Dokumentasi

Pengenalan GarudaShield

GarudaShield adalah mesin mitigasi serangan DDoS Layer 4 & Layer 7 lengkap dengan Web Application Firewall (WAF), verifikasi browser, sinkronisasi cluster antar-node, dan dashboard monitoring real-time.

Arsitektur

Pengunjung
    │
    ▼
┌────────────────────────────────┐
│  GarudaShield Edge (node/cluster) │  ← L3/L4/L7, WAF, verify-browser, rate limit
│  port 8080 · proxy ke origin     │
└───────────────┬────────────────┘
                │ trafik bersih (origin IP disembunyikan)
                ▼
┌────────────────────────────────┐
│          Origin Server         │   ← VPS / dedicated / cloud Anda
└────────────────────────────────┘

Documentation

GarudaShield Introduction

GarudaShield is a Layer 4 & Layer 7 DDoS mitigation engine with a Web Application Firewall (WAF), browser verification, cross-node cluster sync, and a real-time monitoring dashboard.

Architecture

Visitor
    │
    ▼
┌────────────────────────────────┐
│  GarudaShield Edge (node/cluster) │  ← L3/L4/L7, WAF, verify-browser, rate limit
│  port 8080 · proxy to origin      │
└───────────────┬────────────────┘
                │ clean traffic (origin IP hidden)
                ▼
┌────────────────────────────────┐
│          Origin Server         │   ← your VPS / dedicated / cloud
└────────────────────────────────┘

Panduan

Quick Start

Aktifkan proteksi dalam tiga langkah — kurang dari 10 menit.

Contoh perubahan DNS

# Sebelum (langsung ke origin)
www   IN  A  203.0.113.10

# Sesudah (via GarudaShield)
www   IN  A  165.22.56.21

IP origin Anda otomatis disembunyikan dari hasil dig publik.

Guide

Quick Start

Protection live in three steps — under 10 minutes.

Example DNS change

# Before (direct to origin)
www   IN  A  203.0.113.10

# After (via GarudaShield)
www   IN  A  165.22.56.21

Your origin IP is automatically hidden from public dig results.

Fitur

Verify Browser (Interstitial)

Halaman "Just a moment" sebelum pengunjung masuk — memblokir bot tanpa mengganggu manusia.

Cara kerja

1. Request pertama tanpa cookie gs_ok → edge membalas halaman challenge (HTTP 200).
2. Halaman menjalankan JavaScript yang menghitung jawaban dari seed, salt, dan nonce, lalu POST ke /__garuda/verify.
3. Jawaban valid → server menetapkan cookie gs_ok dengan TTL (default 1800 detik).
4. Reload → request masuk ke origin dengan normal.

Konfigurasi

{
  "shield": {
    "verifyOnFirstVisit": true,
    "verifyOnFirstVisitHosts": ["protect.garudashield.my.id"],
    "_tokenTTL": 1800000
  }
}

Kunci	Deskripsi
verifyOnFirstVisit	Aktifkan interstitial untuk pengunjung baru.
verifyOnFirstVisitHosts	Daftar host yang dikenakan interstitial. Host lain tidak terpengaruh.
_tokenTTL	Umur cookie gs_ok dalam milidetik (default 1800000).

Feature

Verify Browser (Interstitial)

A "Just a moment" page before visitors get in — blocking bots without annoying humans.

How it works

1. First request without a gs_ok cookie → the edge replies with the challenge page (HTTP 200).
2. The page runs JavaScript that computes the answer from a seed, salt and nonce, then POSTs to /__garuda/verify.
3. Valid answer → the server sets the gs_ok cookie with a TTL (default 1800 seconds).
4. Reload → the request reaches the origin normally.

Configuration

{
  "shield": {
    "verifyOnFirstVisit": true,
    "verifyOnFirstVisitHosts": ["protect.garudashield.my.id"],
    "_tokenTTL": 1800000
  }
}

Key	Description
verifyOnFirstVisit	Enable the interstitial for first-time visitors.
verifyOnFirstVisitHosts	Hosts that get the interstitial. Other hosts are unaffected.
_tokenTTL	Lifetime of the gs_ok cookie in milliseconds (default 1800000).

Fitur

Cluster Sync

Satu cluster, satu kebijakan — blokir diterapkan di semua node secara otomatis.

Konsep

Setiap node menjalankan GarudaShield penuh. Node-node saling terhubung melalui HTTP dengan shared secret. Ketika satu node memblokir IP, peristiwa tersebut disiarkan ke semua peer dan disinkronkan penuh secara berkala, sehingga IP yang sama langsung diblokir di node lain.

