What DDoS Protection Actually Stops at the Host Level (and What You Still Configure Yourself)

Most “DDoS protection” claims from game server hosts describe one layer of a multi-layer problem. Understanding which layer the provider owns and which layer you own prevents the most common failure mode in gaming infrastructure: a host that scrubs 600 Gbps of volumetric attack traffic while your server still goes offline to a 40,000-packet-per-second UDP reflection.

This is a layer-by-layer breakdown of what upstream protection covers, where the gaps are, and the specific configuration work that lands on you. If you are comparing hosts on this dimension, the dedicated server comparison table lists filtering capacity and pps thresholds per provider.

The Five Attack Categories

Protection is not one product. Each category needs different mitigation, and different providers cover different subsets.

Attack type	Typical size	Who mitigates	Provider covers it?
Volumetric (UDP flood, DNS/NTP/memcached reflection)	10 Gbps – 2 Tbps	Upstream scrubbing center	Usually yes
Protocol (SYN flood, fragmented packets)	1–50 Mpps	Upstream + edge firewall	Usually yes
Application-layer (game protocol abuse, query floods)	10k–500k pps	You, on the server	Rarely
Connection exhaustion (slot/query flooding)	Low volume, high impact	You, in game config	No
Amplification via your own services	Varies	You, by closing ports	No

The pattern is consistent: providers own high-volume, low-complexity attacks. You own low-volume, high-complexity attacks. An attacker who understands this skips the 500 Gbps flood and goes straight to 30,000 malformed Steam query packets per second, which most scrubbing centers will not flag because the bitrate looks like normal traffic.

What Upstream Protection Really Covers

When you rent from a provider with “DDoS protection included,” you are getting one or more of the following. Read the contract language carefully, because these are not equivalent.

• Always-on BGP diversion to a scrubbing center. Traffic is rerouted through a cleaning facility during attack, then forwarded to you. Adds 1–5 ms of latency and can introduce asymmetric routing during mitigation.
• Rate limiting and null-routing. The cheapest tier. A large attack means your IP is simply dropped from the internet until it stops. Effective protection for the provider’s other customers; an outage for you.
• Filtering capacity guarantee. The headline number, usually 1–10 Tbps of aggregate scrubbing. Meaningful, but only for volumetric attacks — it says nothing about pps handling.
• L3/L4 rulesets. Blocks known reflection sources, bad fragmentation, and source-spoofed traffic.
• Game-aware L7 filtering. Rare and worth paying for. Validates game protocol handshakes so garbage packets are dropped before they reach your process.

Two provider numbers matter more than the headline filtering capacity: the pps threshold at which legitimate traffic starts being dropped, and the mitigation latency — how long between attack detection and traffic being diverted. A provider that takes 90 seconds to detect an attack, with a game community logging back in every few seconds, has already given the attacker the outage they wanted.

The Configuration Work That Is Yours

These are the configurations no host can make for you, because they depend on your game and your community.

1. Close every port you are not using

The most common self-inflicted amplification vector is an exposed service that responds with more data than it receives. Default game configs frequently leave RCON, query ports, and web admin panels reachable from the public internet.

# Only publish what players need. Example for a Minecraft instance:
sudo ufw default deny incoming
sudo ufw allow 25565/tcp
sudo ufw allow 25565/udp
# RCON 25575 and query 25577 stay closed to the internet
sudo ufw enable

# Verify nothing else is listening publicly
ss -tulpn | grep -v 127.0.0.1

2. Rate-limit at the application layer

Game binaries have far less protection than web servers. nftables can absorb the query floods that upstream scrubbing ignores, using per-source limits on your game ports.

# Allow at most 20 new packets/sec per source IP on the game port
# (tune to roughly 2x your expected per-player packet rate)
nft add rule inet filter input udp dport 25565 \
  meter flood-25565 '{ ip saddr limit rate 20/second burst 40 packets }' accept
nft add rule inet filter input udp dport 25565 drop

Set the rate to roughly double what a legitimate client sends. Too low and players on high-tick-rate servers get throttled; too high and the rule does nothing.

3. Bound connection and slot counts

Most game servers accept unlimited handshakes until the slot table fills. A UDP handshake flood consumes every slot without ever joining, locking out real players. Fix it in the game config: enable a join cooldown, cap handshake attempts per IP per minute, and set a maximum pending-connection count.

4. Keep the traffic profile documented

You cannot tell a provider’s NOC “we are under attack” usefully without a baseline. Log pps and throughput continuously so you can state that normal is 8,000 pps and current is 400,000. This turns a support ticket from a guess into a mitigation request, and providers escalate faster when the numbers are precise.

# 30-second resolution pps baseline, cheap enough to run always
sar -n DEV 30 | awk '$4+$5 > 0 {print strftime(), $2, $4+$5" pps"}'

Choosing a Host on This Dimension

Ask for these five things in writing before signing, and treat vague answers as a no.

1. Is the port dedicated or shared, and does the shared port have a per-customer cap?
2. What is the pps threshold before legitimate packets are dropped?
3. Is mitigation automatic and always-on, or must you open a ticket?
4. Is there an L7 or game-protocol-aware filtering option, and what does it cost?
5. What is the mitigation latency, and is there a written SLA for gaming traffic specifically?

A host that answers all five concretely is worth a premium. A host that answers with filtering capacity alone is selling you protection against the attacks you were least likely to receive. Check how the providers on our dedicated server comparison table rate on pps thresholds and game-aware filtering before you commit.