DDoS Protection for Game Servers: What Actually Works
Game servers are soft targets. A fixed public IP, UDP packets that must be answered fast. Both of those are things attackers exploit. Here is what is actually happening during a DDoS attack, and what protection looks like at the network level.
What is a DDoS attack on a game server?
DDoS stands for Distributed Denial of Service. The goal is to flood your server with traffic or connections so it cannot serve real players. Attack traffic comes from a botnet, hundreds or thousands of compromised machines, which is why blocking one IP does not stop it.
Game servers are common targets because they expose a fixed public IP and port to the internet, and they must respond to UDP packets fast enough to keep the game ticking. Most game server DDoS attacks are low-effort: someone buys a cheap booter service for a few pounds and fires a 5–10 minute burst. That is enough to disconnect players or freeze the server without a mitigation layer in place.
Common attack types targeting game servers
Volumetric attacks
Raw bandwidth flooding: sending so much traffic that your server's uplink is saturated. Even if your server ignores the packets, the pipe is full. Mitigation must happen upstream, not on the server itself.
UDP amplification attacks
The attacker spoofs your server's IP and sends small requests to third-party services (DNS resolvers, NTP servers) that reply with much larger responses. Your server receives a flood it never asked for. DNS amplification can reach 50×; NTP up to 556×; Memcached up to 51,000×.
Protocol attacks (SYN flood, UDP flood)
Exhaust the server's connection state table or application threads. The server struggles to process legitimate player packets while trying to handle garbage.
Application-layer attacks
Less common on game servers, but some target specific game protocols to cause the server process to crash or hang without requiring huge bandwidth.
How hosting-level DDoS protection works
Upstream network filtering: traffic is inspected at the provider's network edge before it reaches the physical server. Obvious attack traffic is dropped at the router level. Legitimate player packets pass through.
Null routing (blackholing): if an attack is too large to filter cleanly, the provider routes all traffic destined for the attacked IP to nowhere. This stops the attack from impacting other customers, but it also takes your server offline temporarily. It is a last resort, not a defence.
Anycast scrubbing centres: large providers route incoming traffic through scrubbing centres spread across multiple locations. Attack traffic is absorbed and cleaned before being delivered to the server. This is the highest tier of protection.
The quality of DDoS mitigation is largely a property of the network provider the host uses, not the hosting company itself. A host on a well-connected, well-mitigated network passes that protection down to every server on it.
What you cannot do as a server owner
- You cannot stop a large volumetric attack at the application level. If your uplink is saturated, it does not matter how good your server's firewall rules are.
- Blocking individual IPs has limited effect on attacks from botnets spread across thousands of IPs.
- You cannot prevent someone from knowing your server's IP if it is publicly listed in the server browser.
- Changing your server's IP after an attack may help temporarily, but a determined attacker can find the new IP quickly.
- You cannot trace a DDoS attack in any meaningful way. The source IPs are almost always spoofed or belong to compromised machines.
How our infrastructure handles it
Zeros Host runs on Hetzner infrastructure in Germany. Hetzner includes network-level DDoS mitigation as a standard part of their network: volumetric and protocol attacks are filtered at Hetzner's network edge before reaching your server.
This is not proprietary technology. It is Hetzner's mitigation, which is well-regarded and handles the majority of game server attacks that happen in practice. For very large or sustained attacks, Hetzner may null-route the affected IP temporarily.
We do not sell tiered DDoS protection. Every server on our network gets the same baseline Hetzner mitigation. We think that is more honest than selling "enhanced protection" packages on top of the same infrastructure.
What to do when your server is under attack
- Check whether it is actually a DDoS. High ping and disconnections can also be caused by the server process itself: a bad Lua script, memory pressure, a CPU spike. Check server RAM and CPU in the panel first.
- Confirm with the host. Open a support ticket. They can see whether your IP is receiving abnormal traffic volumes and whether mitigation is active.
- Do not restart the server repeatedly. Restarting will not stop a network-level attack and may make diagnosing the situation harder.
- Communicate with your players. A quick Discord message prevents most of the panic. Players who know what is happening are more patient than players left guessing.
- Wait it out if it is a short burst. Most cheap booter attacks last 5–15 minutes. If your host's mitigation is active, the attack may subside before it causes major disruption.
- Contact the host if it is sustained. If the attack continues for more than 30 minutes or is happening repeatedly, your host needs to be involved.
Frequently asked questions
Can I stop a DDoS attack on my game server myself?
Not if it is a volumetric attack. If the attacker is sending more traffic than your server's uplink can carry, there is nothing you can do at the server level. The pipe is full before your firewall rules even see the packets. Protection needs to happen at the hosting network level, upstream of your server. What you can control is choosing a host with solid upstream mitigation in place.
What kind of DDoS protection does Zeros Host include?
Zeros Host runs on Hetzner infrastructure in Germany, which includes network-level DDoS mitigation as a standard part of the network. Volumetric and protocol attacks are filtered at Hetzner's edge before reaching your server. This is not a proprietary system: it is Hetzner's mitigation, which handles the large majority of game server attacks in practice. For very large attacks, Hetzner may temporarily null-route the affected IP.
Will changing my server's IP stop DDoS attacks?
Temporarily, sometimes. If the attacker found your IP through the public server browser or a community site, they can usually find the new one quickly as well. It is a short-term measure, not a solution. The better approach is to be on a network with active mitigation so attacks are absorbed without taking your server offline.
How do I tell the difference between a DDoS attack and my server just lagging?
Check the server panel first. If CPU and RAM are normal but players are disconnecting, it is more likely a network issue (possibly an attack). If CPU or RAM is spiking, the problem is more likely on the server side. Your host can confirm whether your IP is receiving abnormal traffic: open a support ticket and ask.
Does DDoS protection affect my server's ping for normal players?
It should not meaningfully. Mitigation operates on attack traffic and does not add latency to legitimate player packets in normal operation. The only time normal players notice mitigation is if null routing is triggered, which takes the server offline temporarily during very large attacks.
Every Zeros Host server includes Hetzner network-level DDoS mitigation
You do not pay extra for it. It is built into the network. Start a 24-hour free trial and see the panel for yourself before committing.
See plans and pricing →