> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/welcome/system-overview.md). # System Overview
Link11 includes a number of services, shown in the diagram above. Each has its own section in the documentation, linked to below. These services can be divided into three categories: * **Web Performance** (securely increasing the responsiveness of the customer’s sites) * **Network Security** (protecting the customer’s system against DDoD threats on the network and transport layers: OSI Layers 3 and 4) * **Web Protection** (protecting the customer’s system against threats on the application layer: OSI Layer 7) Managing them all are the **WebGUI** ([the Link11 web console for administering the system](https://webgui.link11.com/), viewing analytics, etc.), and the **API.** These are part of every Link11 system; the other services are purchased on an individual basis. The various Link11 services provide different kinds of protection. The more services that are used, the broader the protection that is received. Some services can be used individually, while some require others to be present in order to be used. In the discussion below, the general capabilities of each service are described. In-depth explanations are provided in the individual documentation for each service. ## How a request is processed The diagram shows what happens when all Link11 services are used. The process begins when a client generates an http/s request; the request then proceeds through the following stages. ## Stage 1: Secure DNS Before the request can be sent to the customer origin, a DNS lookup must be performed. Link11’s **Secure DNS** provides domain-name services with additional security for the customer. Its capabilities include: * Providing DNS services to clients through multiple global PoPs, each with redundant services with failover. (To ensure the lowest response time, the client’s request is routed to the closest PoP.) * Enabling SSL auto-renewal via Let’s Encrypt * Securing the customer's DNS against attacks such as DDoS and DNS poisoning Full documentation for this service is here: [**Secure DNS**](/product-guides/secure-dns/introduction.md) After DNS lookup is complete, the request can be now routed to the customer origin. ## Stage 2: Secure CDN In the diagram above, the client’s request travels the path shown by the solid arrows. Its first encounter is with Link11’s Secure Content Delivery Network. This service can: * Serve static content to clients, improving performance and reducing load on the customer origin * Load-balance multiple origins * Block malicious IPs, including customizable ACLs * Be configured in several architectures, whether split servers (separate origins for static and dynamic content, which increases performance) or a unified backend (which is simpler). Full documentation for this service is here: [**Secure CDN**](/product-guides/secure-cdn/introduction.md) ## Stage 3: Network DDoS Protection If the request was not fulfilled by Secure CDN, it continues to the next Link11 service: **Network DDoS.** It offers: * Protection against DDoS traffic on OSI Layers 3 and 4 (network and transport) * Load-balancing to multiple origins or instances of Web DDoS Protection * Flexible setup: downstream tunnels can be Layer 2 or GRE * Flexible configuration options: Always-On (scrubbing all traffic always), Standby (only scrubbing traffic during a larger attack), Multi-ISP (scrubbing traffic for which the local path is the shortest), and Asynchronous (scrubbing incoming traffic, while outgoing traffic goes direct to local ISPs). * Optional additional security with **Netflow DDoS Detector**, described below. Full documentation for this service is here: [**Network DDoS**](/product-guides/network-ddos-v3/introduction.md)**.** ### Netflow DDoS Detector This is an add-on service to Network DDoS. It provides: * Fine-tuning of threat and response criteria * On-demand DDoS scrubbing: traffic can be dynamically routed into Link11 only while attacks are occurring, then released again * In-depth analytics, with additional insights and more granularity than Network DDoS alone. Full documentation for this service is here: [**Netflow DDoS Detector**](/product-guides/netflow-ddos-detector/introduction.md) ## Stage 4: Web DDoS Protection In this stage, the request is inspected for application-layer threats. The Web DDoS Protection Service provides: * Robust DDoS filtering. Admins can enable geoblocking, ASN blocking, IP and URL allow/blocklisting, path-specific security policies, behavioral analysis, client verification, and more * Robust architecture, with many instances running simultaneously as reverse proxies for customer origins * Load balancing to multiple origins * Optional conversion of http/2 to http/1 * Optional use of **Bot Management** (described below) * Optional use of **Zero Touch WAF** (described below) Full documentation for this service is here: [**Web DDoS Protection**](/product-guides/web-ddos/introduction.md) ### Bot Management This optional extension to **Web DDoS Protection** provides: * Identification and filtering of non-human traffic * Allow/blocklisting of specific bots, organizations, IPs, user agents, and so on. * Flexible configuration (can be enabled on a per-instance basis) Full documentation for this service is here: [**Bot Management**](/product-guides/bot-management/introduction.md) ### Zero Touch WAF This optional extension to **Web DDoS Protection** provides: * Traffic filtering based on [OWASP’s Mod Security Core Ruleset](/reference/zero-touch-waf-rules.md) * Additional traffic filtering based on custom rules * Flexible configuration, a learning mode, per-instance enabling, and more Full documentation for this service is here: [**Zero Touch WAF**](/product-guides/zero-touch-waf/introduction.md) ## Stage 5: Arrival at Customer Origin If the request successfully passes the previous stages of traffic filtering, it will arrive at the customer origin. All of the description above assumes that the customer origin will only receive traffic that has been cleaned by Link11. Under certain circumstances, it is possible that threat actors will try to bypass Link11, and access the origin directly. When Network DDoS is part of the system and is in "[Always-On mode](/product-guides/network-ddos-v3/architecture-and-setup-options.md#the-recommended-option-always-on-setup)", this will not be a problem. Otherwise, it's important for customers to [configure their networks so that non-Link11 traffic is rejected](/using-link11/how-do-i.../reject-traffic-from-sources-attempting-to-bypass-link11.md). This can be done with a router in front of the origin, or with firewalls at the edges.