Public endpoint DDoS protection
Inspect edge mitigation, service exposure, and application-layer limits.
Edge protection applies network mitigation to managed public endpoints. It is separate from project firewall authorization and from application request policy.
Coverage
Open Networking → Public addresses → Address → Edge protection. For an owned-node endpoint, use Fleet → Nodes → Node → Networking → Public endpoints. The view identifies the actual ingress path and protection state.
Managed public assignments inherit the region's baseline edge policy. The endpoint view shows active protection, ingress region, recent mitigation events, and configuration exceptions. Local or externally routed public addresses require the deployment's supported edge path; an address record alone is not proof that packets traverse it.
Node public addressing is managed by fleet administrators. Public management interfaces still require restricted inbound policy. DDoS mitigation does not make unrestricted SSH or agent endpoints acceptable exposure.
Mitigation behavior
An event can produce dropped traffic, filtered flows, or routing changes at the edge. The journal identifies affected endpoint, observation interval, mitigation class, and current state. A mitigation event is not necessarily a guest failure.
Project firewall allowlists continue to apply after the edge path. An allow rule does not bypass mitigation, and mitigation does not grant traffic that a firewall rejects.
Application traffic
Layer 3/4 filtering does not establish that an HTTP request is authorized or cheap for an application to process. Configure authentication, request limits, and backend capacity for exposed services. TLS pass-through restricts what the edge can inspect at the application layer.
Do not use a broad firewall change to resolve a filtered application request. Compare mitigation records, listener protocol, source identity, and application logs first.
Exceptions and incident handling
A mitigation exception identifies endpoint, source or protocol scope, owner, reason, and expiry. Organization policy can require approval. An exception to one mitigation class is not a blanket exemption from edge filtering.
During an incident, preserve endpoint ID, attack interval, applied policy, and service symptoms. Follow the region's escalation path for provider-level routing changes. Do not reassign addresses repeatedly without checking whether the new endpoint has the same route and protection dependency.
See public addresses, listener protocols, and alerts for the corresponding configuration and observations.