Network DDoS scrubbing vs CDN / reverse proxy
Network DDoS protection vs a CDN proxy
Network-level scrubbing filters attack traffic upstream of your server at layers 3 and 4, and it works for any protocol — game servers, DNS, mail, anything UDP. A CDN proxy terminates HTTP and defends layer 7, but only for HTTP, and only if your origin IP never leaks. They are complementary: scrubbing protects the wire, a CDN protects the application.
| Dimension | Network DDoS scrubbing | CDN / reverse proxy |
|---|---|---|
| Layers covered | L3/L4, any protocol | L7, HTTP/HTTPS only |
| Works for game servers | Yes | No |
| Works for mail or DNS | Yes | No |
| Hides origin IP | No | Yes, if never leaked |
| Latency added | Fractions of a millisecond | Varies; usually negative for cached content |
| Included here | Yes, every tier | Bring your own |
Which should you choose?
Network DDoS scrubbing
Network scrubbing is mandatory for anything non-HTTP, and included at every OnionVPS tier.
CDN / reverse proxy
Add a CDN for HTTP workloads: it caches, hides the origin and filters application-layer floods.
Frequently asked questions
Do I need both DDoS protection and a CDN?
For an HTTP service, yes — they cover different layers. For a game server or a DNS resolver, a CDN cannot help at all; network scrubbing is the whole answer.
Does a CDN hide my server IP?
Only if it never leaks. Historical DNS records, mail headers, TLS certificate transparency logs and error pages all leak origin IPs routinely.