Konfigurasi

{
  "cluster": {
    "enabled": true,
    "nodeId": "edge-ny2",
    "secret": "SHARED-SECRET-RAHASIA",
    "peers": ["146.190.104.237:8080"],
    "heartbeatMs": 10000,
    "syncIntervalMs": 30000
  }
}

Kunci	Deskripsi
nodeId	Nama unik node ini di cluster.
secret	Shared secret — harus sama di semua node.
peers	Daftar node lain dalam format host:port.
heartbeatMs	Interval heartbeat kesehatan peer (default 10000).
syncIntervalMs	Interval sinkronisasi penuh blocklist (default 30000).

Event yang disinkronkan

• block / unblock — peristiwa IP diblokir atau dibuka.
• whitelist / unwhitelist — daftar IP tepercaya.
• emergency — mode darurat diaktifkan/dimatikan.
• aggressive — mode agresif diaktifkan/dimatikan.

Tombstone

Jika sebuah IP sengaja di-unblock/di-remove, node lain "menandai" IP itu (tombstone) selama TTL tertentu agar node yang stale (misalnya karena jaringan terputus) tidak memasukkan kembali IP tersebut saat full-sync.

Feature

Cluster Sync

One cluster, one policy — blocks are enforced on every node automatically.

Concept

Each node runs a full GarudaShield. Nodes connect over HTTP using a shared secret. When one node blocks an IP, the event is broadcast to all peers and periodically fully-synced, so the same IP is blocked everywhere immediately.

Configuration

{
  "cluster": {
    "enabled": true,
    "nodeId": "edge-ny2",
    "secret": "SHARED-SECRET-RAHASIA",
    "peers": ["146.190.104.237:8080"],
    "heartbeatMs": 10000,
    "syncIntervalMs": 30000
  }
}

Key	Description
nodeId	Unique name of this node in the cluster.
secret	Shared secret — must be identical on all nodes.
peers	List of other nodes as host:port.
heartbeatMs	Peer health heartbeat interval (default 10000).
syncIntervalMs	Full blocklist sync interval (default 30000).

Synced events

• block / unblock — blocked/unblocked IP events.
• whitelist / unwhitelist — trusted IP lists.
• emergency — emergency mode on/off.
• aggressive — aggressive mode on/off.

Tombstone

When an IP is deliberately unblocked/removed, other nodes "tombstone" it for a TTL so a stale node (e.g. after a network partition) cannot re-add it during full-sync.

Fitur

Dashboard

Pusat kendali real-time untuk seluruh engine — tersedia di port 3000 dengan autentikasi HTTP Basic.

Halaman

Halaman	Fungsi
Overview	Postur keamanan, mode, dan ringkasan serangan.
Analytics	Garis waktu threat dan verdict trafik.
Traffic	Throughput, sumber request, dan mitigasi.
Geo Map	Distribusi negara pengunjung & IP penyerang.
Blocklist	Kelola IP diblokir.
Whitelist	Kelola IP tepercaya (dengan info lokasi).
Challenge	Status interstitial & IP gagal challenge.
Cluster	Status node, peer, tombstone, dan event sync.
Rules	Modul WAF, custom rule, dan per-path rate limit.
Event Log	Riwayat peristiwa keamanan.
Settings	Konfigurasi engine & webhook alert.

Referensi API

GET  /api/stats            ringkasan lengkap (SSE: /api/stats/stream)
GET  /api/blocklist        daftar IP diblokir (dengan geo)
GET  /api/whitelist        daftar IP tepercaya
GET  /api/whitelist/detailed   whitelist + lokasi
GET  /api/rules            custom WAF rules + per-path rules
GET  /api/config           konfigurasi engine
GET  /api/cluster          status cluster
POST /api/block | /unblock /api/whitelist /api/unwhitelist
POST /api/mode | /api/emergency
POST /api/rules            action: add-custom | remove-custom | clear-custom | add-path | remove-path
POST /api/alerts/test      kirim alert uji
POST /api/reset            reset counter rate limiter

Feature

Dashboard

Real-time control center for the whole engine — available on port 3000 behind HTTP Basic auth.

