Game servers hand their address to strangers, run mostly on UDP and notice every lost packet, so a generic flood filter can hurt as much as the attack. What a Minecraft server should expose, how a Velocity proxy hides the backend, why open query ports reflect floods, and what to ask a host.
Game server DDoS protection has a harder job than protecting a website. The server's address goes to every player who joins, most game traffic is UDP, and players feel a few lost packets as rubber-banding or a dropped connection. A filter that cannot tell a flood from a busy match finishes the attacker's work. Below: why game hosts draw floods, what to expose, proxies, query reflection and what to ask a host.
A game server hands out its own address: server lists, chat invites and every player's saved servers carry it, so anyone who has joined knows it, including the griefer you banned an hour ago and the rival community that wants your players. A flood of a few minutes empties a match, and players who cannot connect find another server and may stay there.
Cloudflare's reports agree:
2.5 Tbps is 2,500 times a 1 Gbps uplink. Nothing on the server absorbs that, so filtering has to happen upstream; our DDoS protected dedicated server guide explains how scrubbing works and how to size it. Its 2025 Q3 report also says most attacks are relatively small and 89% of network-layer attacks end in under 10 minutes, so the real question is usually whether the filter is already on.
Cloudflare counted UDP floods as the top network-layer vector in 2025 Q3, up 231% on the previous quarter. Most game traffic is UDP too.
UDP has no handshake. As CISA's amplification advisory notes, it is connectionless and does not validate source addresses, so a forged packet looks like any other until something reads the payload. TCP is easier: data flows only after a handshake, and SYN cookies (RFC 4987) let the receiver answer a SYN flood without keeping state. A spoofed source never sees the reply, so it never completes a connection.
A generic filter facing a UDP flood has blunt tools, and each hurts a game:
Every real player dropped is a packet the attacker did not have to send. What works is a policy tuned to the title: one that knows the game's ports, what a valid packet looks like and how a session starts, and drops what does not match.
Minecraft shows both cases. Java Edition listens on TCP port 25565, so a filter can validate players by their handshake. Bedrock Dedicated Server listens on UDP port 19132 and needs a filter that understands its protocol. The relevant server.properties defaults, from the Minecraft Wiki's copies of the Java 26.3 and Bedrock 1.26.52.3 files:
| Setting | Default | Under attack |
|---|---|---|
server-port (Java) |
25565, TCP | publish it, or your proxy's |
server-port (Bedrock) |
19132, UDP | needs a game-aware filter |
enable-query, query.port |
false, 25565 UDP |
UDP info service: leave off |
enable-rcon, rcon.port |
false, 25575 TCP |
unencrypted: localhost only |
rate-limit |
0, off |
kicks a packet-spamming client |
Query shares the number 25565 but runs on UDP, so enabling it opens a UDP service on a TCP-only server.
rate-limit sounds like DDoS protection and is not. The wiki defines it as the maximum packets a player can send before being kicked: it stops one logged-in client spamming. A flood never logs in, and a large one fills the port first. The wiki gives no time window, so test any value against your busiest real players; set too low, it kicks them.
Velocity describes itself as a Minecraft proxy. Players connect to it, and it passes them to backend servers such as a lobby or a survival world. What it buys against DDoS:
Give the proxy its own machine: on a second address of the same box, a flood at the proxy fills the backend's port too. The backend must refuse everyone but the proxy, because it relies on the proxy to vouch for each player; Velocity's docs cover this under player information forwarding and securing your servers. With the proxy at 198.51.100.20 and an existing inet filter table, so the drop also covers IPv6:
nft add rule inet filter input ip saddr 198.51.100.20 tcp dport 25565 accept
nft add rule inet filter input tcp dport 25565 drop
A proxy concentrates risk rather than removing it: a flood that overwhelms it disconnects everyone on it. If the backend's address was ever public, in an old DNS record or a server list, change it first. For titles without a proxy layer, the game server's own address is the public one, and the upstream filter carries the load. Minecraft server hosting covers sizing a Velocity network.
