error and a Try again button; what was already running keeps running.
Where protections run
Each rule a protection creates shows a small XDP or Kernel tag in the Rules list, so you can see where it runs. moat follows connections itself, so the protections run in XDP, in the network driver, before the Linux network stack. The SYN proxy is the one that runs in the kernel, right after moat.