L7 behavioral protection
Request behavior is scored per proxy, and abusive sources are banned with timed durations before they reach your origin.
Features
Everything Pixel Shield runs between the public internet and your game servers.
iptables rate limiting
Per-IP packet and connection rates enforced in kernel space on every node, tuned per proxy within validated bounds.
Per-node management
Every node reports heartbeat, capacity and version to the control plane. Credentials stay AES-256-GCM encrypted at rest.
Bandwidth quotas
Bytes in, bytes out and request counters roll up daily per proxy, so plan limits are measured, not guessed.
Port-based TCP/UDP proxies
Dedicated listen ports on edge nodes forward clean TCP and UDP traffic to your game server, with weighted, health-checked backends behind each one.
ACLs with expiry
Global and per-proxy blocklists and whitelists for CIDR entries, with temporary rules that expire on schedule.
Port-based TCP/UDP proxies
A proxy is a dedicated listen port (or SNI hostname) on an edge node. Clean traffic is forwarded to your backends; attack traffic never makes the trip.
- Listen modesport, hostname (sni)
- Protocolstcp, udp, tcp+udp
- Load balancinground-robin, least-conn, ip-hash, weighted, random
- Backendsweighted, health-checked, backup-ready
iptables rate limiting
Rate policy executes in kernel space on the node itself, so floods are dropped before user space ever sees them. Every field is validated against declared bounds.
- tcp_pps_per_ip10 to 100,000 packets/s
- udp_pps_per_ip10 to 100,000 packets/s
- tcp_syn_rate_per_ip5 to 50,000 packets/s
- concurrent_connections_per_ip1 to 10,000 connections
- new_connections_per_second1 to 50,000 connections/s
L7 behavioral protection
The L7 engine scores request behavior per proxy and bans abusive sources for a timed duration, with a live event feed behind every decision.
- http_rps_per_ip1 to 10,000 requests/s
- max_header_size_bytes1,024 to 65,536 bytes
- max_body_size_bytes1,024 to 104,857,600 bytes
- Ban controltimed bans, manual unban
- Detection feedauto-detection, abuse reports
Per-node management
Each node runs the RouteX agent and reports to the control plane. Key material is stored encrypted and never returned to clients unmasked.
- Lifecycle statesprovisioning, active, degraded, draining, offline
- API credentialsaes-256-gcm encrypted at rest
- Telemetryheartbeat, capacity, version
- Accessscoped api keys per node
Bandwidth quotas
Traffic counters roll up daily per proxy, powering quota enforcement and the usage charts in the console.
- Countersbytes in, bytes out, requests
- Granularitydaily, per proxy
- Sourcenode tracker snapshots
- Resetsper-proxy counter reset
ACLs with expiry
Blocklists and whitelists apply globally or per proxy. Temporary entries expire on schedule, enforced by a background worker.
- Scopesglobal, per proxy
- List typesblacklist, whitelist
- Entriescidr or single ip, with reason
- Expirytemporary entries auto-expire