Since 23 October 2026, every NexonHost VPS, from the €9-a-month NEX1 up, carries the same 100 Gbps of Layer 4 DDoS protection as a dedicated server. That figure sits in front of a 10 Gbps port on NEX plans and a 1 Gbps port on UNEX plans, and the gap between the two is easy to misread. Below: what the ratio means for VPS DDoS protection, what still gets through, and when a VPS stops being the right answer.
Filter capacity is upstream; the port is yours
The protection figure is filter capacity: how much attack traffic the provider can drop before it reaches you. A 1 Gbps port can't carry 100 Gbps, so whatever drops that much has to sit upstream of the port. NexonHost's DDoS protected server page says floods "are dropped upstream, before they reach your port", and the VPS pages list the same 100 Gbps Layer 4 tier.
The port is your own pipe: the most traffic, attack or real, that can reach your VPS at once. Once it is full, users can't get in, and firewall rules on the VPS run too late to help.
The ratio: 100× on UNEX, 10× on NEX
Divide the filter by the port:
- UNEX, 1 Gbps port: 100 Gbps ÷ 1 Gbps = 100× what the port can carry (50× or 25× with the 2 or 4 Gbps port upgrade).
- NEX, 10 Gbps port: 100 Gbps ÷ 10 Gbps = 10×.
A bigger ratio doesn't make UNEX safer: both plans get the same 100 Gbps of filtering. The port decides how much room clean traffic has beside whatever gets past the filter; the plan decides whether that traffic is metered. If 500 Mbps of real-looking attack traffic gets through, it takes half a UNEX port and 5% of a NEX port: NEX gives more headroom, UNEX no meter.
Gbps is also only one meter: small-packet floods can exhaust a filter's packet budget first, so ask about packet rate too, as Gbps vs Mpps explains.
What still reaches a VPS when the filter works
A network filter drops what it can tell apart from your users. Three things it can't.
Traffic that looks legitimate at Layer 4
Complete TCP connections from real addresses, or well-formed packets to a UDP port you run, look like users at Layer 4 and reach your kernel. SYN flood protection covers hardening the TCP stack; game server DDoS protection covers public UDP services.
Layer 7 floods on a website
NexonHost's DDoS page says Layer 7 is "not in the included tier; the 10 Tbps tier adds Layer 7 filtering", and on a VPS that tier is €4,499 a month: 4,499 ÷ 9 = 499.89, about 500 times NEX1's price.
The proportionate fix is the website DDoS protection proxy: its Micro plan is €49 a month (€44.10 a month billed annually) with 10 Gbps of Layer 4 protection and a web challenge for bots. NEX1 plus Micro is €58 a month; NEX1 plus 10 Tbps is €4,508, which is 4,508 ÷ 58 = 77.7 times as much. The proxy carries HTTP(S) only, not game, SIP, WireGuard or DNS traffic.
Your own vCPU and RAM
NEX1 and UNEX1 have one vCPU and 2 GB of RAM, shared by everything that passes the filter. PHP's default PHP-FPM pool file ships pm.max_children = 5; if each request takes 0.5 seconds, that is 5 ÷ 0.5 = 10 requests a second before visitors queue. Ten 1,000-byte requests a second is 10 × 1,000 × 8 = 80 kbit/s, far below anything a volumetric filter looks for.
Metered traffic: the question to ask before you pick NEX
NEX plans meter transfer: 4 TB a month on NEX1, up to 32 TB on NEX4. Does attack traffic count towards that quota, whether dropped upstream or passed through to your port? The store and the VPS pages don't say. The dedicated page's line that clean traffic "is not capped or billed while an attack is being filtered" answers a question about dedicated servers' unmetered ports, not a NEX quota. Before you put an exposed service on NEX, ask sales two things: does attack traffic count, and what happens when the quota runs out?
To size the risk meanwhile, suppose it did count. Cloudflare's DDoS threat report for the first half of 2026 found that 96.62% of the network-layer attacks it mitigated stayed under 500 Mbps and 90.60% ended in under 10 minutes; the rest of its figures are in our cheap DDoS protected dedicated server guide. An attack at both limits, 500 Mbps for 10 minutes, is 0.5 × 600 ÷ 8 = 37.5 GB, about 0.9% of NEX1's 4 TB. A full 10 Gbps port for an hour is 10 × 3,600 ÷ 8 = 4,500 GB, more than NEX1's whole month.
UNEX avoids the question: no quota, only the port. Unmetered VPS in the Netherlands works out where UNEX becomes cheaper than NEX on ordinary traffic.
Neighbours, shared hosts and null-routes
A VPS is a share of one physical host. Your vCPU and RAM are allocated to you; the host's network interface and uplinks carry every tenant's traffic. A flood reaching the host would slow the neighbours too, which is why volumetric filtering belongs in the network, ahead of the hosts, rather than on each VPS.
When an attack exceeds what a network can absorb, a common last resort is destination-based blackholing, or null-routing. RFC 5635 describes the trade-off: attack and legitimate traffic to the address are both dropped, "taking the target completely offline", so that collateral damage to other systems is limited. On a VPS host, those other systems include the neighbours. Server under DDoS attack: what to do covers how blackholing works and what to do in the first hour.
