Security
DDoS protection for game servers (FiveM, Minecraft): the guide
Published on · 4 min read
Why are game servers attacked so often?
A FiveM, Minecraft, Rust or CS2 server is an easy target: its IP address is public, most games use UDP, and an attack costs very little to launch. The motives are often trivial — a banned player, a rival server, or simply the urge to cause trouble.
The most common attacks:
- UDP floods: millions of packets sent to the game port to saturate the connection;
- amplification attacks (DNS, NTP, Memcached…): small requests bounced back as large responses towards your IP;
- TCP floods (SYN, ACK) that exhaust server resources;
- application-layer attacks that mimic real players to flood connections.
Without protection, the result is always the same: the server becomes unreachable and players leave.
How two-layer DDoS protection works
A single barrier is not enough: a volumetric attack must be stopped as far away as possible, while subtler attacks need precise filtering close to the server. That is the principle behind VexCloud protection.
Layer 1: upstream filtering by IP transit
Our network connects to the Internet through three IP transit providers: Gcore, Netrix and EASIO-COM. They scrub the traffic and absorb volumetric attacks before they even reach us.
Layer 2: the XDP filter on our machines
What gets through the first layer is sorted by our XDP (eXpress Data Path) program, running directly in the Linux kernel, before the network stack. Suspicious packets are dropped very early, which makes it possible to filter large volumes without slowing down legitimate traffic.
This protection is included with VPS, dedicated servers, IP tunnels and all our other plans, at no extra cost.
Tuning protection yourself with the DDoS panel
Effective protection has to know your services: a FiveM server does not have the same needs as a website. With the VexCloud DDoS panel, available from your client area for VPS, dedicated servers, IP tunnels and VPS reseller plans, you configure filtering one IP address at a time.
Choosing the right filtering mode
- Full (default): TCP and UDP filtered. Ports recognised as services stay reachable; the rest is rate-limited, then dropped under attack.
- TCP only: for TCP-only services (websites, SSH, RDP).
- UDP only: for games and VPNs.
- Open: ports with a filter stay protected, all others pass unfiltered.
- Closed: everything is blocked except active filters. The strictest mode.
- Bypass: no protection, for one-off testing only.
For a game server with SSH access, Full mode with the default filters fits most cases.
Filters and custom ports
Ready-made filters exist for the most common services: SSH, HTTP/HTTPS, RDP, FiveM, Steam, Minecraft, WireGuard… If your game uses another port — a Velocity proxy, a Steam port range such as 27015-27030, SSH on 2222 — you add a port or range with the appropriate filter, up to 32 rules per IP.
Packets-per-second threshold
You can set a packets-per-second cap for each IP: Low (50,000), Medium (150,000), High (350,000) or Extreme (500,000). Beyond it, the excess is dropped by the filter.
Blocklist, allowlist and protocols
- Block an IP or a CIDR range, temporarily or permanently.
- Allow trusted sources (a partner, your office) so they are never filtered.
- Deny a whole protocol to an IP (TCP, UDP or ICMP) if your service does not need it.
Tracking attacks and getting alerts
The panel keeps the attack history with type, peak and duration, and shows traffic origins by country and network (ASN). You can get an alert when each attack starts and ends: browser notification, Discord webhook or a call to your own API.
Good practices on the server side
Network protection does most of the work, but a few habits complete the defence:
- only open the ports you need in your system firewall;
- don't reveal the IPs of other machines (database, panel) in the server's public files;
- keep your resources up to date (FiveM artifacts, Minecraft plugins);
- watch your logs: a sudden rise in connections is often the first sign.