# Order and use a custom profile

> Order a custom DDoS Shield profile, bind your floating IPs to it, and block or unblock traffic sources on them.

Source: https://docs.coritan.com/ddos-shield/custom-profiles/

In the dashboard:

- /dashboard/ddos/profiles: https://www.coritan.com/dashboard/ddos/profiles
- /dashboard/order/ddos-shield: https://www.coritan.com/dashboard/order/ddos-shield

A *custom profile* is a DDoS Shield profile that you order as a service. It holds one protection mode, one set of rate limits and rules, and one choice of what happens when no rule matches, for every floating IP you bind to it. It also lets you block traffic sources on those addresses. The **Profiles** tab of DDoS Shield lists your custom profiles.

An address can also have a profile of its own, at no charge, from its **Shield** tab ([Change a floating IP's DDoS protection](/floating-ips/shield-settings/)). A custom profile is for addresses that should share their settings, and for blocking sources.

## Before you begin

- A custom profile filters only the floating IPs you bind to it. It cannot filter a server's shared address ([How DDoS Shield works](/ddos-shield/how-ddos-shield-works/#what-ddos-shield-covers)).
- An address uses one profile at a time. When you bind an address that has a profile of its own, it moves to the custom profile, and the rules of its own profile stop applying to it.
- Every address you bind shares the profile's settings. A change on the **Shield** tab of one of them applies to all of them.
- The plans' descriptions name packet rates, but every plan starts with the same rate limits as any new profile ([Rate limits](/floating-ips/shield-settings/#rate-limits)). Set the limits you need yourself, as [Change the settings](#change-the-settings) shows.
- For the first invoice, credit on your account pays first. Otherwise you pay by card or PayPal on the page the order lands on ([How the first payment works](/get-started/order-a-service/#how-the-first-payment-works)).

## Order a custom profile

Open the order page in one of these ways:

- In the sidebar, select **DDoS Shield**, then **Order custom profile** at the top of the page. The button is on every tab, and the **Profiles** tab repeats it while you have no custom profile.
- On [**Order a service**](https://www.coritan.com/dashboard/order), select the **DDoS Shield** card under **Network and security**.

The page has three numbered sections, and the summary under **Your order** sits beside them. On a phone the summary follows the sections, and **Review order** at the bottom of the screen takes you to it.

1. Under **Plan**, choose a plan. Each card shows the plan's description and its price.
2. Choose the billing cycle with the buttons beside the **Plan** heading, such as **Monthly**. A longer term names what it saves, such as `Annually · save 20%`.
3. Under **Profile**, enter a **Profile name** of up to 100 characters, such as `Game servers`. The profile's title on the **Profiles** tab is made from it, and the **Shield** tab of each bound address shows it. When you leave it empty, we name the profile `Custom Shield` followed by its service ID.
4. Choose the **Protection mode**. **Custom**, which the page starts on, applies the profile's own rate limits. **Standard** applies the platform's limits with your rules added ([Protection modes](/ddos-shield/how-ddos-shield-works/#protection-modes)). The order page does not offer **Passthrough**.
5. Under **When no rule matches**, choose **Allow**, which the page starts on, or **Drop**. The line under the buttons says what your choice does, such as `Traffic passes unless a rule drops it.`
6. Under **Addresses to protect**, tick each floating IP that the profile should filter. The line under an address says where it is now: `On the platform scrubbing today.`, or `It has a custom profile already. Binding moves it to this one.` for an address with a profile of its own or on another custom profile. You can leave every box empty and bind addresses later.
7. Check the summary. It lists the plan with its billing cycle, the **Protection mode** and the **Addresses**, such as `2 addresses` or `None yet; bind them later`, with **Change** beside each to go back to its section. The **Total** shows the price and what is due today, and the line under it says how the first invoice is paid.
8. Select the button under the summary. It reads **Place order and pay** when you pay after placing the order, and **Place order** when your credit pays for it or your account is billed in arrears. While the plan cannot be ordered, the button is greyed out and the line under it says why, such as `This plan is sold out right now.`

If we refuse the order, **Could not place the order** appears above the button with the reason, and your choices stay as they were.

