Layer 3/4: Protection below HTTP.

A little, from the extra hop and the encapsulation — how much depends on how far your server is from our network. Traffic always takes the same path, so there is no sudden latency jump the moment you are attacked.

GRE adds 24 bytes of header to every packet, which reduces the usable packet size. If that is not accounted for, large packets are fragmented or dropped while small ones work perfectly — the classic symptom is that a site loads but large uploads or TLS handshakes hang. We set the tunnel MTU and clamp TCP MSS with you during setup, and agree packet sizes for UDP services, so large packets get through.

Tell us what you have been hit with and we will give you a straight answer for your setup rather than a marketing number.

Yes, that is the main reason to use GRE rather than moving. Your hardware stays exactly where it is; only the route in front of it changes.

UDP will be filtered, not null-routed. Null-routing UDP when an attack starts is indistinguishable from the attack succeeding if you run a game server, so it is treated as traffic to inspect, not something to discard.

If you firewall it to our ranges, it stops answering anyone but us, and because the world only sees the protected address it is far harder to find. We recommend this and help you set it up.

Not yet — layer 3/4 transit is still being built. Get in touch and we will tell you where it stands and what your setup would need.

No. The plan is that you can announce your own prefix through us if you have one, or use addresses from our range if you do not.

Yes, and they are complementary. Websites and APIs are best served by the HTTP proxy, which is live today; everything else will go over the tunnel once it launches.