Netshop · Vultr · OVH · Hetzner · any VPS with "DDoS protection"

Your "DDoS-protected" server is still exposed.

Hosting-level anti-DDoS is built to protect the provider's network, not your MT5 server. Your real IP is in every terminal you ever handed out, your kernel is on defaults and your ports are open to the world. Fendwall fixes all four.

Get protected now How it works

Zero access to your server Live in minutes, no hardware Real client IPs preserved

attack traffic traders & players

2 edges

London + New York, always on

5 layers

edge, node, kernel, firewall, origin

0 access

we never touch your server

< 10 min

from signup to protected

Defense in depth

One filter is a hope. Five layers are a plan.

Every protected endpoint gets all five, on every plan. Nothing to install on your side except one firewall rule we generate for you.

Hidden origin

Your server's real address is never published again. Attackers get an armored edge address that shrugs. There is nothing left to aim at.

Scrubbing edge

Volumetric floods are absorbed upstream of our nodes by always-on, carrier-grade scrubbing in London and New York — unmetered, on every plan.

Hardened nodes

Tuned kernels, nftables per-source limits and HAProxy stick-tables stop SYN floods, connection exhaustion and protocol abuse that slip under volumetric thresholds.

Sealed origin

Your firewall accepts only the Fendwall edge addresses published in your console. Nothing to install: one rule on your side, and your origin is unreachable for everyone else.

Resilient routing

Two regions, automatic origin failover, live geo-blocking and IP allowlists per endpoint, and the real trader IP preserved for your risk engine.

The uncomfortable truth

Provider "DDoS protection" protects the provider.

The anti-DDoS bundled with Netshop, Vultr, OVH, Hetzner and most VPS or dedicated hosts is a network-level volumetric filter. It was designed so a flood against one customer doesn't take the whole datacenter down. That is a very different job from keeping your trade server answering during the attack.

Hosting-level anti-DDoS

Fendwall

Your real IP

Hosting-level anti-DDoSPublic. Sits in every terminal and srv file ever distributed.

FendwallHidden. Only the Fendwall edge address is ever published.

Volumetric floods (Gbps)

Hosting-level anti-DDoSFiltered after detection, with generic thresholds; seconds to minutes of impact.

FendwallAbsorbed at an always-on scrubbing edge in London and New York.

SYN / connection exhaustion

Hosting-level anti-DDoSUsually below the threshold. Your kernel's backlog fills; MT5 stops accepting logins.

FendwallPer-source SYN rate limits, connection caps and SYN cookies on hardened nodes.

Protocol-aware for MT5 / FIX / games

Hosting-level anti-DDoSNo. It doesn't know what a login storm on a long-lived TCP session looks like.

FendwallYes. TCP-mode proxying tuned for long-lived trading and game sessions.

Kernel & OS hardening

Hosting-level anti-DDoSYour job. Default sysctl, default conntrack, default limits.

FendwallIncluded on every node. On your side, one firewall rule: accept only the Fendwall edges.

Open ports on the origin

Hosting-level anti-DDoSStill open. RDP, SSH, MT5 manager — reachable by anyone who finds the IP.

FendwallYour firewall accepts only the Fendwall edge addresses we give you. Nothing else reaches your trade port.

When the attack is too big

Hosting-level anti-DDoSYour IP is null-routed. Their network stays up; you go dark for hours.

FendwallThe attack lands on our edge. Your origin never sees it.

Failover

Hosting-level anti-DDoSNone. One box, one IP, one point of failure.

FendwallTwo regions, automatic origin failover, per-region health checks.

Geo-blocking & allowlists

Hosting-level anti-DDoSRarely, and never per port.

FendwallPer endpoint, live from the dashboard, applied in seconds.

Fendwall itself sits behind carrier-grade volumetric scrubbing — because that layer is necessary. It just isn't sufficient. Everything else on this list is what turns a filtered pipe into a server that keeps answering.

Beyond the infrastructure layer

Protection is also a server setup.

A filtered pipe into a default server still falls over. Every Fendwall node ships with a proprietary tuning profile for the kernel, the firewall and the proxy layer. On your side there is nothing to install: one firewall rule that accepts only our edges. We don't publish the recipe. You get the result.

Kernel

Kernel tuned for floods

Our kernel profile is applied to every node automatically and re-verified on each agent cycle. The parameters are ours; the resilience is yours.

