[Yandex Cloud documentation](../../index.md) > [Yandex Virtual Private Cloud](../index.md) > [Step-by-step guides](index.md) > DDoS protection > Enabling DDoS protection

# Enabling DDoS protection

You can activate [DDoS protection](../ddos-protection/index.md) when [creating](../../compute/quickstart/quick-create-linux.md) a VM and [reserving](get-static-ip.md) public IP addresses.

Protected addresses are allocated from a separate pool; therefore, you cannot enable and disable protection for a previously reserved address.

## Enabling DDoS protection when creating a virtual machine {#enable-on-vm-creation}
{% list tabs group=instructions %}

- Management console {#console}

	When configuring a network on a new virtual machine, select the automatically assigned public IP address or an address from the list of the reserved ones. 

	Once you select an address, select **DDoS protection**.

{% endlist %}

## Enabling DDoS protection when reserving an IP address {#enable-on-reservation}

{% list tabs group=instructions %}

- Management console {#console}

	To reserve a protected static IP address:

	1. In the [management console](https://console.yandex.cloud), select the folder where you need to reserve an address.
	1. Navigate to **Virtual Private Cloud**.
	1. In the left-hand panel, select ![image](../../_assets/console-icons/map-pin.svg) **Public IP addresses**.
	1. Click **Reserve public IP address**.
	1. Select the availability zone where you want to reserve the address.
	1. Select **DDoS protection**.
	1. Click ** Reserve**.

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  1. Open the Terraform configuration file and edit the section with the static public IP description by adding the `ddos_protection_provider` field:

     ```hcl
     resource "yandex_vpc_address" "addr" {
       name = "exampleAddress"
       external_ipv4_address {
         zone_id                  = "ru-central1-a"
         ddos_protection_provider = "qrator"
       }
     }
     ```

     Where the `ddos_protection_provider` parameter enables DDoS protection. The possible value is `qrator`.

     For more on the properties of the `yandex_vpc_address` resource in Terraform, see [this provider guide](../../terraform/resources/vpc_address.md).

  1. Validate your configuration using this command:

     ```
     terraform validate
     ```
     
     If the configuration is valid, you will get this message:
     
     ```
     Success! The configuration is valid.
     ```

  1. Run this command:

     ```
     terraform plan
     ```
  
     You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

  1. Apply the configuration changes:

     ```
     terraform apply
     ```
     
  1. Confirm the changes: type `yes` into the terminal and press **Enter**.

     You can check whether DDoS protection is active in the [management console](https://console.yandex.cloud) or using this [CLI](../../cli/quickstart.md) command:

     ```
     yc vpc address list
     ```

{% endlist %}