Contents
Getting started
10-minute quick startArchitecture
Install and upgrade
Install the controllerAdd nodesOnline upgradesStaged rollout and automatic rollbackBackup and point-in-time restoreUninstall and migrate
Sites
Add a siteSet up the CNAME recordHTTPS certificatesCache rulesPurge and prefetchOrigin settingsAlways Online, 0-RTT and 103 Early HintsTiered origin (L2)Stream forwarding (Layer 4)
Security
Security overview and big screenWebsite checkupAttack logCC protectionWAFLists and access controlBots and scannersJA4 / TLS fingerprintXDP kernel-level filteringPaid features
Analytics and alerts
StatisticsAccess logsAlerts and notificationsAlert channels
Accounts and licensing
Users and plansLicenses and add-onsOnline top-up and identity verification

XDP kernel-level filtering

About 5 minApplies to v2.3.1Updated 2026-11-02

XDP fast filtering drops banned IPs and blocklisted traffic at the NIC driver layer (XDP), before the kernel network stack, reducing the cost that floods of malicious connections impose on a node. Open Node Management › XDP Fast Filtering. This is a licensed add-on; see Licenses and add-ons for license status.

Requirements

  • The node's NIC and driver support XDP, and the kernel is 5.10 or later. Otherwise the node stays in Standard mode and the page shows the reason.
  • Filtering covers website ports only: TCP 80 / 443 and UDP 443. The allowlist, the master address, SSH and admin ports, and health-probe points are let through first and never dropped.

Two modes

Each node shows its current mode and the reason:

ModeMeaning
Fast modeBanned and blocklisted traffic is dropped at the NIC driver layer
Standard modeThe system firewall blocks it; bans and lists stay the same, but filtering does not happen at the NIC driver layer

Available actions: Enable Fast mode, Switch to Standard mode, Pause, Resume and Switch to manual resume.

Pause and automatic fallback

  • Pause: all nodes temporarily run in Standard mode, with no gap in protection. A pause can resume automatically after a number of hours, or you can switch to manual resume, in which case you must click Resume yourself.
  • Automatic fallback: if something abnormal happens at runtime, the node falls back to Standard mode on its own and raises an alert, and sites keep serving normally. Re-enable it once the cause is fixed.

To switch it off on the node itself, run as root:

gocdn-agent xdp off

License and upgrades

  • After the license expires there is a buffer period: nodes already deployed when it began keep running, and other nodes are not deployed. When the buffer ends or the license is withdrawn, all nodes run in Standard mode and bans and lists keep working. Renewal restores it automatically.
  • After a node program upgrade, the XDP component is deployed automatically; no separate installation is needed.
Tip XDP only handles traffic already decided to be blocked (bans and blocklists). Detecting attacks is still done by CC, WAF and Bot protection; see CC protection and Lists and access control.