Your server lands on a public list, and one evening three hundred names nobody knows join in a minute while real players time out. Another night the whole server drops off the internet at peak time. Both get called "a DDoS", but they are different attacks, and Minecraft server DDoS protection has two layers: a network filter that throws floods away before they reach you, and settings on your own proxy and server for traffic that looks exactly like players.
This post covers what the included 100 Gbps filtering removes and what it cannot see, Velocity with online-mode and modern forwarding, login and ping throttling, a minimal firewall, keeping origin addresses private, and what to do during an attack. For RAM and location sizing, see our Minecraft hosting guide; for other games, start at the DDoS-protected game server hub.
Minecraft server DDoS protection: what the network filter removes and what it cannot see
Every Noded VPS and dedicated server sits behind 100 Gbps of always-on Layer 3/4 DDoS protection, included at no extra cost, with nothing to enable. Attack traffic is filtered upstream, before it reaches your server's port. Layer 3/4 means packets and connections, not Minecraft logins, so the line falls like this:
| Attack | What arrives | Who handles it |
|---|---|---|
| UDP flood, any port (19132 included) | Gigabits of junk datagrams | Included filter, upstream |
| DNS or NTP amplification | Replies to requests you never sent | Included filter, upstream |
| SYN flood on 25565 | Masses of half-open TCP connections | Included filter, upstream |
| Server-list ping flood | Complete connections asking for your MOTD | You: proxy, firewall limits |
| Handshake and login flood | Connections that start a login, stall or repeat | You: login rate limit, firewall |
| Bot joins | Clients that log in and spawn | You: online-mode, anti-bot plugin |
| Chat and command spam | Joined bots flooding chat | You: rate limits, moderation |
The bottom four are why "we have DDoS protection" and "bots are wrecking my server" can both be true. A server-list ping is an ordinary TCP connection whose handshake asks for status instead of login, and needs no account. A bot that completes the handshake and speaks valid protocol at a few connections per second per address is, to a network filter, a busy Friday night. When you compare Minecraft DDoS protected hosting, ask which rows a host handles, and how.
Offline-mode servers are the easy target. With online-mode=false and no proxy, the server never checks names against the Minecraft account database, so one script can join as five hundred invented players, or as your admin. With online-mode on, every bot needs a real, paid account, and each ban costs the attacker one. It is the strongest bot defence you have, and it is free.
Put Velocity in front: online-mode, modern forwarding, private backends
Velocity, PaperMC's proxy, is worth running even for one server. A Velocity proxy does not absorb a DDoS flood; it gives you one hardened address to defend. Players connect to it on 25565; it authenticates them, answers server-list pings itself and connects them to backends you never publish. In velocity.toml:
bind = "0.0.0.0:25565"
online-mode = true
player-info-forwarding-mode = "modern"
forwarding-secret-file = "forwarding.secret"
[servers]
lobby = "127.0.0.1:30066"
survival = "127.0.0.1:30067"
try = ["lobby"]Edit the generated file, and remove the example entries under [forced-hosts], or Velocity rejects the config because they name servers that no longer exist. It writes a random secret to forwarding.secret on first start. Each Paper backend then gets, in server.properties:
server-ip=127.0.0.1
server-port=30066
online-mode=falseand in config/paper-global.yml, with settings.bungeecord: false in spigot.yml:
proxies:
velocity:
enabled: true
online-mode: true
secret: "contents of forwarding.secret"Backend online-mode=false looks alarming but is what the forwarding guide prescribes: the proxy has already authenticated the player, and modern forwarding passes the real UUID and IP, checked against the shared secret. server-ip=127.0.0.1 makes it safe, because nobody on the internet can reach the backend for a direct offline join. Velocity's security guide recommends that binding and warns that forwarding "is not a replacement for a firewall". Avoid legacy BungeeCord forwarding on 1.13 and newer; the docs call it "fundamentally insecure".
When backends outgrow the proxy's VPS, move them to a second VPS and firewall their ports to the proxy's address, or link the machines over WireGuard. Players never learn those IPs.