Once you place it, the order's own page opens. When its title is **Order placed, payment due**, pay under **Pay invoice** with account credit, a saved card or PayPal account, or a new card ([Pay and follow the order](/get-started/order-a-service/#pay-and-follow-the-order)). To pay later, leave the page and pay the invoice under [Invoices](/billing/invoices/).

We set the profile up once its invoice is paid, and we bind the addresses you ticked. Until then, its card on the **Profiles** tab shows **Setting up**, and you cannot bind addresses to it. The order's page updates on its own. Its title becomes **Your order is ready** when the profile is active, and `Open profile` at the top of the page then opens DDoS Shield.

### Add a profile to another order

The order pages for Cloud Compute, Container Apps and Floating IPs offer a **DDoS Shield profile** card under **Add-ons** ([Add products to the order](/get-started/order-a-service/#add-products-to-the-order)). A profile you add there differs from one you order on its own page:

- It protects the addresses in that order. On an instance, those are its included public IPv4 and any floating IPs you add. On a server, it is the dedicated IPv4 address you add. On a floating IP order, it is the new address.
- It starts in **Custom** mode, with **Allow** when no rule matches.
- Its **Profile name** takes up to 40 characters. When you leave it empty, the profile takes the instance's or server's name.
- Until the order has an address, the card's switch stays off and the card says why: `Keep the included public IPv4 first. The profile protects addresses you own.` on Cloud Compute, or `Add the dedicated IPv4 address first. The profile protects addresses you own.` on Container Apps.

Once it is set up, the profile appears on the **Profiles** tab like any other.

## Read the Profiles tab

The tab shows a card for each custom profile that has not ended. With none, it shows **No custom DDoS profiles yet** and **Order custom profile**.

A profile's card shows:

- Its slug as the title, such as `game-servers-1043-a1b2`: the name in lower case with hyphens, the service ID and four random characters. Until we set the profile up, the title is the plan's name.
- The plan, its price per billing cycle and the next renewal date, with the service's status, such as `Active`.
- The protection mode that the profile was ordered with, such as `Custom mode`. The **Shield** tab of a bound address shows the mode in use.
- **Bound addresses**: each address bound to the profile, which links to its **Shield** tab, with **Unbind…** beside it. With none, the card says `No address is bound yet. The profile protects nothing until you bind one.`
- **Bind an address** and **Block a source**, which the sections below describe.
- **Open Billing**, which opens the service's **Billing** tab.

Under the cards, **Per-address profiles** lists each address that has a profile of its own, with that profile's name and mode. **Manage** opens the address's **Shield** tab.

## Bind an address

1. On the profile's card, choose the address under **Bind an address**.
2. Select **Bind IP**.

A message confirms `IP bound to custom profile`, and the address appears under **Bound addresses**. DDoS Shield then filters it with the profile's settings.

The list offers only your own floating IPs that are on the platform default profile. When none is left, the card says `Every address on the account is already on a custom profile.` To move an address from another custom profile, unbind it there first. To move an address that has a profile of its own, bind it with `bind_ip` ([With the API](#with-the-api)).

## Unbind an address

1. Under **Bound addresses**, select **Unbind…** beside the address.
2. Read the dialog and select **Unbind**.

A message confirms `IP unbound; uses platform default scrubbing`. The address goes back to the platform default profile, and the profile's rules and limits stop applying to it.

Blocks made on the address stay in place, and this profile can no longer remove them. Remove them before you unbind the address, as [Block a source](#block-a-source) explains.

The address goes back to the platform default profile even when it had a profile of its own before you bound it. In that case, **Customise** on the address's **Shield** tab brings its own profile back, with the settings and rules it had.

## Change the settings

The profile's protection mode, rate limits, rules and **When no rule matches** are on the **Shield** tab of each address bound to it.

1. Under **Bound addresses**, select an address. Its **Shield** tab opens, with the profile's name on the profile card.
2. Change the profile or its rules as [Change a floating IP's DDoS protection](/floating-ips/shield-settings/#change-the-profile) shows.

> [!IMPORTANT]
> A change on the **Shield** tab of one bound address applies to every address bound to the profile.

To aim a rule at one of the addresses, enter that address as the rule's **Destination prefix**, such as `203.0.113.10/32`. The rule then matches only traffic to that address.

The rate limits apply to each bound address on its own. An aggregate limit of 10,000,000 packets per second lets each address receive up to that much, rather than all of them together.