Many games answer a small UDP server-info query with a larger reply: name, map, player list. Answered for anyone, that is an amplifier: queries carrying the victim's forged address make thousands of game servers reply to the victim. CISA's table of UDP amplification factors lists two game protocols, both for server info exchange: the Quake Network Protocol at 63.9 and the Steam Protocol at 5.5.
The factor is reply payload bytes per request payload byte. At 63.9, 100 Mbps of forged queries becomes 6.39 Gbps at the victim, more than six 1 Gbps ports; at 5.5, it becomes 550 Mbps. Headers make the on-wire ratio a little lower, and every amplifier spends its own uplink on the attack.
CISA's advice applies: disable services you do not need or deny internet access to them, and shape UDP requests against repeated abuse. Minecraft Java ships with query off; leave it off unless a listing site needs it, then admit only the addresses that poll it. If a title's in-game browser must query your server, keep the port, rate-limit replies per source where you can, and ask whether the host's filter recognises its query traffic. Types of DDoS attacks covers the other attack families.
Beyond the general questions in the guide above:
Our game server hosting runs on dedicated servers from €209 a month and KVM VPS from €29. Every dedicated server and VPS plan has DDoS protection on the order form, 100 Gbps included. Monthly, EUR, excluding VAT, checked 26 October 2026:
| Tier | Monthly |
|---|---|
| 100 Gbps | included, €0 |
| 500 Gbps | €149 |
| 1 Tbps | €499 |
| 2 Tbps | €999 |
| 5 Tbps | €2,499 |
| 10 Tbps + Layer 7 | €4,499 |
Tiers up to 5 Tbps are network-layer (L3/L4) protection; Layer 7 filtering is part of the 10 Tbps tier. Network-layer floods, 78% of attacks in Cloudflare's 2025 Q4 data, are the usual risk for a game port. The 2.5 Tbps Minecraft attack would have needed the 5 Tbps tier; the included 100 Gbps is 100 times a 1 Gbps port.
On request, we tune the network-level policy to your titles: tell us the games and ports you run. To change tier on a running server, ask support. For CPU, memory and storage, see game server hardware.
Yes, if its address is public. Every player who joins learns it, so anyone with a grudge can aim traffic at it, and a few minutes of flooding empties a match. Protection has to sit upstream of the port and already be on, since most attacks end within minutes.
Because game traffic is mostly UDP, which has no handshake, so a generic filter cannot easily tell a forged packet from a player's. Its fallback tools drop players sharing an address, throttle the whole match, or fail clients that cannot answer a challenge. A policy tuned to the game's protocol avoids most of that.
Not by itself. Only the proxy's address is published, so the backend running the world cannot be targeted unless its address leaks. The proxy still needs upstream protection, and a flood that overwhelms it disconnects everyone, but it can be replaced on a new address without moving the world.
If nothing needs it, yes. Query protocols answer a small UDP request with a larger reply, which attackers use to reflect floods at others; CISA puts the Quake Network Protocol's amplification factor at 63.9. If your game's server browser needs the port, keep it open and rate-limit replies per source.
Why a flood aimed at one VPS is a flood at every guest on its node, why budget hosts answer with a null route, what DDoS protection has to mean on a VPS, what the guest still handles itself, the questions to ask a host, and when a protected VPS is enough or a dedicated server is the better buy.
A server cannot filter a flood that has already filled its port, so protection has to sit upstream. How the filtering works, why hosts null-route unprotected IPs, always-on versus on-demand, what a 100 Gbps tier does and does not cover, how big a tier to buy and seven questions to ask any host.
A hidden primary, three secondaries in different cities and networks, TSIG-signed NOTIFY and zone transfers, a working Knot DNS config with automatic DNSSEC signing, and the dig commands that prove an authoritative DNS server answers correctly. Plus what it costs and when managed DNS wins.