Ask any provider, us included: what happens to my address when an attack exceeds the tier, for how long, and will I be told?
NEX or UNEX: which VPS for which exposure
| Plan · vCPU, RAM | Per month | Port · traffic | 100 Gbps L4 ÷ port |
|---|---|---|---|
| NEX1 · 1, 2 GB | €9 | 10 Gbps · 4 TB | 10× |
| NEX2 · 2, 4 GB | €18 | 10 Gbps · 8 TB | 10× |
| NEX3 · 4, 8 GB | €32 | 10 Gbps · 16 TB | 10× |
| NEX4 · 8, 16 GB | €64 | 10 Gbps · 32 TB | 10× |
| UNEX1 · 1, 2 GB | €18 | 1 Gbps · unmetered | 100× |
| UNEX2 · 2, 4 GB | €32 | 1 Gbps · unmetered | 100× |
| UNEX3 · 4, 8 GB | €54 | 1 Gbps · unmetered | 100× |
| UNEX4 · 8, 16 GB | €89 | 1 Gbps · unmetered | 100× |
Monthly billing, excluding VAT; annual billing takes 10% off (NEX1 €8.10, UNEX1 €16.20). Every plan is KVM with SSD storage.
| Exposure | Start on | Why |
|---|---|---|
| Website or API, modest traffic | NEX1–NEX2, plus the website proxy if HTTP floods are likely | Layer 7 isn't in the included tier |
| Public UDP or TCP service on a known IP | UNEX | No quota for a flood to touch |
| Release days, bursty downloads | NEX, sized by monthly total | 10 Gbps headroom; packs from €5 |
| An address attacked every week | Upgrade tier, or dedicated | See the next section |
When to move to a dedicated server
Protection doesn't decide between VPS and dedicated here: both get the same included 100 Gbps and the same paid ladder. Move when the rest of the bill says so.
- Your address needs an upgrade tier. 500 Gbps is €149 a month, 149 ÷ 9 = 16.6 times NEX1's price. UNEX1 with it is €18 + €149 = €167; the entry dedicated server with it is €129 + €149 = €278. The extra €111 swaps one vCPU, 2 GB and 40 GB for 20 cores and 40 threads, 128 GB of RAM and a 240 GB SSD, at the same 1 Gbps port speed, unmetered on both.
- You filter at Layer 7 on the box. Rate limiting, bot challenges and TLS cost CPU; on one vCPU, filter and application share a core.
- Attacks are sustained. No other tenant shares a dedicated server's CPU or network interface, and you have cores to spare for what leaks through.
The DDoS protected dedicated server page lists seven builds, from €129 a month with 100 Gbps included.
VPS DDoS protection at NexonHost
NexonHost's VPS DDoS protection is the same on every plan: 100 Gbps at Layer 4, included. A Linux VPS starts with NEX1 at €9 a month on a 10 Gbps port with 4 TB of traffic; an unmetered Linux VPS starts with UNEX1 at €18 a month on an unmetered 1 Gbps port. Both are offered in Germany, the Netherlands and Romania. Upgrades run from 500 Gbps for €149 to 10 Tbps with Layer 7 for €4,499 a month.
It won't stop HTTP floods or spare your CPU, and the NEX quota questions go to sales first. Start on a one-month term.
Prices as of 26 October 2026, in euros excluding VAT. Check the product page before you order.
Sources
- Cloudflare DDoS Threat Report H1 2026 — first half-year edition, January to June 2026, published 11 August 2026: 96.62% of network-layer attacks under 500 Mbps, 90.60% ending in under 10 minutes, retrieved 26 October 2026.
- RFC 5635 — Remote Triggered Black Hole Filtering with Unicast Reverse Path Forwarding, IETF: RTBH "a popular and effective technique" (abstract); destination-based RTBH drops attack and legitimate traffic, "taking the target completely offline", and limits collateral damage (section 1), retrieved 26 October 2026.
- www.conf.in — PHP-FPM default pool configuration, php-src repository: pm = dynamic, pm.max_children = 5, retrieved 26 October 2026.
- NexonHost store and product pages (Linux VPS, unmetered Linux VPS, DDoS protected dedicated servers, website DDoS protection) — VPS plans, ports, traffic quotas and packs, UNEX port upgrades, VPS regions, DDoS tiers, the proxy's Micro plan (price, annual price, 10 Gbps L4, web challenge) and the entry dedicated build, retrieved 26 October 2026.
- Computed: 100 ÷ 1 = 100×; 100 ÷ 2 = 50×; 100 ÷ 4 = 25×; 100 ÷ 10 = 10×; 0.5 ÷ 1 = 50%; 0.5 ÷ 10 = 5%; 4,499 ÷ 9 = 499.89; 4,499 + 9 = 4,508; 49 + 9 = 58; 4,508 ÷ 58 = 77.7; 5 ÷ 0.5 = 10 requests/s; 10 × 1,000 × 8 = 80 kbit/s; 0.5 × 600 ÷ 8 = 37.5 GB; 37.5 ÷ 4,000 = 0.9%; 10 × 3,600 ÷ 8 = 4,500 GB; 149 ÷ 9 = 16.6; 18 + 149 = 167; 129 + 149 = 278; 278 − 167 = 111.