Pages

Page	Purpose
Overview	Security posture, mode and attack summary.
Analytics	Threat timeline and traffic verdicts.
Traffic	Throughput, request sources and mitigation.
Geo Map	Visitor & attacker country distribution.
Blocklist	Manage blocked IPs.
Whitelist	Manage trusted IPs (with location info).
Challenge	Interstitial status & failed-challenge IPs.
Cluster	Node, peer, tombstone and sync event status.
Rules	WAF modules, custom rules and per-path rate limits.
Event Log	Security event history.
Settings	Engine configuration & webhook alerts.

API Reference

GET  /api/stats            full summary (SSE: /api/stats/stream)
GET  /api/blocklist        blocked IPs (with geo)
GET  /api/whitelist        trusted IPs
GET  /api/whitelist/detailed   whitelist + location
GET  /api/rules            custom WAF rules + per-path rules
GET  /api/config           engine configuration
GET  /api/cluster          cluster status
POST /api/block | /unblock /api/whitelist /api/unwhitelist
POST /api/mode | /api/emergency
POST /api/rules            action: add-custom | remove-custom | clear-custom | add-path | remove-path
POST /api/alerts/test      send a test alert
POST /api/reset            reset rate limiter counters

Fitur

Webhook Alert (Telegram & Discord)

Notifikasi otomatis ke chat pribadi/group Anda saat terjadi peristiwa penting.

Peristiwa yang memicu alert

• Attack detected / subsided — serangan mulai / berakhir.
• Emergency mode ON/OFF — mode darurat.
• Aggressive mode ON — mode agresif diaktifkan.
• Flood mode ON — flood HTTP terdeteksi.
• Critical log — pesan log level critical.

Konfigurasi

{
  "alerts": {
    "enabled": true,
    "minSeverity": "warning",
    "cooldown": 60000,
    "discord": "https://discord.com/api/webhooks/...",
    "telegram": { "botToken": "123456:ABC...", "chatId": "-1001234567890" }
  }
}

Kunci	Deskripsi
enabled	Aktif/nonaktifkan seluruh alert.
minSeverity	Level minimum: info | warning | critical.
cooldown	Jarak minimum antar alert identik (ms).
discord	Webhook URL Discord (embed alert).
telegram	Bot token + chat ID Telegram.

Feature

Webhook Alerts (Telegram & Discord)

Automatic notifications to your private chats/groups on important events.

Events that trigger alerts

• Attack detected / subsided — attack started / ended.
• Emergency mode ON/OFF — emergency mode.
• Aggressive mode ON — aggressive mode enabled.
• Flood mode ON — HTTP flood detected.
• Critical log — critical-level log messages.

Configuration

{
  "alerts": {
    "enabled": true,
    "minSeverity": "warning",
    "cooldown": 60000,
    "discord": "https://discord.com/api/webhooks/...",
    "telegram": { "botToken": "123456:ABC...", "chatId": "-1001234567890" }
  }
}

Key	Description
enabled	Enable/disable all alerts.
minSeverity	Minimum level: info | warning | critical.
cooldown	Minimum gap between identical alerts (ms).
discord	Discord webhook URL (embed alert).
telegram	Telegram bot token + chat ID.

Fitur

Geo & Monitoring

Lihat dari mana pengunjung dan penyerang Anda berasal.

Data geolokasi

Setiap IP yang terpantau dilengkapi negara, kota, dan koordinat (via database GeoLite). Data dihitung otomatis dari request yang masuk — tanpa basis data eksternal tambahan.

Yang bisa Anda lihat

• Geo Map — distribusi negara sumber request dengan bar visual.
• Top Sources — IP teraktif beserta negara & kotanya.
• Blocklist & Whitelist — setiap entri diperkaya lokasi.
• Challenge failures — negara asal IP yang gagal verifikasi.

Feature

Geo & Monitoring

See where your visitors and attackers come from.

Geolocation data

Every monitored IP is enriched with country, city and coordinates (via the GeoLite database). Computed automatically from incoming requests — no extra external database required.

What you can see

• Geo Map — country distribution of request sources with visual bars.
• Top Sources — most active IPs with country & city.
• Blocklist & Whitelist — every entry enriched with location.
• Challenge failures — countries of IPs that failed verification.

Proteksi

Proteksi Layer 4

Menangkal serangan volumetrik dan protokol di level jaringan & transport.

Vektor serangan yang ditangani

• SYN Flood — proteksi setengah-open connection per IP.
• UDP Flood — analisis paket dan pembatasan laju per IP.
• ACK / RST Flood — validasi state koneksi TCP.
• Amplification — DNS, NTP, SSDP, dan refleksi lain.
• ICMP Flood — pembatasan paket ICMP.

