Game Server Protection

    Minecraft server DDoS protection

    Keep your Java or Bedrock server and the host you already rent. Players connect to a Sterile IP, attacks are filtered on our network, and only clean traffic reaches your server over a GRE tunnel.

    View pricing

    What hits Minecraft servers

    What gets thrown at a public Minecraft server, and what happens to it behind Sterile.

    Floods aimed at your IP
    UDP and amplification floods big enough to fill your host's uplink are filtered on our network. Your server's real address stays hidden, so nobody can aim around us.
    Connection and ping floods on 25565
    Waves of half-open connections, handshakes and server-list pings are filtered before they reach the server, so real players can still get in.
    The query and voice ports
    The query port and Simple Voice Chat listen on UDP. Each gets a rule with a profile built for it instead of being left wide open.
    Bot joins
    Bots that finish a real login look like players to any network filter, so keep an anti-bot plugin for those. Sterile takes the floods away so the plugin is not buried under them.

    Premade protection for every Minecraft port

    Every port a Minecraft server uses has a premade profile, tuned for that traffic. In the dashboard you pick the port and its profile from a list; there are no filter rules to write. Traffic to a port you have not added does not reach your server.

    • Java EditionJoins, gameplay and server-list pings25565 TCP
    • Bedrock EditionBedrock players and the server list19132 UDP
    • QueryOnly if enable-query is on in server.propertiesServer-list sites reading your player count25565 UDP
    • Simple Voice ChatProximity voice between players24454 UDP

    Leave RCON (TCP 25575) without a rule, so it is not reachable on the protected IP. It is for you, not your players.

    Set up in a few minutes

    Download the installer from the dashboard and run it as root on the Linux server that hosts Minecraft. It brings up the GRE tunnel; then add a rule for 25565 and give players the Sterile IP. Add your SSH port to a profile first, or the install can cut your session.

    root@your-server

    Guides

    Questions about protecting Minecraft

    No. You keep your host and your server. Traffic reaches Sterile first and is delivered to your server over a GRE tunnel, so the only thing that changes for players is the address they connect to.

    If they join by domain name, point its A record at the Sterile IP and nothing changes for them. If they join by IP address or a saved favourite, give them the new one.

    Yes. Java uses TCP 25565 and Bedrock UDP 19132, and each has its own premade profile. A server that takes both, through Geyser for example, adds a rule for each port.

    The proxy, because it is the only server players connect to. Put the proxy's port behind a rule and keep the backend servers off the public internet, so nobody can attack them directly.

    It stops the floods: connection, handshake and ping floods are filtered on our network. Bots that complete a real login look like players to any network filter, so pair Sterile with an anti-bot plugin for those.

    A little, because traffic takes one extra hop through our edge. How much depends on where your players, our edge and your server are. Read the latency guide

    You choose the reserved speed, clean traffic and protected IPs you need, and pay monthly for that. View pricing

    Keep your Minecraft server online

    Protect the server you already run, and be filtered before the next attack arrives.

    Other games