Game Server Protection

    CS2 server DDoS protection

    Keep your Counter-Strike 2 community server and the host you already rent. Players connect to a Sterile IP, attacks are filtered on our network, and only clean traffic reaches your server over a GRE tunnel.

    View pricing

    What hits CS2 servers

    What gets thrown at a public Counter-Strike 2 server, and what happens to it behind Sterile.

    UDP floods mid-match
    A flood timed for a close round fills the server's uplink and lags everyone out. It is filtered on our network, and your server's real address stays hidden so nobody can aim around us.
    Server-browser query floods
    Spoofed A2S queries can bury a Source server and use it to reflect traffic at others. The A2S challenge answers the server browser without letting fake requests through.
    Fake connection spam
    Floods of connection attempts that never become players are filtered before they reach the server, so real players can still join.
    RCON on the same port number
    Source RCON listens on TCP 27015. With a rule only for UDP, it is not reachable on the protected IP at all.

    Premade protection for every CS2 port

    Every port a CS2 server uses has a premade profile, tuned for that traffic. In the dashboard you pick the port and its profile from a list; there are no filter rules to write. Traffic to a port you have not added does not reach your server.

    • Game and Steam queryOr the -port you start the server withPlayers joining, playing and the server browser27015 UDP

    Leave RCON (TCP 27015) without a rule, so it is not reachable on the protected IP. Reach it over SSH or a VPN instead.

    Set up in a few minutes

    Download the installer from the dashboard and run it as root on the Linux server that hosts CS2. It brings up the GRE tunnel; then add a rule for UDP 27015 and give players the Sterile IP. Add your SSH port to a profile first, or the install can cut your session.

    root@your-server

    Guides

    Questions about protecting CS2

    No. You keep your host and your server. Traffic reaches Sterile first and is delivered to your server over a GRE tunnel, so the only thing that changes for players is the address they connect to.

    If they join by domain name, point its A record at the Sterile IP and nothing changes for them. If they join by IP address or a saved favourite, give them the new one.

    Yes. The game port also answers the server browser, and its premade profile has the A2S challenge on, which answers real queries and drops spoofed ones.

    Give each server its own port, as you would anyway, and add a rule for each. Every rule can use the same premade profile.

    No. Sterile filters network attacks; cheats run inside a normal game connection and are a job for your anti-cheat and your admins.

    A little, because traffic takes one extra hop through our edge. How much depends on where your players, our edge and your server are. Read the latency guide

    You choose the reserved speed, clean traffic and protected IPs you need, and pay monthly for that. View pricing

    Keep your CS2 server online

    Protect the server you already run, and be filtered before the next attack arrives.

    Other games