Minecraft bot attack protection: throttle logins, pings and packets
Most of this is already in the default configs:
| File | Setting | Default | What to do |
|---|---|---|---|
| velocity.toml | login-ratelimit | 3000 ms | Keep; raise to 10000 during an attack |
| velocity.toml | ping passthrough | off | Keep off, so pings never reach backends |
| velocity.toml | kick-after-rate-limited-commands | 0 (off) | Set a small number to kick command spammers |
| paper-global.yml | packet-limiter.all-packets | 500 over 7 s, KICK | Keep |
| bukkit.yml | settings.connection-throttle | 4000 ms | Matters only without a proxy |
| server.properties | hide-online-players | false | true on a standalone server |
Velocity checks login-ratelimit per IP and only when a handshake asks to log in, so it does not slow a status-ping flood; ping passthrough keeps those on the proxy, and the firewall below caps them. And with Velocity forwarding enabled, Paper's code ignores connection-throttle, since every connection comes from the proxy; on a standalone server it is your per-IP brake. The Paper packet limiter kicks clients that flood packets, and recent Velocity builds add a [packet-limiter] section whose packets-per-second check ships disabled.
None of this stops a botnet with a different address per bot. That is the job of anti-bot plugins, usually a limbo filter: new connections land in a lightweight virtual world on the proxy, pass checks such as falling physics or a captcha map, and only then reach a backend. Pick one with releases for your current Velocity version, and add a password login plugin if you must stay offline-mode.
A firewall that opens 25565 and nothing else
A host firewall does nothing against floods; that is the upstream filter's job. It keeps everything except the proxy unreachable: backend ports, RCON, databases, map viewers. With ufw:
sudo ufw default deny incoming
sudo ufw allow from 203.0.113.10 to any port 22 proto tcp
sudo ufw allow 25565/tcp
sudo ufw allow 19132 # Geyser only: TCP and UDP
sudo ufw enableReplace 203.0.113.10 with your own address, or allow SSH from anywhere with keys only, as in our hardening checklist. Java Edition needs only 25565/tcp. Geyser belongs on the Velocity proxy, listens on 19132, and its setup guide asks for TCP and UDP: UDP for play, TCP so players can find the server. Voice chat plugins add their own UDP port (24454 for Simple Voice Chat).
For per-address limits, use nftables instead of ufw, not both. This caps each IPv4 address at eight open connections and 20 new ones a minute on 25565, pings included:
table inet mc_filter {
set mc_conns { type ipv4_addr; size 65535; flags dynamic; }
set mc_rate { type ipv4_addr; size 65535; timeout 60s; flags dynamic; }
chain input {
type filter hook input priority filter; policy drop;
ct state established,related accept
ct state invalid drop
iif "lo" accept
meta l4proto { icmp, ipv6-icmp } accept
ip saddr 203.0.113.10 tcp dport 22 accept
tcp dport 25565 ct state new add @mc_conns { ip saddr ct count over 8 } drop
tcp dport 25565 ct state new update @mc_rate { ip saddr limit rate 20/minute } accept
tcp dport 19132 accept
udp dport 19132 accept
}
}Drop the 19132 lines without Geyser. The example is IPv4-only; for IPv6 players add matching ipv6_addr sets with ip6 saddr. Schools and mobile networks put many players behind one address, so raise the numbers if real players get refused. Per-address limits stop one machine, not a thousand.
Hide your Minecraft server IP: where origins leak
Be realistic: the address players connect to is the proxy's, and it is not secret. An SRV record at _minecraft._tcp.play.example.com hides the port, but its target resolves to an A record anyone can look up. What you can keep private is everything behind the proxy.
| Leak | Fix |
|---|---|
| Website, forum or store on the game IP | Host it elsewhere; web floods are Layer 7 |
| BlueMap (8100) or Dynmap (8123) on a backend | Bind it to 127.0.0.1 behind a reverse proxy on another box, or use BlueMap's external-webserver mode |
| Voice chat on a backend | Players connect to it directly, so that IP is public; keep it on the proxy's VPS |
| Plugins or bots fetching player-supplied URLs (image maps, skin URLs, link previews) | Each fetch shows your IP to the attacker's web server; disable it or restrict hosts |
| Old DNS records and certificate logs | Public history: a once-published IP stays known |
| Discord status bots, pasted configs | Publish the hostname only |
If a backend address leaks, move it: a new VPS comes with its own IPv4, and hourly billing makes the move cheap. If you put a third-party TCP proxy in front of Velocity, set haproxy-protocol = true and allow only that provider's ranges, or anyone can spoof player IPs.