## Block a source

We drop every packet from a blocked source before any rule decides, so an **Allow** rule cannot let it through. You block a source on one of the addresses bound to the profile, so bind an address first.

1. On the profile's card, enter the sender's address under **Block a source**, such as `198.51.100.7`.
2. When more than one address is bound, choose under **On** the address that the block is on.
3. Select **Block source**.

A message confirms `Blocked 198.51.100.7`.

A block works differently from a rule:

- It is on one of the profile's addresses: the one you choose under **On**, or the only one bound.
- It blocks one sender address. The field also takes a prefix, such as `198.51.100.0/24`, but a prefix blocks nothing. To drop a range, add a **Drop** rule with the range as its **Source prefix** ([Add a rule](/floating-ips/shield-settings/#add-a-rule)).
- It never expires.
- It stays in place when you unbind its address and when the profile ends.
- The card does not list your blocks and cannot remove one. Remove a block with `whitelist_ip` and the block's `id`, which the answer to `blacklist_ip` gives ([With the API](#with-the-api)). The profile must be active, and the block's address must still be bound to it. For a block you made in the dashboard, [contact support](/support/conversations/) with the address.

## Suspension, plan changes and cancelling

A custom profile is billed like any other service ([Invoices](/billing/invoices/)).

### While the profile is suspended

We suspend the profile when an invoice for it stays unpaid ([Failed payments and suspended services](/billing/failed-payments/#a-service-is-suspended)). While it is suspended:

- We set the profile to **Passthrough**, so DDoS Shield stops filtering its addresses and an attack reaches them in full.
- **Bind IP**, **Unbind…** and **Block source** fail, with a message that ends `Service is not active`.

Pay the open invoice to lift the suspension. We then set the profile back to the mode its card shows, such as `Custom mode`, or to **Custom** when the card shows `Passthrough mode`. If you changed the mode on a **Shield** tab since the order, set it again there.

### Change the billing cycle

You can move a profile to another billing cycle of its plan on its **Billing** tab, but not to another plan, because each plan is a product of its own ([Change a service's plan](/billing/change-plan/)). To move to another plan, order a new profile, bind your addresses to it and cancel the old one.

> [!WARNING]
> Changing the billing cycle resets part of the profile. It sets **Packets per second per source** and **Aggregate packets per second** to the plan's own values, and binds the addresses you chose in the order again, including any you have unbound since. It can also set the protection mode, **When no rule matches** and the name back to what you ordered. Check the profile and its bound addresses afterwards.

### Cancel the profile

Select **Open Billing** on the profile's card and cancel the service there ([Cancel a service](/billing/cancel-a-service/)). When the service ends:

- Every bound address goes back to the platform default profile, and the profile's rules stop applying.
- The card leaves the **Profiles** tab.
- Your blocks stay in place, and nothing can remove them with this profile any more. Remove them with `whitelist_ip` before the service ends.

## Troubleshooting

The card shows **Setting up**
: The order waits for payment. Pay its invoice, and we set the profile up once it is paid.

The card shows `Profile is failed`, or `Profile is provisioning` for a long time
: We could not set the profile up. [Contact support](/support/conversations/) with the plan and the time you ordered.

An address is missing from **Addresses to protect**
: The list holds the floating IPs we have assigned to you. An address that you ordered but that is not ready yet is left out. Order the profile without it, and bind it once it is ready.

**Could not load your addresses**
: The list of floating IPs did not load, and the message gives the reason. Reload the page, or order the profile and bind addresses once it is set up.

**Could not place the order** with `ip_service_ids must name your own floating IPs that are not terminated or cancelled.`
: An address you ticked ended after the page loaded. The message ends with its service ID, such as `Remove 214.` Reload the page and tick the addresses again.

`No DDoS Shield plans yet`
: DDoS Shield is not in the catalogue for your account. [Contact support](/support/conversations/) if you expected it.

**Could not load the plans**
: The plans did not load. Select **Try again**, or reload the page.

An address is missing from **Bind an address**
: It has a profile of its own, or it is on another custom profile. [Bind an address](#bind-an-address) explains how to move it.

An address you ticked in the order is not under **Bound addresses**
: We skip an address that we cannot bind when we set the profile up, such as one that was cancelled in the meantime. Bind it now.

