How does remote DDoS protection work with GRE tunnels?

Remote DDoS protection via GRE tunnels works by routing your traffic through our scrubbing network before it reaches your servers. You announce your IP space to AS398999 via BGP, and we establish a GRE tunnel back to your origin. All inbound traffic is scrubbed at our 9 global centers (2Tbps+ capacity), and only clean traffic is forwarded to you through the tunnel. No server migration required.

What types of DDoS attacks does SucuraGuard mitigate?

SucuraGuard mitigates all common DDoS attack vectors: volumetric attacks (UDP floods, DNS amplification, NTP reflection, memcached), protocol attacks (SYN floods, TCP state exhaustion, fragmented packets), and application-layer attacks (HTTP floods, slowloris). Our XDP/eBPF filtering pipeline handles L3/L4 attacks at line rate with sub-second detection.

How much does remote DDoS protection cost?

Remote SucuraGuard protection starts at $25/mo for 100 Mbps clean, $75/mo for 500 Mbps, $150/mo for 1 Gbps, and $500/mo for 5 Gbps — plus usage-based pay-as-you-go plans from $0.05/GB. Protection is always-on with unlimited attack mitigation — you only pay for clean traffic throughput, not attack volume. DDoS protection is included free on all Sucura hosting services.

Do I need to migrate my servers to use SucuraGuard?

No. SucuraGuard remote protection works with any infrastructure, anywhere. You keep your existing servers and hosting provider. We protect your IPs remotely via BGP announcement and deliver clean traffic back to your origin through a GRE tunnel. Setup takes minutes, not days.

How does SucuraGuard compare to Path.net or CosmicGuard?

SucuraGuard offers competitive remote DDoS protection starting at $25/mo (vs typical $100+ from other providers). Like Path.net and CosmicGuard, we use GRE tunnels and BGP for remote mitigation, with 2Tbps+ scrubbing capacity across 9 global centers. We also include free DDoS protection on all our hosting services — dedicated servers, VPS, and colocation.

Remote DDoS Protection & Mitigation

Protect any infrastructure, anywhere. 2Tbps+ scrubbing capacity across 9 global centers. Deploy via GRE, VXLAN, WireGuard tunnel or BGP in minutes — no server migration required. Sub-second attack detection, always-on filtering, from $25/mo. Included FREE on all Sucura hosting.

Get Protected Now Under Attack? Get Help

SucuraGuard Services

SucuraGuard Included Free

All Sucura services (Dedicated Servers, VMs, Colocation) include SucuraGuard protection at no additional cost. All traffic is automatically scrubbed through our 2Tbps+ global network.

Always-On No Extra Cost 2Tbps+ Capacity

FREE with all services

Remote SucuraGuard Protection (GRE / VXLAN / WireGuard Tunnel or BGP)

Don't host with us? No problem. Announce your IP blocks to AS398999 over a GRE, VXLAN or WireGuard tunnel — or a direct BGP session — and get instant SucuraGuard protection. Self-serve deployment in the Nexus panel; a free trial is available.

Starter

100 Mbps clean

$25/mo

Business

500 Mbps clean

$75/mo

Professional

1 Gbps clean

$150/mo

Enterprise

5 Gbps clean

$500/mo

Prefer pay-as-you-go? Usage-based plans available in-panel — from $0.05/GB scrubbed, hourly announce, per-prefix, and 95th-percentile transit billing.

Start Free Trial →

SucuraGuard for IP Transit

Bringing your own transit? Protect your prefixes with per-prefix and 95th-percentile plans — configure and deploy it yourself in the Nexus panel. Custom filtering rules included at no extra cost.

Per-prefix & 95th-percentile billing

Get Started →

How Remote DDoS Protection Works

Announce Your IPs

Announce your IP blocks to AS398999 via BGP. All inbound traffic routes through our scrubbing network first.

We Scrub the Traffic

Our XDP/eBPF pipeline inspects every packet at line rate across 9 global centers. DDoS traffic is dropped, legitimate traffic passes.

Clean Traffic via GRE

Only clean traffic is forwarded to your origin through a GRE tunnel. Your servers never see attack traffic. No migration needed.

Defense Capabilities

Edge Network (AS398999)

Anycast edge - Global traffic distribution

BGP divert / GRE - Flexible traffic routing

Inline scrubbing - Real-time traffic cleaning

Low-latency routes - Optimized network paths

SucuraGuard Appliances

Custom-built protection - Designed and built in-house

2Tbps+ capacity - Across 9 active scrubbing centers worldwide

Lightning-fast filtering - Ultra-low latency traffic inspection

Live telemetry - Real-time attack visibility

Mitigation

L3/L4 + volumetric - Multi-layer defense

App-layer hardening - L7 protocol protection

Amplification dampening - Reflection attack defense

Botnet fingerprinting - Advanced threat detection

Operations

24/7 SOC / NOC - Round-the-clock monitoring

Auto detection - AI-powered threat identification

Reports & API - Comprehensive analytics export

SLA-backed - Guaranteed response times