Kernel

$ fendwall-tune --profile edge --verify
✔ kernel profile        applied  (47 params)
✔ flood resilience      verified
✔ anti-spoof            enabled
✔ connection tracking   sized
status: HARDENED · drift: none

Firewall

Firewall, per source, per endpoint

Each protected port gets its own rule set with per-source limits and your allowlist, rendered by the agent and reloaded atomically.

Firewall

$ fendwall-fw status
table fendwall          6 chains · 214 rules
per-source limits       on
invalid packets         dropped
allowlist ep-4433       synced 12s ago
status: ENFORCED

Proxy

Proxy layer with abuse guards

The TCP proxy carries long-lived trading and game sessions and rejects sources that behave like a flood. Origins are health-checked per region.

Proxy

$ fendwall-proxy check
configuration           valid
listeners               3 · abuse guards on
origins                 lon ✔  nyc ✔ (backup)
client source           preserved
status: SERVING

Origin

Your origin, sealed with one rule

You install nothing. Your console lists the exact edge addresses to allow; your firewall accepts those and drops everything else. For anyone who isn't Fendwall, your origin simply isn't there.

Origin

origin firewall policy    managed by you
allowed sources           Fendwall edges only (2)
trade port                reachable via Fendwall
everything else           dropped
agents installed          none
status: SEALED

The tuning is proprietary and applied automatically. We don't publish the recipe: you never maintain it, and attackers never get to study it.

Plain words

How the tunnel works

A tunnel is a protected route for your traffic. Instead of the internet connecting straight to your server, it connects to our armored edge first.

Your traders & playersconnect to the address we give you

Fendwall edgeattacks absorbed · only clean sessions pass

Your serverreal address hidden · firewall sealed

Step 1

Clients connect to us, not to you

You get one protected port, live in London and New York at the same time. Traders and players use that address — nothing changes on their side.

Step 2

The junk never gets through

Floods die at the edge. Legitimate sessions pass through a private tunnel to your origin, with latency kept low by routing each client to the nearest edge.

Step 3

Your server becomes invisible

Your origin's real address is never published. Its firewall accepts only the Fendwall pool and your admins — everything else bounces off.

Built so you never trust us with anything sensitive

What we see: encrypted noise. What you keep: everything.

Your data stays sealed. MT5 / MT4 / FIX and game clients encrypt end-to-end. We relay that encrypted stream as-is — logins, orders, balances and payouts are never visible to us.
Zero access to your server. Nothing of ours runs on your machine, ever. No agents, no credentials, no third party inside your stack.
Real client IPs preserved. Your server keeps seeing every trader's or player's true IP — multi-account detection, copy-group hunting, geo-compliance and anti-cheat keep working untouched.
You hold the keys. Geo-blocking, allowlists and per-endpoint rules change live from your dashboard. Leave anytime — it's your DNS record.

Attackers don't pick random moments

Timed to hurt exactly when you can't afford it.

Attacks cluster around the minutes when your traders are most active and your losses per minute are highest.

News releasesNFP · CPI · FOMC — peak concurrent trading, peak damage.

Challenge launchesPromo weekends, when new signups flood in and support is thin.

Payout daysThe worst possible day to be "down for maintenance".

Market openSunday gap and Monday open volatility.

Tournament finalsGame servers under the most eyes, and the most sore losers.

Ransom deadlines"Pay, or stay down through the session." Paying once marks you as a payer forever.

Verify it yourself

Don't take our word for it. Test it.

We'll run a stress test authorized by you, against your own infrastructure, while markets are closed — and hand you a report showing exactly how vulnerable you are today. Then watch the same test bounce off a protected endpoint.

Request an authorized stress test

Built for

Infrastructure where seconds are money.

Financial markets

Brokers, prop firms & exchanges

Shield MT5 / MT4 trade servers, FIX gateways and price feeds. Latency stays low where the liquidity is, and your origin never leaks.

Games

Game, matchmaking & voice servers

Keep backends, login and matchmaking online through attacks. Players connect to a protected port; the real host stays hidden.

Speed

Live in minutes, not weeks

Create an endpoint, set your origin, share the new address. No hardware, no contracts, no engineers required on your side.

Pricing

Flat monthly tiers. No surprises.

Protect 1, 3 or 5 endpoints — an endpoint is one IP:port service you shield. Every plan includes both edges, unlimited traffic, all five layers, geo controls, failover and support. Switch tiers anytime.