`Could not bind IP: Service is not active`, or the same message for another action
: The profile is suspended, or we have not set it up yet. Pay its open invoice.

`Bind an address to this profile first, then block the source on it.`
: No address is bound to the profile, so there is nothing to block the source on. Bind an address, then block the source.

`This profile protects more than one address. Set ip_service_id to the one to block the source on.`
: The block did not say which address it is on. Choose an address under **On**, then select **Block source** again.

The profile's rate limits have no effect
: The profile is in **Standard** mode, which uses the platform's limits. Set **Protection mode** to **Custom** on the **Shield** tab of a bound address.

A blocked sender still reaches an address
: The address is in **Passthrough**, or you blocked a prefix, which blocks nothing. Add a **Drop** rule for the range.

## Related

- [How DDoS Shield works](/ddos-shield/how-ddos-shield-works/)
- [Change a floating IP's DDoS protection](/floating-ips/shield-settings/)
- [Read attack events](/ddos-shield/attack-events/)
- [Order a service](/get-started/order-a-service/)
- [Cancel a service](/billing/cancel-a-service/)

## With the API

### Order a profile with the API

The custom profile plans are the products with `module_name` `antiddos` in [`GET /products/`](/api/reference/client/catalog/#op-get-api-v1-products). Order one with [`POST /services/order`](/api/reference/client/services/#op-post-api-v1-services-order), as [Order a service](/get-started/order-a-service/#with-the-api) explains:

```bash
curl -X POST https://api.coritan.com/api/v1/services/order \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "product_id": 41,
    "pricing_id": 118,
    "config": {
      "profile_name": "Game servers",
      "protection_mode": "custom",
      "default_action": "allow",
      "ip_service_ids": [214, 215],
      "per_source_pps": 50000
    }
  }'
```

| Key in `config` | Meaning |
| --- | --- |
| `profile_name` | The profile's name, 191 characters or fewer. It defaults to `Custom Shield` followed by the service ID. |
| `protection_mode` | `standard`, `custom` or `passthrough`. It defaults to `custom`. |
| `default_action` | `allow`, or `deny` for **Drop**. It defaults to `allow`. |
| `ip_service_ids` | The service IDs of the floating IPs to bind. Each must be one of your own floating IPs that is not terminated or cancelled. |
| `per_source_pps`, `aggregate_pps` | The profile's starting per-source limit (100–10,000,000) and aggregate limit (10,000–100,000,000). Leave them out to start at the values in [Rate limits](/floating-ips/shield-settings/#rate-limits). |

A `config` that fails a check answers `422` with `{"detail": {"errors": [...]}}`, such as `protection_mode must be standard|custom|passthrough`, `profile_name must be text of 191 characters or fewer`, or `ip_service_ids must name your own floating IPs that are not terminated or cancelled. Remove 902.` The API does not check the two limits, so keep them within their ranges. When you send a `hostname`, the card shows it as the title in place of the slug.

A profile takes no add-ons. To add a profile to an order for an instance, a server or a floating IP, put it in that order's `addons`, with an optional `profile_name` of up to 40 characters in its `config`. The order names the addresses itself, so an add-on whose `config` has `ip_service_ids` answers `422` with `Shield Custom Profile protects the addresses in this order, so leave ip_service_ids out of its config.` ([Add-ons in the order](/get-started/order-a-service/#add-ons-in-the-order)).

The answer's `service.id` is the profile's service ID. Once we have set the profile up, [`GET /services/{service_ref}`](/api/reference/client/services/#op-get-api-v1-services-service-ref) returns its `module_data`, with the profile's `profile_id` and `profile_slug`. The addresses bound to it are the ones whose `protection.profile_id` in `GET /api/v1/client/shield/status` is that `profile_id` ([With the API](/ddos-shield/#with-the-api)).