Pengaturan bawaan

Parameter	Nilai default
Max half-open connection per IP	10
Max koneksi per detik per IP	50
Max koneksi aktif per IP	100
Bogon filter	aktif
Deteksi port scan	aktif
UDP amplification protection	aktif

Protection

Layer 4 Protection

Stops volumetric and protocol attacks at the network & transport layer.

Attack vectors handled

• SYN Flood — half-open connection protection per IP.
• UDP Flood — packet analysis and per-IP rate limiting.
• ACK / RST Flood — TCP connection state validation.
• Amplification — DNS, NTP, SSDP and other reflections.
• ICMP Flood — ICMP packet rate limiting.

Defaults

Parameter	Default
Max half-open connections per IP	10
Max connections per second per IP	50
Max active connections per IP	100
Bogon filter	enabled
Port scan detection	enabled
UDP amplification protection	enabled

Proteksi

Layer 7 & WAF

Melindungi aplikasi dari serangan yang meniru trafik manusia.

Proteksi Layer 7

• HTTP / HTTPS Flood — deteksi perilaku request abnormal.
• Slowloris, Slow POST/Read — batasi koneksi idle dan lambat.
• Brute-force login — rate limiting per path dan per IP.
• Web scraping — deteksi headless browser dan pola otomatisasi.

Aturan WAF bawaan

Modul	Keterangan
SQL Injection	Deteksi pola injeksi pada parameter.
XSS	Blokir skrip berbahaya pada input.
Path Traversal	Cegah akses ke path di luar direktori.
Command Injection	Blokir eksekusi perintah via input.
LFI / RFI	Cegah include file lokal & remote.
Shellshock & scanner	Blokir eksploitasi dan probing otomatis.

Custom WAF Rules

Tambahkan aturan regex Anda sendiri yang diterapkan ke path, query, body, header, dan cookie. Skor ≥ 50 akan memblokir request.

{
  "defense": {
    "waf": {
      "customRules": [
        { "name": "block-bad-bot", "pattern": "/badbot/i", "score": 60, "type": "custom" }
      ]
    }
  }
}

Per-Path Rate Limit

Atur ambang RPS spesifik per path, misalnya membatasi endpoint login. Gunakan * untuk prefix.

{
  "defense": {
    "rateLimit": {
      "perPathRPS": 1000,
      "pathRules": [
        { "path": "/api/login", "rps": 20 },
        { "path": "/api/*", "rps": 200 }
      ]
    }
  }
}

Protection

Layer 7 & WAF

Protects your app from attacks that mimic human traffic.

Layer 7 protection

• HTTP / HTTPS Flood — abnormal request behavior detection.
• Slowloris, Slow POST/Read — idle and slow connection limits.
• Login brute-force — per-path and per-IP rate limiting.
• Web scraping — headless browser and automation detection.

Built-in WAF rules

Module	Description
SQL Injection	Injection pattern detection on parameters.
XSS	Blocks malicious scripts on input.
Path Traversal	Prevents access outside allowed directories.
Command Injection	Blocks command execution via input.
LFI / RFI	Prevents local & remote file inclusion.
Shellshock & scanners	Blocks exploits and automated probing.

Custom WAF Rules

Add your own regex rules applied to path, query, body, headers and cookies. Score ≥ 50 blocks the request.

{
  "defense": {
    "waf": {
      "customRules": [
        { "name": "block-bad-bot", "pattern": "/badbot/i", "score": 60, "type": "custom" }
      ]
    }
  }
}

Per-Path Rate Limit

Set a specific RPS ceiling per path, e.g. to throttle a login endpoint. Use * for prefix matching.

{
  "defense": {
    "rateLimit": {
      "perPathRPS": 1000,
      "pathRules": [
        { "path": "/api/login", "rps": 20 },
        { "path": "/api/*", "rps": 200 }
      ]
    }
  }
}

Layanan

Layanan API Custom

Selain proteksi DDoS, GarudaShield membangun API sesuai kebutuhan bisnis Anda. Konsultasi dan order langsung via WhatsApp.

Yang bisa kami bangun

Alur order

1. Hubungi WhatsApp +62 831-8781-5456 dan jelaskan kebutuhan Anda.
2. Diskusikan spesifikasi, estimasi biaya, dan timeline.
3. Kami kerjakan, uji, lalu serahkan dengan dokumentasi.

Service

Custom API Service

Beyond DDoS protection, GarudaShield builds APIs to fit your business. Consultation and orders via WhatsApp.

