Is Your Host's DDoS Protection Enough for a Game Server?

Most VPS and dedicated server hosts include DDoS protection with every plan. For a website, that is often all you need. For a game server, it is often where the trouble starts: the protection is there, but players still time out, and sometimes the whole server disappears for hours.

This post explains what bundled protection usually does, where it falls short for games, and how to find out whether yours is enough before the next attack does it for you.

What bundled protection usually is

A host protects its whole network, not your server in particular. The usual design looks like this:

• Detection by volume. Traffic to each address is watched, and filtering starts when it crosses a threshold that looks like an attack.
• Generic filters. Once traffic is diverted, it goes through rules built to suit every customer on the network: websites, mail servers, databases and game servers alike.
• A ceiling. Each plan covers attacks up to a certain size. Above that, the host protects everyone else by dropping all traffic to your address, which is called a null route.

None of this is bad engineering. It is the right design for a host with thousands of customers who mostly run websites. Game servers just behave differently.

Where it falls short for game servers

The first seconds of every attack get through

Filtering that starts after detection is filtering that starts late. Even a short delay is enough for players to time out, and many attacks are built for exactly that: short bursts, repeated every few minutes, each one ending before mitigation settles. Always-on vs on-demand protection covers this difference in detail.

Small attacks never trigger it

A threshold tuned for a network that carries many gigabits sees nothing wrong with a few hundred megabits. Your server might: a flood of small packets can max out its network card or CPU long before the traffic counts as an attack upstream. You see lag and timeouts, and the host's dashboard shows a quiet day.

Generic rules do not understand game traffic

Most games run on UDP, and a lot of attack traffic is shaped to look like real game packets: fake join requests, server-list query floods, packets that copy a game's handshake. A filter written for web traffic cannot tell these apart from real players, so it either lets them through or blocks real players along with them.

The null route finishes the job

When an attack is larger than your plan covers, the host's way of stopping it is to stop all traffic to your address, players included. The attack ends, and so does your server, often for hours. From the attacker's side, that is a win.

You cannot see or tune anything

When players complain, you want to know whether there was an attack, what it looked like and what was blocked. Bundled protection rarely tells you, and rarely lets you set rules for one port.

This is what that can look like: every attack listed with when it started, how long it lasted, its peak and how much was dropped.

When it is enough

Be honest about your situation before paying for anything:

• A private server for friends that has never been attacked does not need more.
• A website is usually better served by a CDN or proxy in front of it than by game protection.
• A TCP-only service with low traffic is easier for generic filters to get right.

If attacks have never happened, or happened once and stopped, what your host includes is probably fine.

Six questions to ask your host

Support can usually answer these in one reply:

1. Is filtering always on, or does it start after an attack is detected? If after, how long does detection take?
2. What happens when an attack is bigger than my plan covers: is it still filtered, or is my address null-routed?
3. Is there filtering specific to my game, for UDP traffic, or only general rules?
4. Will I be told when an attack happens, and can I see what was blocked?
5. Can I set rules per port, for example to block a port I do not use?
6. Are attacks below the detection threshold filtered at all?

Answers like "after detection", "null route above X Gbps" and "general rules only" are normal for bundled protection. They are also the reasons a game server outgrows it.

Signs you have outgrown it

• Players time out at the start of an attack and the server recovers a minute later. That is detection delay.
• The server becomes completely unreachable for hours. That is a null route.
• Lag spikes happen with no alert from the host. That is an attack under the threshold.
• The host emails you asking you to upgrade or move.

Any of these, more than once, means attackers have found a gap they can use again.

Adding protection without changing host

You do not have to move your server to fix this. With a GRE tunnel, your server stays where it is, and players connect to a protected address instead. Traffic reaches a filtering network first, and only clean traffic travels down the tunnel to your host.

Sterile works this way. Filtering is on all the time, so there is no detection window, and each game port gets a profile made for that game's traffic instead of generic web rules.

Clean and blocked traffic sit side by side in your dashboard, so you can see what reached your server and what was dropped. Blocked attack traffic is never billed.

See game server DDoS protection for the games we have profiles for.

Whatever you choose, one thing matters as much as the filtering: attackers must not know your server's own IP, or they can skip the protection and hit your host directly. Origin IP protection explains how to keep it hidden.