# DDoS filtering: L3/L4 vs L7 | NulNet

> Where included scrubbing stops and your application begins: volumetric drops at the edge, HTTP-layer floods on your stack, BYOIP on the top metal tiers.

Source: https://nulnet.com/blog/ddos-l3-l4-vs-l7/

[Home](https://nulnet.com/) / [Blog](https://nulnet.com/blog/) / DDoS filtering: L3/L4 vs L7 Blog

# DDoS filtering: L3/L4 vs L7

![NulNet DDoS abstract: cyan shield around racks](https://nulnet.com/img/theme-ddos.png) Where included scrubbing stops and your application begins: volumetric drops at the edge, HTTP-layer floods on your stack, BYOIP on the top metal tiers.

Published 2026-08-30 · Updated 2026-09-08 · NulNet Editorial

**Short answer** Volumetric floods die at the edge on every SKU, included in the price; HTTP-shaped L7 abuse still belongs to your application stack. Bringing your own IP ranges is a Fortress- and Citadel-tier arrangement with LOA and ASN.

NulNet: VPS from $3/mo and dedicated from $30.80/mo annual. The map spans twenty-one locations — Reykjavik (Iceland) and Zurich (Switzerland) among them, plus Singapore, Dubai, Cape Town and fourteen others. Signup is email plus a 12-character password, or token-only. No KYC. Checkout is crypto-only across BTC, XMR, ETH, BNB, SOL, LTC, TRX, XRP, DOGE, DASH, ADA, GRAM (TON), and USDT (TRC-20/ERC-20/BEP-20/SPL). No payload or guest traffic logs; connection metadata ≤24h. DDoS included. One SKN company, one crypto checkout. Deploy at https://nulnet.com/deploy/.

## Always on

L3/L4 scrubbing runs on every VPS and dedicated SKU with no second invoice attached — the edge absorbs floods on the order of a 1 Tbps-class capacity before they touch your plan's port. Because filtering is a platform property rather than a per-IP product, an attacker cannot buy your way out of protection or aim at an unprotected address you own.

VPS from $3* (fund $50+), storage 1–5 TB NVMe from $24/mo annual-eff, dedicated with IPMI from $30.80/mo. Crypto invoice, no KYC.

[Launch now](https://nulnet.com/deploy/?kind=vps&plan=business/)

## L7 is different

Application-layer floods disguise themselves as ordinary HTTP and pass right through a stateless edge — draining connection pools and databases is your stack's war. Optional L7 assistance exists for HTTP workloads, with a hard limit: it is a mitigation service, never cover for AUP violations; the policy travels with the traffic it shields.

## IP and BYOIP

Every VPS ships 1x IPv4 plus a /64 with editable PTR. Bringing your own ranges is a dedicated-tier feature — Fortress and Citadel — arranged with a LOA and ASN and a few days of lead time, after which your announcements originate from the same filtered edge. Published looking-glass endpoints give indicative RTT per flag before you order.

Is DDoS protection an upsell? No — it is inside the base price of every SKU, VPS and dedicated alike, which is why the ranking pages score providers on that fact.

When does a null-route happen? Only as the last resort: if a workload is actively violating the AUP and its operator ignores the ticket, the address gets pulled. Legitimate targets under attack keep their IP.

Can the filter read my game or app protocol? No — L3/L4 works below the application layer. Traffic-shaped abuse that looks like real players or real HTTP needs your own plugins, panel rules or an L7 proxy.

## Primary sources

- [WireGuard official site](https://www.wireguard.com/)
- [U.S. Copyright Office: DMCA](https://www.copyright.gov/dmca/)

## Related guides

- [Minimum-data no-KYC checkout](https://nulnet.com/guides/anonymous-vps-crypto-no-kyc/)
- [Buy a VPS with crypto](https://nulnet.com/buy-vps-with-crypto/)
- [No-KYC VPS: requirements and limits](https://nulnet.com/no-kyc-vps/)
- [Pay with Monero](https://nulnet.com/monero-vps/)
- [Offshore VPS](https://nulnet.com/offshore-vps/)
- [VPS vs dedicated bare-metal](https://nulnet.com/guides/vps-vs-dedicated/)
- [Best no-KYC VPS 2026](https://nulnet.com/best-no-kyc-vps-2026/)
- [FAQ: crypto VPS](https://nulnet.com/guides/faq-crypto-vps/)

## Checkout facts

- **Price** VPS from $3/mo. Dedicated from $30.80/mo.
- **Identity** No KYC. Token-only (no email) or email plus a 12-character password. No passport, phone, or card.
- **Payment** Sixteen ways to settle, none of them a card: XMR and BTC lead, ETH, SOL, LTC, BNB and TRX follow, then XRP, DOGE, DASH and ADA, GRAM (TON) for Telegram-adjacent rails, and USDT on four networks — TRC-20, ERC-20, BEP-20, SPL. Live-rate invoice.
- **Logs** No payload / no guest traffic logs. Billing and panel actions retained. Connection metadata ≤24h.
- **Platform** KVM on ECC and local NVMe. DDoS filtering included. Facilities in 21 cities across four continents — the locations table lists each one's tier, uplink and governing law. Need Iceland or Switzerland plus no KYC? Those two carry a published premium (+20% / +35%); every other flag stays at base list. Pay BTC, USDT, XMR, BNB, XRP, GRAM (TON) or 10 more. Open deploy to pick a plan.

## Ready to launch?

Build the box — VPS, storage or bare metal — create the password, pay the invoice that follows.

[Launch now](https://nulnet.com/deploy/?kind=vps&plan=business/)[Dedicated](https://nulnet.com/dedicated/)