Run a public game server long enough and someone will try to knock it offline: a rival community, a banned player, or a teenager with a few euros and a "stresser" site. DDoS protected game server hosting is meant to keep you online when that happens, but the phrase covers very different things from host to host, and you find out which one you bought when thirty players time out mid-raid.
This post covers why game servers attract DDoS attacks, the attack types they actually see, what Noded's included 100 Gbps of protection stops and what it cannot, the five-attack rule and when a paid tier is worth it, a hardening checklist for your side, and how to choose a VPS shape and location.
Why do game servers get DDoSed?
- Attacks are cheap to order. DDoS-for-hire "booter" and "stresser" sites sell floods to anyone with a browser. Operation PowerOFF, a 21-country police action in April 2026, targeted more than 75,000 of their users, according to Cloudflare's H1 2026 DDoS report.
- Rivals and grudges. In a Cloudflare survey, 71% of attacked customers did not know who hit them; of those who did, 63% named competitors, a pattern Cloudflare calls especially common in gaming, gambling and crypto (Q2 2025 report).
- Gaming sits near the top. Cloudflare's Q4 2025 report ranked Gaming the fourth most-attacked industry, with Gambling & Casinos third.
- Real-time UDP punishes short floods. A website under a short flood loads slowly; a game server drops packets, players rubber-band, then time out. Attackers don't need long: in the first half of 2026, 90.60% of the network-layer attacks Cloudflare mitigated ended in under ten minutes. Timed for wipe night or a tournament round, that is enough.
Most floods are small: 96.62% of network-layer attacks in the same report stayed under 500 Mbps. Even 500 Mbps is five times the 100 Mbps ceiling of our smallest VPS, and a firewall on the server cannot help once the link is full. That is why DDoS protection for game servers has to filter upstream.
The attacks game servers actually see
| Attack | What it looks like | Usually handled by |
|---|---|---|
| UDP flood | Junk UDP aimed at the game port or random ports until the link fills | Upstream L3/L4 filtering |
| Amplification (DNS, NTP, CLDAP, memcached) | Spoofed queries make third-party servers send large replies to you | Upstream L3/L4 filtering |
| SYN flood | Half-open TCP connections against TCP ports: Minecraft Java, RCON, a web panel | Upstream L3/L4 filtering |
| Query floods | Server-browser info requests (A2S on Steam games) at high rates; every answer costs the server work | Upstream if volumetric; otherwise the game side |
| Game-packet mimicry | Floods shaped like real traffic to the game port | Mostly the game side |
| Bot joins | Clients that complete a real handshake, log in, spam chat or fill slots | You: whitelists, rate limits, anti-bot plugins |
Amplification is why spoofed UDP hurts. The CISA amplification table puts NTP at a bandwidth factor of 556.9 and memcached at up to 51,000. Game protocols are on the same list: Quake's network protocol at 63.9, the Steam protocol at 5.5. Keep the game server updated, and never run an open DNS resolver or NTP service on the same box.
The last three rows are the hard ones. Cloudflare described Teeworlds-based floods as UDP packets that "mimic in-game actions or connection attempts". To a network filter, that can look like a busy server.
What DDoS protected game server hosting covers on Noded
What the included 100 Gbps stops
Every KVM VPS, media-server VPS and dedicated server at Noded includes 100 Gbps of always-on DDoS protection at Layers 3 and 4, at no extra cost, with nothing to enable: no ticket, no DNS change, no agent. Attack traffic is filtered upstream, before it reaches your server's port, and clean traffic keeps flowing. That means the volumetric and protocol attacks at the top of the table: UDP floods, DNS and NTP amplification, SYN floods. The protection sits in front of our own network, AS60982, and is the same in every location.
What it cannot see
Layer 3/4 filtering judges packets by volume and protocol behaviour, not by your game's messages. A modest query flood, packets imitating connection attempts, or bots that complete a real login can still reach the game port. Layer 7 protection comes only with the 10 Tbps tier, and it is described for application-layer floods such as HTTP request floods; for a game protocol, ask before buying. On every tier, game-side hardening stays your job.
