Game Server DDoS Protection: Why a Web Proxy Won't Save a UDP Server

Most DDoS advice is written for websites: put a proxy in front, hide the origin, filter the requests. Game servers break it. Minecraft, CS2, Rust, FiveM, ARK, Valheim and Palworld servers speak their own protocols, mostly over UDP, and a web proxy can read none of them. Game server DDoS protection has to happen at the network edge, in front of the server's real address, or in a relay built for the game. Here is what that means for ports, attacks, packet rates and the server you rent.

Why a web proxy can't front a game server

A website DDoS proxy accepts HTTP and HTTPS, usually on ports 80 and 443, inspects each request and forwards clean ones to your origin. Gameplay traffic isn't HTTP. Each game has its own protocol on its own port, according to the publishers' documentation:

Minecraft: Java Edition is the best-known exception to UDP: it runs over TCP, but its protocol is still not HTTP.

FiveM shows the split clearly. Cfx.re's documentation lets any HTTPS reverse proxy front its connect endpoint, but says the server endpoint, which carries the game, needs a raw TCP/UDP proxy. So protection for game traffic comes from filtering upstream of your port, at the host's network edge, or from a proxy or relay that carries the game's own TCP and UDP traffic.

What attacks game servers actually see

• UDP floods at the game port. Small packets, often from forged addresses, each of which must be received and inspected before it is dropped.
• Reflection and amplification. Small requests go to open services with your address forged as the source, so the larger replies land on you. Game queries work too: CISA's advisory gives Steam's server-info exchange an amplification factor of 5.5, and the Quake network protocol 63.9.
• Query floods. Source servers answer 25-byte A2S_INFO queries from the server browser. In November 2020 Valve called this a reflection attack vulnerability. In December it shipped an opt-in fix: the server answers with a challenge, and the client must repeat its request with it, proving its address is real.
• Handshake floods. SYN floods and half-finished logins on TCP games; fake challenge or connection requests on UDP games. Valve's December 2020 release hardened challenge generation against attacks designed to fill its challenge table.
• Attacks on players. A player's home connection usually has no DDoS protection, and nothing you buy for the server changes that.

Why packet rate matters more than gigabits

Floods at a game port often use small packets, so they exhaust a filter's packet budget long before its bandwidth. A spoofed A2S_INFO query is 25 bytes of payload plus 8 bytes of UDP header, 20 of IPv4 and 18 of Ethernet header and checksum: a 71-byte frame. With 20 bytes of preamble and inter-frame gap it takes 91 bytes, or 728 bits, on the wire.

• NexonHost VPS protection is 20 Gbps / 1 Mpps. A million query-sized packets a second is 1,000,000 × 728 bits = 0.73 Gbps: the packet budget is full at under 4% of the bandwidth.
• Dedicated server protection is 40 Gbps / 4 Mpps. Four million a second is 2.9 Gbps, about 7% of the 40 Gbps.

Cloudflare's DDoS threat report for the first half of 2026 found that 96.62% of network-layer attacks stayed under 500 Mbps, and that attackers sometimes pair a high packet rate with low bandwidth. Small is not harmless: 500,000,000 ÷ 728 ≈ 687,000 query-sized packets a second, over two-thirds of a 1 Mpps budget. Read the Mpps figure first; Gbps vs Mpps works through every tier.

Hiding the origin: relays, or a public IP

A website can hide its origin IP behind a proxy. A game server usually can't: the server browser publishes its address so that players can join.

One exception is a game built on a relay network. Valve says its Steam Datagram Relay protects servers and players because IP addresses are never revealed, and that all relayed traffic is authenticated, encrypted and rate-limited. But SDR has to be built into the game: Valve tells developers to port their socket code to Steamworks APIs, so a server operator can't add it. FiveM is another: with Cfx.re's two proxies in front and sv_forceIndirectListing set, the server list stops advertising the real IP, and the proxy's address is the one exposed. If your game connects players directly, assume your IP is known, and judge your host by the network protection in front of it.

What you can harden on the host

Rules on the server can't stop a flood that fills its port, because the traffic has already arrived. They do remove cheap attacks and shrink what is exposed.

1. Close query ports you don't need; rate-limit the rest. Valve's December 2020 release added an experimental setting, STEAM_GAMESERVER_RATE_LIMIT_200MS, which drops server-browser queries from one address beyond a set number per 200 ms; Valve suggested 25 to 75. STEAM_GAMESERVER_A2S_INFO_REQUIRE_CHALLENGE=1 turns on the challenge. Both are read by Steam's game-server binaries from that release on, so check that your game ships them. Test your monitoring tools first: Valve warned the change would break third-party query tools that had not been updated.
2. Firewall RCON to your own addresses. On a Source server, RCON is TCP 27015 and gameplay is UDP 27015, so dropping TCP 27015 from everyone but your admin address leaves player traffic untouched. Rust's RCON is TCP too.
3. Keep the game off your website's IP. The game's address is public by design. If your website or panel shares it, every attack on the game hits them too, and a site hidden behind a proxy is exposed. An extra IPv4 address on a NexonHost dedicated server is €3 a month, up to five.

VPS or dedicated?

Size by the publisher's own requirements where they exist. Pocketpair's Palworld documentation asks for 16 GB of memory, recommends more than 32 GB, and recommends four or more CPU cores. Most games publish nothing that precise, so start small and watch memory and CPU at full player load.