What we can build

Order flow

1. Contact us on WhatsApp +62 831-8781-5456 and describe your needs.
2. Discuss specifications, cost estimate and timeline.
3. We build, test and deliver with documentation.

Paket

Paket & Harga

Tanpa kontrak panjang, tanpa biaya setup. Batalkan kapan saja.

Fitur	Startup	Business	Enterprise
Harga	Rp350k/bln	Rp1.250k/bln	Custom
Kapasitas mitigasi	20 Gbps	100 Gbps	Tanpa batas
Domain terproteksi	1	3	Tak terbatas
WAF Layer 7	—	✓	✓
Verify Browser	—	✓	✓
Cluster multi-node	—	✓	✓
Load balancing & failover	—	✓	✓
Notifikasi real-time	E-mail	Telegram	Telegram + TAM
SLA tertulis	—	—	99.99%

Semua paket termasuk SSL otomatis (Let's Encrypt) dan dashboard monitoring. Hubungi kami untuk trial 7 hari.

Plans

Plans & Pricing

No long contracts, no setup fees. Cancel anytime.

Feature	Startup	Business	Enterprise
Price	Rp350k/mo	Rp1.250k/mo	Custom
Mitigation capacity	20 Gbps	100 Gbps	Unlimited
Protected domains	1	3	Unlimited
Layer 7 WAF	—	✓	✓
Verify Browser	—	✓	✓
Multi-node cluster	—	✓	✓
Load balancing & failover	—	✓	✓
Real-time notifications	E-mail	Telegram	Telegram + TAM
Written SLA	—	—	99.99%

All plans include automatic SSL (Let's Encrypt) and a monitoring dashboard. Contact us for a 7-day trial.

Riwayat

Changelog & Versi

Catatan perubahan mesin GarudaShield.

History

Changelog & Version

GarudaShield engine change log.

FAQ

FAQ

Apa itu serangan DDoS?

Distributed Denial of Service adalah serangan yang membanjiri server dengan trafik palsu hingga layanan tidak dapat diakses pengguna asli. Serangan terjadi di layer jaringan (L3/4) atau layer aplikasi (L7).

Seberapa cepat serangan dideteksi?

Ambang deteksi di bawah 3 detik. Mesin mitigasi langsung aktif di edge tanpa intervensi manusia.

Apakah GarudaShield memperlambat website?

Tidak — umumnya lebih cepat, karena trafik diarahkan ke PoP terdekat melalui jaringan anycast. Optimalisasi SSL dan HTTP/3 aktif secara default.

Apakah IP origin saya terlihat?

Tidak. Hanya IP anycast GarudaShield yang tampil di DNS publik. Alamat IP origin dienkripsi dan tidak pernah diekspos.

Apa itu Verify Browser dan apakah pengunjung terganggu?

Verify Browser adalah interstitial ringan untuk pengunjung pertama. Manusia lolos otomatis dalam < 2 detik tanpa interaksi. Setelah cookie gs_ok terpasang, kunjungan berikutnya langsung masuk.

Bagaimana cara memesan?

Hubungi WhatsApp +62 831-8781-5456. Tim kami membantu pilih paket, proses trial 7 hari, dan pandu setup hingga selesai.

FAQ

FAQ

What is a DDoS attack?

A Distributed Denial of Service attack floods a server with fake traffic until real users can no longer reach the service. Attacks happen at the network layer (L3/4) or the application layer (L7).

How fast are attacks detected?

Detection threshold is under 3 seconds. The mitigation engine activates at the edge automatically with no human intervention.

Does GarudaShield slow my website down?

No — usually it is faster, because traffic is routed to the nearest PoP via the anycast network. SSL and HTTP/3 optimization are on by default.

Is my origin IP visible?

No. Only the GarudaShield anycast IP appears in public DNS. The origin IP address is encrypted and never exposed.

What is Verify Browser and do visitors get bothered?

Verify Browser is a lightweight interstitial for first-time visitors. Humans pass automatically in under 2 seconds with no interaction. Once the gs_ok cookie is set, subsequent visits go straight through.

How do I order?

Contact us on WhatsApp +62 831-8781-5456. Our team helps you pick a plan, runs the 7-day trial, and guides you through setup.

Dukungan

Dukungan

Butuh bantuan? Tim kami siap membantu setiap hari, 08.00–22.00 WIB.

Support

Support

Need help? Our team is available every day, 08:00–22:00 WIB.