ProxyShield Engine

Three Layers of Defense.
Zero Compromise.

The only Node.js API gateway with kernel-level iptables banning, TCP socket termination, and distributed ban propagation. Attacks are stopped before they reach your application.

Request Flow Through ProxyShield

Incoming Traffic

All requests hit the server

Layer 1: Kernel (iptables)

Packet dropped at kernel — Node.js never sees it

~0ms

Layer 2: TCP Socket

Connection destroyed before HTTP parsing

~0.01ms

Layer 3: Application

Failure detection, threat scoring, ban escalation

~0.1ms

Clean Traffic → Your API

Only legitimate requests reach your backend

Defense in Depth

Each layer catches what the previous one missed. Together, they provide enterprise-grade protection.

LAYER 01

Kernel-Level Packet Dropping

iptables / ip6tables

Banned IPs are added to a dedicated NOLXY_SHIELD iptables chain. Packets are dropped at the kernel level before they ever reach Node.js — zero CPU cost for your application.

  • Dedicated iptables chain (NOLXY_SHIELD) created at startup
  • IPv4 and IPv6 support via iptables and ip6tables
  • execFile() with args array — immune to shell injection
  • Automatic chain cleanup on graceful shutdown
  • Capability detection — falls back gracefully if iptables unavailable

LAYER 02

TCP Socket Termination

server.on('connection')

Every new TCP connection is checked against the ban list before HTTP parsing begins. Banned connections are destroyed instantly — including all existing keep-alive connections for that IP.

  • Runs once per TCP connection, not per HTTP request
  • LRU cache for O(1) ban lookups (zero Redis calls)
  • Active socket tracking — destroys ALL connections for banned IPs
  • Slowloris protection via header reception timeouts
  • Drops banned traffic from 30k req/s → 0 req/s instantly

LAYER 03

Application-Level Threat Detection

Failure counting & progressive banning

Authentication failures, rate limit violations, and IP block hits are tracked per-IP. Repeated offenses trigger automatic bans with escalating durations.

  • 5 auth failures → automatic ban
  • 100 rate limit violations → kernel-level ban
  • Progressive ban escalation (repeated bans within 1 hour → longer duration)
  • Per-source failure tracking (auth, ratelimit, ipblock)
  • Threat score calculation for analytics

Beyond the Layers

ProxyShield includes additional security mechanisms that work together with the three-layer defense.

Distributed Ban Propagation

Bans are broadcast via Redis Pub/Sub to all gateway nodes instantly. Ban one IP on node 1, it's blocked on all nodes within milliseconds.

Active Connection Killing

When an IP is banned, all existing keep-alive TCP connections for that IP are immediately destroyed. No waiting for timeout — instant termination.

Negative Caching

Invalid API keys are cached to prevent cache-bypass DoS attacks. Attackers can't flood your database with invalid key lookups.

Zero Hot-Path Overhead

Legitimate traffic never touches ProxyShield. Ban checks use in-memory LRU cache — zero Redis calls, zero database queries on the hot path.

Stop Attacks at the Kernel

ProxyShield is included in every Nolxy plan — even free. No configuration needed. Just deploy and you're protected.