DDoS protection comes standard on every plan
Each IP address we advertise travels through Cloudflare Magic Transit first, which filters large-scale DDoS traffic at the network edge before it can reach our data centre. There are no null-routes, no extra charges for attack traffic, and no separate "premium protection" plan to buy — the smallest hourly virtual machine gets the same shield as the biggest server.
Start a deployment already covered by Magic Transit
Protected hosting compared with unprotected hosting
| Situation | Without this protection | With NABHCLOUD |
|---|
| Server knocked offline | Provider null-routes the IP, leaving it unreachable for hours | Traffic never reaches our network, so there is nothing to null-route |
| Attack traffic volume | Billed per gigabyte of bandwidth consumed | Not metered or billed — we don't charge for bandwidth at all |
| Upgrading to clean-pipe protection | Charged per IP, per month, as an add-on | Current plans and prices are shown on this page, with protection already included |
Every prefix under our network, AS152523, is advertised through Cloudflare Magic Transit.
- We operate our own network, AS152523, peered at Extreme IX
- Cloudflare Magic Transit comes included
- Invoicing includes GST, with billing in rupees
- Our data centre is in Noida (Sector 80), Delhi NCR
- Billing is hourly, with no minimum commitment
- Customers go through eKYC verification in line with CERT-In requirements
How the protection works
Traffic arrives via Cloudflare first
We advertise our IP ranges to the internet through Cloudflare's anycast network, so every packet heading to your server lands first at one of Cloudflare's 300+ edge locations worldwide.
Floods get filtered at the edge
Attack traffic is identified and discarded right at the edge, within seconds and near its origin. Only legitimate traffic is forwarded on to Noida through private tunnels.
Protection runs continuously, no support ticket needed
There's no "emergency mode" to activate and no support line to call. The shield is active before your virtual machine even finishes starting up.
Don't settle for bandwidth that skips the scrubbing step
Low-cost, unprotected transit seems fine right up until the first flood hits. At that point, it's your provider's own uplinks on the line, and whatever action they take protects their network, not your server.
Workloads that attract attacks
Forex and algorithmic traders
Booter attacks tend to spike around NFP releases and RBI or Fed announcement days. Your trading algorithm stays live.
Game server hosts
A frustrated player renting a cheap booter service can't take your community's server down.
Online stores and SaaS platforms
Extortion floods timed around sale days bounce off at the edge; pair this with Cloudflare's proxy for protection at the application layer too.
Where this protection stops — and what to do instead
- Floods aimed at a website's HTTP layer still need a WAF or reverse proxy positioned ahead of the VM. Cloudflare's free proxy for your domain usually handles this, and we can help you configure it.
- Your firewall configuration remains your responsibility. Shut off ports you're not using — scrubbing at the network layer doesn't substitute for hardening the host itself.
- Genuine traffic surges are never mistaken for attacks and never get filtered. A sudden rush of real visitors is simply good news.
Frequently asked questions about DDoS protection
Is this protection actually included with every plan?
Yes — every prefix we advertise is routed through Cloudflare Magic Transit. Every virtual machine, on every plan, is protected from the moment it starts up. There's no per-IP add-on fee, and no separate protection tier.
What attack types does Magic Transit block?
It blocks network-layer and transport-layer floods — UDP floods, SYN floods, amplification via DNS, NTP or SSDP, and fragment or protocol abuse — the kind of volumetric attack that can take an unprotected server offline. Website-targeted application-layer floods need a WAF or reverse proxy standing in front, and Cloudflare's own proxy works well for this; we can help set it up.
Could my server get null-routed during an attack?
No. Null-routing happens when a provider's own uplinks are threatened by attack traffic. Because the scrubbing takes place at Cloudflare's edge, the flood never makes it to our routers, leaving nothing to null-route.
Does attack traffic count toward my bandwidth usage?
No — the flood is filtered out long before it reaches our data centre, and besides, our pricing never had a metered bandwidth line to begin with.
Can I still run UDP-based game servers and open any ports I need?
Yes. Filtering looks at attack patterns and traffic volume, not at which ports you use. Game-oriented UDP ports, VoIP traffic, VPN tunnels and custom protocols all continue working normally.
Is there anything I need to set up myself?
Nothing at all. Protection runs continuously at the network layer — there's no dashboard switch to remember and no "under attack" mode to turn on.