There are two ways to put a DDoS protection proxy in front of your sites. You can rent one: a managed proxy plan, where the provider runs the software, the network and the on-call rota. Or you can run one: a licensed proxy on a server you control, where the software is supplied but the machine, the configuration and the 3 a.m. alerts are yours.
Self-hosted DDoS protection is the second route. It suits some businesses very well and others not at all, and the difference comes down to arithmetic and staffing. This guide sets out both, with real prices.
What a self-hosted proxy is
A proxy licence gives you the filtering software. At NexonHost that is the WS Proxy V7 licence, the WorldShield v7 engine described in how a DDoS protection proxy works. You install it on your own server, point your domains at that server, and it forwards clean traffic to your origins. The Standard licence includes:
- layer 7 protection engines (Sentinel and Crack) and the full management panel
- unlimited domains per node, with Let's Encrypt certificates renewed automatically
- GeoIP, ASN and IP2Proxy filtering, and a testcookie anti-bot challenge using JavaScript or a redirect
- request filtering, HTTP method blocking and backend health monitoring
- master/slave cluster sync between nodes, automatic updates, and settings backup and restore
The licence costs €49 a month per node on Standard, €99 on Professional, which adds AI-assisted investigation and configuration plus five priority tickets a month, and €299 on Enterprise, which adds a dedicated account manager, live chat, unlimited tickets and assisted onboarding. Two conditions matter before you buy: the Standard licence requires Ubuntu 24, and once activated it is tied to the server's IP address and cannot be migrated.
The one thing a self-hosted proxy cannot do alone
A proxy inspects traffic. A volumetric flood never gets inspected, because it fills the network port first. A proxy node on a 1 Gbps port is knocked offline by a few gigabits of junk, however good its layer 7 engines are.
So a self-hosted proxy has to sit on a network that absorbs layer 3 and 4 floods before they reach it. On a NexonHost dedicated server that is built in: the Xeon and EPYC 9004 builds include 40 Gbps / 4 Mpps of layer 4 mitigation upstream of the port, with upgrades to 80 Gbps for €250 a month, 100 Gbps for €300, and up to 1 Tbps / 100 Mpps for €1,500. On a server without upstream mitigation, a self-hosted proxy protects your origins from application-layer attacks and nothing else. How much DDoS protection is enough for a dedicated server covers how to size that layer.
The costs, side by side
| Self-hosted, 1 node | Self-hosted, 2 nodes | Managed Micro | Managed Business | Managed Enterprise | |
|---|---|---|---|---|---|
| Monthly | €178 | €356 | €49 | €399 | €710 |
| Made up of | €49 licence + €129 server | 2 × (licence + server) | Plan | Plan | Plan |
| Clean traffic | Port-limited: up to about 324 TB at 1 Gbps | Up to about 648 TB | 3 TB | 15 TB | Unmetered |
| Layer 4 absorption | 40 Gbps included, up to 1 Tbps | 40 Gbps per node | 10 Gbps | 50 Gbps | 100 Gbps included, up to 1 Tbps |
| Domains | Unlimited per node | Unlimited | Unlimited | Unlimited | Unlimited |
| Who operates it | You | You | NexonHost | NexonHost | NexonHost |
The self-hosted columns use the entry dedicated server, two Xeon E5-2630 v4 processors with an unmetered 1 Gbps port. Managed prices are monthly; annual billing takes 10% off.
Two things stand out. Below a few terabytes a month, the managed Micro plan costs the same as the licence alone, with the network and the operations included, so self-hosting makes no sense there. Above 15 TB a month, a self-hosted node carries far more clean traffic per euro than any plan sold by the terabyte, because the server's port is unmetered.
When self-hosting is the right call
- You protect many domains. Hosting companies, agencies and resellers with hundreds of customer sites get unlimited domains on every node.
- Your clean traffic is large. Tens or hundreds of terabytes a month is where an unmetered server port beats a clean-traffic allowance.
- Your TLS keys have to stay on your hardware. A proxy must terminate TLS to inspect HTTP. With a managed proxy that happens on the provider's machines; with a self-hosted one it happens on yours.
- You want your own rules and your own logs. Custom filters, your own logging pipeline and your own change control.
When it is the wrong call
- Nobody on the team runs Linux servers. You patch the operating system, watch the node and handle the incident. The Standard licence includes two support tickets a month; full 24/7 support is an add-on at €450 a month.
- You need one site protected today. A managed plan is live as soon as DNS changes. A self-hosted node needs a server, an install and a configuration first.
- You want large absorption without sizing it yourself. Managed Enterprise includes 100 Gbps of layer 4 absorption and emergency support.
A practical self-hosted layout
- Two proxy nodes on dedicated servers in different locations, kept in step by the licence's master/slave sync.
- DNS for every protected domain pointing at the proxy nodes.
- Origins firewalled so they accept web traffic from the proxy nodes' addresses only. The origin has to stay hidden: how to hide your origin IP lists the eight usual leaks.
- Layer 4 mitigation on the proxy nodes, sized for the attacks you actually see rather than the largest one on record.
- Real visitor IPs restored at the origin, so logs and rate limits keep working; getting real visitor IPs on your backend shows how.
Choose the proxy nodes' IP addresses before activating the licences, since each licence is tied to one address. Unlike the origin, a proxy node's address is meant to be public; the network mitigation in front of it is what keeps it standing.
Try it before you commit
First-time customers of a service get 7 days under NexonHost's money-back guarantee, but DDoS-protected services stop being refundable after 3 days of use, so put your real traffic through a test node early rather than late.
Where to start
The DDoS protection license page lists the three tiers, and the node itself can be any dedicated server with mitigation included. If you would rather not operate it, the managed anti-DDoS proxy plans start at €49 a month, and DDoS protection server vs remote DDoS protection compares protecting a server directly with protecting it remotely.
Specifications and pricing are as of 28 September 2026 — check the product pages for current figures.
Sources
- NexonHost store, WS Proxy V7 licence: features, Ubuntu 24 requirement, IP binding, support add-on. Retrieved 28 September 2026.
- Remote DDoS Protection License, NexonHost: Standard, Professional and Enterprise tiers. Retrieved 28 September 2026.
- NexonHost store, remote protection plans and dedicated server DDoS mitigation options. Retrieved 28 September 2026.
- Terms of Services, NexonHost, section 11, money-back guarantee. Retrieved 28 September 2026.
- Computed: 1 Gbps × 2,592,000 s ÷ 8 = 324 TB per 30-day month; €49 + €129 = €178.
