# Filtering profiles

> Protocol-aware profiles for game servers, VoIP, DNS and web — pick one per port range.

Source: https://docs.avenlith.com/en/filtering-profiles  
Category: DDoS protection  
Last updated: 2026-09-22

## Why profiles matter

Generic filters see only packet rates. Profiles understand the protocol: they know that a valid Source-engine query has a specific header, that a Minecraft login starts with a handshake, or that DNS responses must match an earlier query. Attack traffic that looks valid to a generic filter is dropped by the profile.

## Available profiles

| Profile | Protocols | Typical ports |
| --- | --- | --- |
| game-source | CS2, TF2, Garry's Mod (A2S) | UDP 27015–27030 |
| game-minecraft | Java and Bedrock | TCP 25565, UDP 19132 |
| game-rust | Rust / RakNet | UDP 28015–28016 |
| game-fivem | FiveM / RedM | TCP+UDP 30120 |
| voip-sip | SIP, RTP | UDP 5060, 10000–20000 |
| dns-auth | Authoritative DNS | UDP/TCP 53 |
| https-strict | TLS handshake validation | TCP 443 |
| generic | Rate and SYN protection only | any |

## Create rules

```bash
avenlith shield profile list
avenlith shield rule create --target 203.0.113.24 --protocol udp --port 27015-27030 --profile game-source
avenlith shield rule create --target 203.0.113.24 --protocol tcp --port 443 --profile https-strict
avenlith shield allowlist add 203.0.113.24 --source 198.51.100.7/32   # monitoring probe
```

> **Tip:** > Add your monitoring and payment-provider IPs to the allowlist so they are never challenged during an attack.

## Order of evaluation

Allowlist → blocklist → port rule with profile → default profile of the IP. The first matching rule wins.