The five-attack rule, in plain terms
- Attacks under 100 Gbps are filtered and not counted. The nightly 20 Gbps booter flood costs you nothing.
- Attacks above 100 Gbps: the first five in a month are still mitigated at no charge.
- The sixth attack above 100 Gbps in the same month: the attacked IP address is null-routed. All traffic to it is dropped, your players' included, until the attack stops or the server moves to a higher tier.
So a null-route takes six floods above 100 Gbps in one month: a determined attacker, not a bored player. If it happens, everything on that IP is unreachable while it lasts.
When a paid tier is worth it
Higher tiers are a per-server option chosen at configuration, billed monthly, VAT added where it applies:
| Tier | Layers | Per server, a month |
|---|---|---|
| 100 Gbps | L3/L4 | €0, included |
| 500 Gbps | L3/L4 | €156.45 |
| 1 Tbps | L3/L4 | €523.95 |
| 2 Tbps | L3/L4 | €1,048.95 |
| 5 Tbps | L3/L4 | €2,623.95 |
| 10 Tbps + Layer 7 | L3/L4/L7 | €4,723.95 |
It pays when big attacks keep returning: you have been null-routed once already, the server earns money, or a tournament weekend cannot afford a dark IP. It does not pay for a friends' server, for attacks under 100 Gbps (the included tier already filters them), or when the real problem is bots and game-shaped floods, which a bigger Layer 3/4 tier does not change. A tier covers the one server it is ordered with, so three game servers need three. To move an existing server to a higher tier, contact us if the route is not obvious.
Game server DDoS protection checklist: your side of the job
1. Expose only the game port. Players need one or two ports; everything else stays closed.
| Game | Open to players | Keep private |
|---|---|---|
| Minecraft Java | 25565/tcp (25565/udp only if enable-query=true) | RCON, 25575/tcp |
| CS2 | 27015/udp (27020/udp only for CSTV) | RCON on 27015/tcp |
| Rust | 28015/udp and the query port (UDP) | RCON (TCP, set with rcon.port) |
| Palworld | 8211/udp (27015/udp for the community server list) | REST API 8212/tcp, RCON 25575/tcp |
For a Minecraft server, the whole firewall is four lines:
sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw allow 25565/tcp
sudo ufw enableThis does not stop floods; it keeps scanners and password guessers away from everything but the game.
2. Keep RCON and admin panels off the internet. Minecraft's RCON is unencrypted, and the community wiki advises connecting only from localhost. Pocketpair's REST API docs say these APIs are "not designed to be exposed directly to the Internet." Bind admin ports to 127.0.0.1 and use an SSH tunnel, or a WireGuard address only your admins can reach. The same goes for any web panel you installed.
3. Don't leak the address of everything else. For most games the server IP is public by design; what you control is what shares it:
- A website, forum or store on the game box: an HTTP flood on the shop lags the game, and a CDN in front of the site is pointless once DNS history shows the box's address.
- Password-reset emails sent from the game box, which carry its IP in the headers.
- Backend servers behind a proxy (a Minecraft network, say) that accept connections from anyone, not only the proxy's IP.
- Plugins and Discord bots that fetch player-supplied URLs or post backend addresses in public channels.
4. Give the website its own IP, ideally its own server. A null-route applies to the attacked IP address, so with an extra IPv4 at checkout a null-routed website does not take the game's address with it. A separate €4 VPS behind a reverse proxy or CDN is better still: an HTTP flood on the site then cannot eat the game's CPU.
5. Keep backups off the box. Noded VPS plans include no snapshots or backups. Copy world saves and configs on a schedule to a server in another city, so a null-routed IP or a rebuild means restoring elsewhere, not waiting.
6. Patch and gate. Update the game and plugins promptly, whitelist private servers, use the game's own limits: Minecraft's rate-limit kicks players who send too many packets, and is off (0) by default.
