// FAQ
Questions, answered honestly.
What Argus does, what it does not, and what it needs from your side.
What does Argus actually protect against?
Attacks aimed at the network and transport in front of your service: volumetric floods, spoofed and malformed packets, SYN and UDP floods, and sources that open connections far faster than a player does. Volumetric traffic is filtered by the upstream network before it reaches our nodes; the rest is dropped or rate-limited at our edge, with a ruleset tuned for your protocol. It does not watch what a logged-in account does inside your game.
Does it replace my host's DDoS protection?
Argus becomes that layer. Players connect to a protected Argus IP instead of your origin, so your host only ever sees the tunnel from us. Keep your origin firewall: it should accept the tunnel and your service ports and nothing else, so nobody can bypass Argus by hitting the origin IP directly.
Will my players feel added latency?
There is one extra hop: the player reaches the Argus node closest to them and the traffic then travels to your origin over our tunnel. We choose nodes near your player base and keep the path short, but we do not promise zero added latency, and we will tell you what we measure for your setup rather than a number from a brochure.
How hard is it to integrate?
You point your players at the protected IP and your origin terminates our GRE tunnel. On Metin2 the server source also needs proxy-IP support so the player IP, not the tunnel address, is what your game records: ENABLE_PROXY_IP, a proxy_ip entry in CONFIG and the matching overrides. We audit your source and tell you exactly what is missing before anything is switched over.
Can it stop abuse from real, logged-in accounts?
No, and nobody filtering at the network level can. Argus works per source address and per connection. Limits per account, per character or per action belong inside your game server, where the account is known.
Will it ever lock out my real players?
Limits are set per source with shared addresses in mind, because a CGNAT address can carry many legitimate players. If our control plane is unreachable, the last policy we applied stays in force rather than opening or closing everything, and we tune a profile with you instead of shipping one default for every game.
What is the difference between Guard and Fortress?
Guard gives one service a protected IP, edge filtering tuned to its protocol, the tunnel to a single origin and the full control plane. Fortress puts the same service on an anycast protected IP across our locations, adds a second upstream with a tested failover path, includes a second origin, and unlocks incidents, attack analytics, alerts and webhooks. The exact plan contents are finalised with the edge rollout.
How does billing work?
Per protected service, monthly. Self-serve checkout is not open yet: we are moving billing to monthly subscriptions, so today a service is quoted and activated by us after you request access.
What do I need to run it?
A service that speaks TCP or UDP and an origin that can terminate a GRE tunnel. Metin2 is our first tested profile; other games and services are onboarded with their own profile. The optional origin agent runs on FreeBSD with pf and needs root - it reports host and firewall telemetry and applies the access rules and modes you set in the dashboard.
What data do you see, and for how long?
Never the contents of your game traffic. The dashboard stores event metadata from your agent - source IP address, event type and time - plus host and firewall statistics. IP addresses are personal data under the GDPR, so treat the dashboard accordingly: events are kept 30 days and host snapshots 7 days, and you can export or delete your account data from the dashboard.