During an attack, and when a paid tier helps
First tell the two kinds apart. A bot or ping wave shows on the box: the proxy log fills and Java CPU climbs. These show who holds connections and how many are half-open:
ss -s
ss -Htn state established '( sport = :25565 )' | awk '{print $4}' | sed 's/:[0-9]*$//' | sort | uniq -c | sort -rn | head
ss -Htn state syn-recv '( sport = :25565 )' | wc -l- Player-like attack: run
whitelist onon the backends (they see real names behind Velocity), switch your anti-bot plugin to strict, raiselogin-ratelimit, tighten the nftables numbers. Undo it afterwards. - Network flood: nothing to enable; it is filtered upstream. If players report trouble while your VPS looks idle, note the times and IP and open a ticket.
- Keep evidence:
sudo tcpdump -ni any -c 20000 -w /root/mc-attack.pcap port 25565, plus the proxy log. - Do not announce a new IP in the Discord that leaked the old one.
Paid tiers answer one problem: frequent attacks above 100 Gbps. On the included tier, the first five such attacks in a month are still mitigated; from the sixth, the attacked IP is null-routed until the attack stops or the server moves to a higher tier, which for a network means the proxy and everyone on it. Tiers run from 500 Gbps at €156.45 to 5 Tbps at €2,623.95 per server per month. A tier covers the one server it is ordered with, so buy it for the proxy, not the private backends. It will not stop bot joins, ping floods or chat spam. Layer 7 exists only on the 10 Tbps tier (€4,723.95), described for floods such as HTTP request floods; Noded does not advertise Minecraft-aware filtering on any tier.
What this is not
Not managed Minecraft hosting: managed game hosting is coming soon and cannot be ordered yet, so you install and patch Velocity, Paper and every plugin yourself. Not a bot filter: the included protection is Layer 3/4, and online-mode, the proxy and the firewall stay your job. Not a bigger pipe: clean traffic still runs through your VPS's shaped port, 100 to 300 Mbps by shape. Not endless: from the sixth attack above 100 Gbps in a month, the attacked IP is null-routed. And not anycast: your proxy lives in one city, so choose it by where your players are.
How Noded Can Help
For Velocity and one or two small Paper backends on one machine, start with a VPS III (8 GB RAM, 2 vCPU, 60 GB SSD) from the VPS hosting page: €10 a month in Bucharest, €14 in Warsaw or Amsterdam, €16 in Sofia, or €0.0139 an hour to test your real plugin list first. Traffic is unmetered and 100 Gbps Layer 3/4 protection is included. If attacks above 100 Gbps become a monthly habit, add a tier to the proxy server from the DDoS protection page; 500 Gbps is €156.45 a month per server. Unsure which shape or tier fits? Ask us.
FAQ
How do I protect a Minecraft server from DDoS?
Use two layers. Host on a network that filters volumetric and protocol floods upstream, such as the 100 Gbps Layer 3/4 protection included on every Noded VPS. Then handle player-like attacks yourself: online-mode on, Velocity in front with modern forwarding, backends bound to 127.0.0.1, login rate limits, an anti-bot plugin and a firewall that opens only 25565/tcp.
Does DDoS protection stop Minecraft bot attacks?
Network-level protection does not. Bot joins, ping floods and chat spam complete real TCP connections and speak valid Minecraft protocol at low volume, so a Layer 3/4 filter passes them as players. Stop them with online-mode, Velocity's login-ratelimit, per-IP firewall limits, an anti-bot limbo plugin and, during an attack, a temporary whitelist.
How do I hide my Minecraft server IP?
You cannot hide the address players connect to; an SRV record only hides the port. Hide everything else: backends on 127.0.0.1 or a firewalled second machine, website and map viewer off the game IP, no plugins fetching player-supplied URLs, and no backend addresses in public. Move a leaked backend to a new IP.
Is Velocity modern forwarding secure?
Yes, when backends are unreachable from the internet. Modern forwarding passes each player's UUID and IP checked against a shared secret, which legacy BungeeCord forwarding lacks. Velocity's docs say it is no replacement for a firewall, so bind backends to 127.0.0.1 or allow only the proxy's address on their ports.
Is DDoS protection included with Minecraft hosting on Noded?
Yes. Every Noded VPS and dedicated server includes 100 Gbps of always-on Layer 3/4 protection with nothing to enable. You run Minecraft yourself with full root, because managed game hosting is not orderable yet. Paid tiers from 500 Gbps at €156.45 a month per server suit networks that see attacks above 100 Gbps often.