Game Server Protection

    Rust server DDoS protection

    Keep your Rust server and the host you already rent, through wipe day and every raid. Players connect to a Sterile IP, attacks are filtered on our network, and only clean traffic reaches your server over a GRE tunnel.

    View pricing

    What hits Rust servers

    What gets thrown at a public Rust server, and what happens to it behind Sterile.

    UDP floods on the game port
    Rust plays over UDP, which makes 28015 the first thing a booter aims at. Floods are filtered on our network, and your server's real address stays hidden so nobody can aim around us.
    Server-browser query floods
    Spoofed Steam queries can bury a server and use it to reflect traffic at others. The A2S challenge answers the server browser without letting fake requests through.
    Connection spam at wipe time
    Fake connection attempts timed for a wipe, when real players are queueing, are filtered before they reach the server.
    RCON and the Rust+ app
    Rust+ gets its own rule with a profile for the companion app. RCON stays without one, so it is not reachable on the protected IP.

    Premade protection for every Rust port

    Every port a Rust server uses has a premade profile, tuned for that traffic. In the dashboard you pick the port and its profile from a list; there are no filter rules to write. Traffic to a port you have not added does not reach your server.

    • GamePlayers joining and playing28015 UDP
    • Steam queryserver.queryport in your startup commandThe server browser and player count28017 UDP
    • Rust+ companion appapp.portRust+ on players' phones28082 TCP

    Leave WebRCON (TCP 28016) without a rule, so it is not reachable on the protected IP. Reach it over SSH or a VPN instead.

    Set up in a few minutes

    Download the installer from the dashboard and run it as root on the Linux server that hosts Rust. It brings up the GRE tunnel; then add a rule for 28015 and give players the Sterile IP. Add your SSH port to a profile first, or the install can cut your session.

    root@your-server

    Guides

    Questions about protecting Rust

    No. You keep your host and your server. Traffic reaches Sterile first and is delivered to your server over a GRE tunnel, so the only thing that changes for players is the address they connect to.

    If they join by domain name, point its A record at the Sterile IP and nothing changes for them. If they join by IP address or a saved favourite, give them the new one.

    Yes. Add a rule for the query port and the server browser reaches it on the Sterile IP. The A2S challenge on that profile answers real queries and drops spoofed ones.

    Yes, once app.port (TCP 28082 by default) has a rule. Its premade profile is built for the companion app's traffic.

    Size the plan for your real player traffic, not for attacks: blocked attack traffic is never billed. If a busy wipe outgrows a premade profile's limits, you can raise them yourself.

    A little, because traffic takes one extra hop through our edge. How much depends on where your players, our edge and your server are. Read the latency guide

    You choose the reserved speed, clean traffic and protected IPs you need, and pay monthly for that. View pricing

    Keep your Rust server online

    Protect the server you already run, and be filtered before the next attack arrives.

    Other games