### Run an action

[`POST /services/{service_ref}/actions`](/api/reference/client/services/#op-post-api-v1-services-service-ref-actions) runs an action on the profile, with `service_ref` set to its service ID. Each action reaches only your own floating IPs and the addresses bound to this profile:

```bash
curl -X POST https://api.coritan.com/api/v1/services/1043/actions \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action": "bind_ip", "params": {"ip_service_id": 216}}'
```

```json
{"success": true, "message": "IP bound to custom profile", "data": {"ip_service_id": 216, "inventory_id": 5122, "profile_id": 58, "enabled": true, "address": "203.0.113.12"}}
```

Every answer has `success`, `message` and `data`. An action that fails can still answer `200`, with `"success": false` and the reason in `message`, so check `success`.

| `action` | `params` | What it does |
| --- | --- | --- |
| `bind_ip` | `ip_service_id` | Binds one of your own floating IPs that is not terminated or cancelled, and moves it off the profile it was on. `data` is the binding. |
| `unbind_ip` | `ip_service_id` | Moves an address bound to this profile back to the platform default profile. `data` is `null`. |
| `blacklist_ip` | `ip_address`, `ip_service_id` when more than one address is bound, and optionally `reason` | Blocks a source on one of the profile's addresses. `data.block` is the new block, with its `id`. |
| `whitelist_ip` | `block_id` | Removes a block whose address is still bound to this profile. `data` is `null`. |
| `view_alerts` | None | Returns up to 50 recent attack events for the addresses bound now, in `data.events`. |

With no address bound, `view_alerts` answers `"success": true` with an empty `data.events` and `No address is bound to this profile, so it has no attack events.` Read attack events with `GET /api/v1/client/shield/events` instead, because it covers every address on your account ([Read attack events](/ddos-shield/attack-events/#with-the-api)).

To block a source, send one IPv4 address, and the `ip_service_id` of the bound address to block it on:

```bash
curl -X POST https://api.coritan.com/api/v1/services/1043/actions \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action": "blacklist_ip", "params": {"ip_address": "198.51.100.7", "ip_service_id": 214, "reason": "UDP flood"}}'
```

```json
{
  "success": true,
  "message": "Blocked 198.51.100.7",
  "data": {
    "block": {"id": 881, "address": "198.51.100.7", "prefix_len": 32, "scope": "subject", "ip_service_id": 214, "reason": "UDP flood", "source": "manual", "expires_at": null, "created_at": "2026-09-26T09:12:40"}
  }
}
```

Keep the block's `id`, because you need it to remove the block and no request lists your blocks. We store `ip_address` as you send it without checking it, and an address we cannot read, or a prefix, blocks nothing. You can leave out `ip_service_id` while one address is bound.

To remove the block, while address `214` is still bound to the profile:

```bash
curl -X POST https://api.coritan.com/api/v1/services/1043/actions \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action": "whitelist_ip", "params": {"block_id": 881}}'
```

```json
{"success": true, "message": "Removed block 881", "data": null}
```

The answers you can act on:

| Answer | Meaning |
| --- | --- |
| `400` `Service is not active` | The profile is not set up yet, is suspended, or has ended. |
| `400` `Action 'name' not available` | `action` is not one of the five above. |
| `404` `Assigned IP service '216' not found` | `bind_ip` named an ID that is not one of your floating IPs, or one that is terminated or cancelled. Or `unbind_ip` or `blacklist_ip` named an address that is not bound to this profile. |
| `404` `Blocked source '881' not found` | `whitelist_ip` named a block that does not exist, or one whose address is not bound to this profile. |
| `404` `Service not found` or `403` `Access denied` | `service_ref` is not a service, or not yours. |
| `"success": false` with `ip_service_id required` | `bind_ip` or `unbind_ip` came without `ip_service_id`. |
| `"success": false` with `ip_address required` | `blacklist_ip` came without `ip_address`. |
| `"success": false` with `Bind an address to this profile first, then block the source on it.` | `blacklist_ip` ran on a profile with no address bound. |
| `"success": false` with `This profile protects more than one address. Set ip_service_id to the one to block the source on.` | `blacklist_ip` came without `ip_service_id`, and more than one address is bound. |
| `"success": false` with `Pass block_id to remove a blocked source entry` | `whitelist_ip` came without `block_id`. |

The [services API reference](/api/reference/client/services/#op-post-api-v1-services-service-ref-actions) lists every field.

## API

- `POST /api/v1/services/order`: Order a platform service, and any add-ons bought with it (https://docs.coritan.com/api/reference/client/services/#op-post-api-v1-services-order)
- `POST /api/v1/services/{service_ref}/actions`: Execute action (https://docs.coritan.com/api/reference/client/services/#op-post-api-v1-services-service-ref-actions)