Name: DDoS Protected KVM VPS Hosting
Brand: Xentain
SKU: DDoSProtectedVPSHosting
Availability: InStock
Rating: 4.4 (34 reviews)

Pick From 2 Locations

Dallas, TX

Starting at $2.00/month

Your ping:

...

Network: 1Gbps

BGP: Available, Free

DDoS Protected by NeoProtect

Fremont, CA

Starting at $2.00/month

Your ping:

...

Network: 1Gbps

BGP: Available, Free

DDoS Protected by NeoProtect

Protected with NeoProtect

DDoS Protection

All of our VPS plans include 1.4Tbps+ of DDoS Mitigation capacity from NeoProtect, making sure that your VPS never skips a beat.

Free BGP Sessions

We offer BGP sessions free of charge in all of our locations. Simply open a ticket requesting a BGP session.

Unmetered Bandwidth

All Xentain VPS plans come with unmetered bandwidth (within the limits of our AUP). No more worrying about overages!

24x7x365 Support

With our 24/7 support team, we are always here to help you out with any questions, issues, or concerns you may have.

IPv6 Connectivity

All of our VPS plans come with a /124 of IPv6 space, allowing you to connect to the IPv6 internet with ease. Need more IPv6 space? Just ask!

Root Access

All of our VPS plans come with full root access, allowing you to install any software you need to get your project up and running.

Powered by VirtFusion

Effortless VPS Management

With a simple and intuitive interface that doesn't compromise on features, VirtFusion makes managing your VPS easy.

VNC Console: allows you to access your VPS even when you can't SSH into it.
Custom ISOs: allows you to install any operating system you want. No more being limited to a few choices.
KVM Virtualization: allows for full virtualization, providing each VPS with bare-metal-like performance.

Full list of NeoProtect's Features

Header validation of the following protocols: IPv4, TCP, UDP, GRE (IPv6 as well, with more basic algorithms)
State validation of TCP protocols as far as technical possible (Out of state ACK, RST or FIN, Sequence validation, Flush handling anomaly detection (ACK/PSH-ACK anomalies))
Invalid TCP flag combinations are checked for (XMas, YMas attacks etc.)
No established connections are ever reset or similar, highest priority is for sessions to remain established
SYN checks based on transmission and a asynchronous Syn-Proxy like CRA ("Challenge-Response-Authentication")
Generic UDP anomaly checks against common attacks like AMP, big floods, fragment floods or spoofed floods from multiple spoof sources
UDP session trackers and filters also based on transmission
UDP header validation of used attributes (Checksum etc.)
Per-ip rate limits for SYN and certain game specific components (e.g. status request in Minecraft or RakNet, or FiveM info.json requests)
SYN-ACK reflection attacks are dropped by default, on local ports we do that as well if symmetric, if not, there are anomaly detections and global limits used
In-line checks for the following L7 protocols (not based on a proxy, done in-line):
Minecraft Java (Validates full Handshake, Login and Status protocol)
RakNet (Bedrock, Rust etc.) (CRA (Challenge-response authentication) implemented)
Source Engine 1/2/Gold / A2S protocol (CRA implemented along with A2S Status caching)
Team Speak 3 (CRA implemented)
FiveM (Validates UDP protocol, only allows certain HTTP requests, highly efficient anomaly detections, zero-tolerance)
HTTP
TLS
SSH
Plasmo Voice
DayZ
RDP
WireGuard
Alt:V (TCP and UDP, similar to FiveM)
QUIC
per-connection packet limits
In-line firewall rules (With Dst. Port Range, Dst. IP, Src. IP, TCP-Flags, Packet Length, (soon) Payload-matching, Src. Port Range, Action (DROP, ACCEPT, Apply certain filter))
Geo-blocking/whitelisting and soon ASN block/whitelisting available as well (per-IP)
Per-ip settings of thresholds, global limits as well as the local port range and of course a default action
Toggleable automatic temp-blacklist for bot behaviours, along with changeable blacklist time (Mainly for FiveM and Alt:V)
Session synchronization over multiple filter instances of all sessions
If no rule is created, and action is filter, we do have application filters on pre-defined port ranges (can be changed manually in the code)