Anti-DDoS game server in Europe: shape and location
With floods filtered upstream, the VPS port ceiling is for players. Each shape has a symmetric burst ceiling on a shared 1 Gbps node uplink, not reserved bandwidth: 100 Mbps on VPS I, 180 Mbps on VPS III, 220 Mbps on VPS IV, 300 Mbps on VPS VI, all unmetered. Size RAM first with the guides for Minecraft, Rust and Palworld, CS2, Valheim, 7 Days to Die and Project Zomboid, then leave headroom: the guest CPU is an older Intel generation (Broadwell), so single-thread speed is modest. For very large or heavily attacked communities, a dedicated server from €209 a month, with a guaranteed unmetered port from 1 Gbps, is the step up.
Put the server near most of your players: Bucharest, Sofia, Warsaw or Amsterdam in Europe, Ashburn for US East, with the same protection in each. A VPS III (8 GB, 2 vCPU) is €10 a month in Bucharest, €14 in Warsaw or Amsterdam and €16 in Sofia or Ashburn. We won't quote latency figures; test instead. An hourly VPS I is €0.0056 an hour in Bucharest: have players ping one in each candidate city for an evening, then destroy it. Hourly billing needs €5 of account credit, and only destroying a VPS stops the meter.
What this is not
- Not managed game hosting. Our managed game hosting is coming soon and cannot be ordered yet. You run the server with full root: you install, patch and watch it.
- No Layer 7 below 10 Tbps. The included tier and 500 Gbps to 5 Tbps work at Layers 3 and 4. Bots and game-shaped floods are yours to handle.
- Not without limits. From the sixth attack above 100 Gbps in a month, the attacked IP is null-routed until the attack stops or the server moves to a higher tier.
- Not a promise of zero disruption. Filtering keeps floods off your port; it cannot fix an exposed admin port, a bot wave or an undersized VPS.
How Noded Can Help
For most community servers, a VPS III (8 GB, 2 vCPU, 180 Mbps) at €10 a month in Bucharest or a VPS IV (16 GB, 4 vCPU, 220 Mbps) at €16 is the starting point, hourly or monthly, from the VPS hosting page. Both include 100 Gbps of always-on Layer 3/4 DDoS protection and unmetered traffic. Add a paid tier, from €156.45 a month per server, only when attacks above 100 Gbps keep returning; the tiers are on our DDoS protection page. Unsure which shape, city or tier fits? Open a ticket with the game, player count and what has hit you so far.
FAQ
Why do game servers get DDoSed so often?
Attacks are cheap to buy from DDoS-for-hire sites, and rival servers, banned players and losing teams have motives. Games also suffer from short floods: they send real-time UDP, so a few minutes of packet loss means lag, timeouts and players leaving. Cloudflare's Q4 2025 report ranked gaming the fourth most-attacked industry.
Is 100 Gbps of DDoS protection enough for a game server?
For most community servers, yes. In the first half of 2026, Cloudflare found 96.62% of network-layer attacks stayed under 500 Mbps. Noded's included tier filters UDP floods, amplification and SYN floods up to 100 Gbps upstream, and still mitigates the first five larger attacks in a month at no charge.
What happens if my game server is attacked more than five times in a month?
Only attacks above 100 Gbps count, so frequent smaller floods change nothing. On the included tier, the first five attacks above 100 Gbps in a month are mitigated free. From the sixth, the attacked IP address is null-routed until the attack stops or the server moves to a higher, paid tier.
Does DDoS protection stop bot attacks on a game server?
Usually not. Bots that complete a real login, and floods built to look like game packets, are valid-looking traffic at Layers 3 and 4, which network filtering is not built to judge. Handle them on the server with whitelists, join and packet rate limits, anti-bot plugins and closed admin ports.
Can I order managed DDoS-protected game hosting from Noded?
Not yet. Managed game hosting is coming soon and is not orderable. Today you run the game server yourself on a KVM VPS from €4 a month or a dedicated server, with full root, unmetered traffic and 100 Gbps of Layer 3/4 DDoS protection included.