OpenShield-XDP

Kernel-level DDoS mitigation on your own Linux server: install OpenShield-XDP from the dashboard, watch it live, and roll back any config change.

Last updated

On this page

OpenShield-XDP is a firewall agent that drops attack traffic inside your server's network card path, using XDP/eBPF, before the Linux network stack spends real work on it. It runs on your own Linux server (kernel 5.15 or newer with BTF support), and you install, configure, and operate it entirely from the XDP.NETWORK console — no shell required.

Install with the one-click wizard

You need a connected fleet server (the Server OAuth daemon) and the license key from your purchase. Start the wizard from either place:

  • A fleet server's Products tab → Install next to OpenShield-XDP, or
  • the OpenShield-XDP product page → the Install on a server card → Install on any online server.

The wizard walks through these steps:

  1. License key — paste the key (PL-XXXX-XXXX-XXXX-XXXX). It is verified with the licensing server, stored encrypted, and only ever sent to the server you install on.
  2. Preflight — the daemon probes the server: root access, kernel ≥ 5.15, kernel BTF support, memory, and a known package manager. If OpenShield is already present, you choose Update to latest or Reconfigure instead.
  3. Install — the signed release downloads and installs, with the installer's output streaming live into the wizard.
  4. Configure — a short questionnaire that auto-saves as you go:
    • Interface — the NIC to protect; the default-route interface is pre-selected.
    • Workloads — what the server runs; your picks drive a profile recommendation.
    • Profile and level — categories such as hosting, gaming, or CDN edge, each with a strictness level. Balanced is the profile default and the safest general choice.
    • Personalize and extras — traffic-pattern answers, optional NIC tuning, the optional SYN-proxy companion (probe-checked on the server first), and attack-data sharing.
    • Review — the exact values about to be written, with free-form overrides, plus the server's config history.
  5. Apply — the config is written, protection starts, and the wizard verifies the agent is healthy. A failed step can be retried, or repaired in place with Run openshield fix.

What the install puts on your server

  • The openshield binary and the compiled eBPF programs, attached to the interface you picked.
  • /etc/openshield/openshield.yaml — rendered from your answers onto the annotated stock config, so every comment and untouched default survives.
  • A systemd unit that starts the agent on boot.
  • The metrics API on port 9100 with a per-install API key (osk_…). The key is stored server-side and never sent to the browser — it is how the console attaches to the agent automatically after install.

Watch the live console

Opening a connected server shows the live console, polled straight from the agent's metrics API (refresh 0.5s–5s, your choice). Tabs split it into Overview, Attacks, Traffic, System, and Logs:

  • An attack banner flips between All clear and UNDER ATTACK, showing the attack type, duration, current rate versus the spike trigger, IPs banned, and new sources blocked.
  • Stat tiles track current PPS and BPS, pass and drop rate, active bans, new sources per second, the spike trigger against the learned baseline, and uptime.
  • Live charts plot packets/sec and bandwidth with the trigger line drawn in.
  • Protocol distribution, Top ports, and the Drop paths donut show what is arriving and where in the pipeline it dies.
  • Top offenders, Recent bans, and the Attack history table (peak rates, duration, sources involved, forensics directory) show who is behind an attack.

With control access, a Control tab pushes changes back to the agent: manage the whitelist and blacklist, edit settings, and more.

See where attacks come from

The Attack origins card on the product page is a world choropleth of hostile sources. It aggregates the top offenders and recent bans reported by every OpenShield server you own and resolves IPs to countries with the bundled DB-IP Lite database. Choose Live or a window (1h, 24h, 7d, 30d, all time) and filter the map to a single server.

Roll back any config change

Every config the console renders — install, reconfigure, preset, or rollback — is snapshotted into the server's Config history (shown in the wizard's review step). View any version, or click Rollback: the live config is snapshotted first, then the chosen version is pushed to the server and the loader restarts — about 30 seconds, with protection running throughout.

Reconfigure or uninstall

  • Reconfigure (from the server row on the product page) reuses the stored license key, asks the questionnaire again, and rewrites openshield.yaml in place.
  • Graceful uninstall runs the full uninstaller on the server: it stops the firewall and removes the binaries, config, and systemd unit.
  • Force remove deletes the server's records from the dashboard immediately — use it when the server is offline or the daemon is gone.

License notes

OpenShield-XDP is licensed per server through the Altis licensing service. The license is bound to the server's hardware fingerprint, and the agent refuses to start without a valid license — and unloads if the license stops validating. The key is stored encrypted, both in the console and on the server, and is only ever transmitted to the licensing server and the machine you install on.

Next steps