# OpenShield-XDP > Kernel-level DDoS mitigation on your own Linux server: install OpenShield-XDP from the dashboard, watch it live, and roll back any config change. > > Canonical: https://xdp.network/docs/products/openshield-xdp · Updated 2026-08-17 OpenShield-XDP is a firewall agent that drops attack traffic inside your server's network card path, using XDP/eBPF, before the Linux network stack spends real work on it. It runs on your own Linux server (kernel 5.15 or newer with BTF support), and you install, configure, and operate it entirely from the XDP.NETWORK console — no shell required. ## Install with the one-click wizard You need a connected fleet server (the Server OAuth daemon) and the license key from your purchase. Start the wizard from either place: - A fleet server's **Products** tab → **Install** next to OpenShield-XDP, or - the **OpenShield-XDP product page** → the **Install on a server** card → **Install** on any online server. The wizard walks through these steps: 1. **License key** — paste the key (`PL-XXXX-XXXX-XXXX-XXXX`). It is verified with the licensing server, stored encrypted, and only ever sent to the server you install on. 2. **Preflight** — the daemon probes the server: root access, kernel ≥ 5.15, kernel BTF support, memory, and a known package manager. If OpenShield is already present, you choose **Update to latest** or **Reconfigure** instead. 3. **Install** — the signed release downloads and installs, with the installer's output streaming live into the wizard. 4. **Configure** — a short questionnaire that auto-saves as you go: - **Interface** — the NIC to protect; the default-route interface is pre-selected. - **Workloads** — what the server runs; your picks drive a profile recommendation. - **Profile and level** — categories such as hosting, gaming, or CDN edge, each with a strictness level. Balanced is the profile default and the safest general choice. - **Personalize and extras** — traffic-pattern answers, optional NIC tuning, the optional SYN-proxy companion (probe-checked on the server first), and attack-data sharing. - **Review** — the exact values about to be written, with free-form overrides, plus the server's config history. 5. **Apply** — the config is written, protection starts, and the wizard verifies the agent is healthy. A failed step can be retried, or repaired in place with **Run openshield fix**. :::tip You can close the wizard while it runs — the install continues on the server and you resume it from the server row later. ::: ## What the install puts on your server - The `openshield` binary and the compiled eBPF programs, attached to the interface you picked. - `/etc/openshield/openshield.yaml` — rendered from your answers onto the annotated stock config, so every comment and untouched default survives. - A systemd unit that starts the agent on boot. - The metrics API on port `9100` with a per-install API key (`osk_…`). The key is stored server-side and never sent to the browser — it is how the console attaches to the agent automatically after install. ## Watch the live console Opening a connected server shows the live console, polled straight from the agent's metrics API (refresh 0.5s–5s, your choice). Tabs split it into **Overview**, **Attacks**, **Traffic**, **System**, and **Logs**: - An attack banner flips between **All clear** and **UNDER ATTACK**, showing the attack type, duration, current rate versus the spike trigger, IPs banned, and new sources blocked. - Stat tiles track current PPS and BPS, pass and drop rate, active bans, new sources per second, the spike trigger against the learned baseline, and uptime. - Live charts plot packets/sec and bandwidth with the trigger line drawn in. - **Protocol distribution**, **Top ports**, and the **Drop paths** donut show what is arriving and where in the pipeline it dies. - **Top offenders**, **Recent bans**, and the **Attack history** table (peak rates, duration, sources involved, forensics directory) show who is behind an attack. With control access, a **Control** tab pushes changes back to the agent: manage the whitelist and blacklist, edit settings, and more. ## See where attacks come from The **Attack origins** card on the product page is a world choropleth of hostile sources. It aggregates the top offenders and recent bans reported by every OpenShield server you own and resolves IPs to countries with the bundled DB-IP Lite database. Choose **Live** or a window (1h, 24h, 7d, 30d, all time) and filter the map to a single server. ## Roll back any config change Every config the console renders — install, reconfigure, preset, or rollback — is snapshotted into the server's **Config history** (shown in the wizard's review step). View any version, or click **Rollback**: the live config is snapshotted first, then the chosen version is pushed to the server and the loader restarts — about 30 seconds, with protection running throughout. ## Reconfigure or uninstall - **Reconfigure** (from the server row on the product page) reuses the stored license key, asks the questionnaire again, and rewrites `openshield.yaml` in place. - **Graceful uninstall** runs the full uninstaller on the server: it stops the firewall and removes the binaries, config, and systemd unit. - **Force remove** deletes the server's records from the dashboard immediately — use it when the server is offline or the daemon is gone. ## License notes OpenShield-XDP is licensed per server through the Altis licensing service. The license is bound to the server's hardware fingerprint, and the agent refuses to start without a valid license — and unloads if the license stops validating. The key is stored encrypted, both in the console and on the server, and is only ever transmitted to the licensing server and the machine you install on. ## Next steps - [How OpenShield mitigation works](/docs/products/openshield-mitigation) - [L7 Shield](/docs/products/l7-shield) - [L4 Tunnel](/docs/products/l4-tunnel)