The VPS upgrade is the cheapest large packet budget: a NEX3 at €32 plus €150 is €182 a month for 10 Mpps, while 8 Mpps on the entry Xeon is €129 + €300 = €429 a month. Dedicated wins when you need the memory, several game instances, or cores nobody else shares. Xeon builds provision in minutes; EPYC builds take about two weeks. Xeon vs EPYC explains why single-thread speed matters for game simulations, and our gaming community overview makes the wider case for dedicated hardware.

What no network filter can do

A good Layer 3/4 filter can drop traffic that is easy to tell from players: reflected DNS, NTP or CLDAP replies, packets to ports you don't run, malformed packets, SYN floods. Without rules written for your game, it cannot separate a flood of well-formed packets at the game port from real players and queries. Ask any provider, us included, whether they filter for your specific game, and what happens when an attack exceeds your tier.

NexonHost's included VPS and dedicated protection works at Layers 3 and 4. In-game abuse, such as bot joins or crash exploits, belongs to the game's settings and plugins. The website protection proxy is built for HTTP and HTTPS sites, so don't buy it for game traffic. If your server runs elsewhere, note that the plans on the DDoS mitigation services page (nodes in Germany, the Netherlands and Romania, up to 1 Tbps at Layer 4) are the same remote proxy tiers sold for websites, so ask us what they can carry for your game's protocol before you order. Under attack right now? Start with what to do when your server is under DDoS attack.

Choosing game server DDoS protection at NexonHost

For game server DDoS protection, compare the included packet rate first. Every Linux VPS includes 20 Gbps / 1 Mpps from €9 a month, upgradable to 100 Gbps / 10 Mpps for €150 a month. Every dedicated server includes 40 Gbps / 4 Mpps from €129 a month, with upgrades up to 1 Tbps / 100 Mpps for €1,500 a month. Start on a one-month term, watch your graphs at peak, and move up when they tell you to.

Prices are as of 12 October 2026, in euros excluding VAT. Check the product page before you order.

Sources

• Steam Support — Required Ports for Steam: dedicated servers use UDP 27015 for gameplay and TCP 27015 for SRCDS RCON by default, retrieved 12 October 2026.
• Valve (Fletcher Dunn), Steam Discussions — "RFC: Changes to the A2S_INFO protocol", 16 November 2020: the reflection attack vulnerability, the 25-byte A2S_INFO request format, and the warning that the fix breaks existing third-party query tools, retrieved 12 October 2026.
• Valve (Fletcher Dunn), Steam Discussions — "Changes to server browser packets in latest Steam client", 7 December 2020: the S2C_CHALLENGE handshake and its opt-in variable, challenge generation hardened against attacks that fill the challenge table, and the experimental 200 ms query rate limit, retrieved 12 October 2026.
• Steamworks documentation — Steam Datagram Relay: relaying protects servers and players because IP addresses are never revealed; traffic is authenticated, encrypted and rate-limited; developers must port their low-level socket code to Steamworks APIs, retrieved 12 October 2026.
• Cfx.re documentation — Setting up a vanilla FXServer: example server.cfg with TCP and UDP endpoints on 30120, retrieved 12 October 2026.
• Cfx.re documentation — Proxy setup: an HTTPS reverse proxy for the connect endpoint, a raw TCP/UDP proxy for the server endpoint, and sv_forceIndirectListing to keep the real IP out of the server list, retrieved 12 October 2026.
• Facepunch Rust wiki — Creating a server: server.port 28015 is UDP, RCON is TCP, the query port is UDP, retrieved 12 October 2026.
• Pocketpair Palworld server documentation — Requirements: 4+ CPU cores recommended, 16 GB memory with more than 32 GB recommended, UDP port 8211, retrieved 12 October 2026.
• Minecraft.net — Minecraft server download page: open port 25565 for Java Edition, retrieved 12 October 2026.
• Microsoft Learn — Bedrock Dedicated Server properties: server-port defaults to 19132, server-portv6 to 19133, retrieved 12 October 2026.
• CISA alert TA14-017A — UDP-Based Amplification Attacks: bandwidth amplification factors of 5.5 for the Steam protocol and 63.9 for the Quake network protocol (last revised 18 December 2019), retrieved 12 October 2026.
• Cloudflare DDoS Threat Report H1 2026 — 96.62% of network-layer attacks under 500 Mbps; attacks pairing high packet rates with low bandwidth (published 11 August 2026), retrieved 12 October 2026.
• RFC 5180 — IPv6 Benchmarking Methodology: 20 bytes of preamble and inter-frame gap per frame; 1,518 bytes as the largest untagged Ethernet frame, retrieved 12 October 2026.
• RFC 894 — A Standard for the Transmission of IP Datagrams over Ethernet Networks: the largest IP datagram on Ethernet is 1,500 octets, retrieved 12 October 2026.
• RFC 768 — User Datagram Protocol: 8-byte UDP header, retrieved 12 October 2026.
• RFC 791 — Internet Protocol: minimum IPv4 header of five 32-bit words (20 bytes), retrieved 12 October 2026.
• NexonHost store configurator — VPS and dedicated DDoS protection tiers and prices, VPS plans, the entry Xeon and EPYC 9254 builds, extra IPv4 addresses and delivery times, retrieved 12 October 2026.
• Computed: Ethernet header and checksum = 1,518 − 1,500 = 18 bytes; frame = 25 + 8 + 20 + 18 = 71 bytes; on the wire 71 + 20 = 91 bytes = 728 bits; 1,000,000 × 728 = 0.728 Gbps (3.6% of 20 Gbps); 4,000,000 × 728 = 2.912 Gbps (7.3% of 40 Gbps); 500,000,000 ÷ 728 ≈ 686,813 ≈ 687,000 packets per second (69% of 1 Mpps); €32 + €150 = €182; €129 + €300 = €429.