A DDoS (distributed denial-of-service) attack floods your server or network with traffic from many sources, so real users can’t get through. Popular game servers, forums, crypto projects and competitive businesses are frequent targets, but any public service can be hit. This guide explains what you can do on the server itself, and where you need upstream protection.

Types of attacks

Layer Examples Target
Volumetric (L3/L4) UDP floods, amplification (DNS, NTP, memcached), SYN floods Saturate the network link
Protocol SYN floods, fragmented packets, connection exhaustion Exhaust server or firewall state tables
Application (L7) HTTP floods, expensive search or login requests Exhaust CPU, PHP workers, database

Details: DDoS attack types.

What one server can and can’t do

  • A volumetric attack larger than your server’s network port (for example 1 Gbps) can’t be stopped on the server. The link is already full before packets reach your firewall. That needs upstream filtering by the network provider or a scrubbing service.
  • Application-layer attacks and smaller floods can often be handled with good configuration on the server: rate limiting, caching, firewall rules.

Upstream protection options

Option Protects Notes
Provider DDoS mitigation L3/L4 volumetric attacks on your IP Filtering in the provider’s network
CDN / reverse proxy (Cloudflare and others) Websites (HTTP/HTTPS), hides origin IP Doesn’t cover non-HTTP services unless using special products
Game/TCP/UDP proxies (e.g. specialised game DDoS services) Game servers and custom protocols Adds a hop; choose locations near players

VPS.DO: DDoS protection is available as a paid add-on for dedicated servers (USA, Hong Kong, Japan and Singapore). VPS plans don’t include DDoS protection, so for frequently targeted services, use a protected dedicated server, or put a CDN or proxy in front. See USA dedicated servers, Hong Kong dedicated servers, and Japan dedicated servers.

Websites: put a CDN in front

  1. Route the site through a CDN or proxy with DDoS protection. See using Cloudflare with a VPS.
  2. Hide the origin IP: don’t expose it in DNS records (for example on an unproxied subdomain, or mail records on the same IP), and change the IP if it has leaked.
  3. Allow HTTP/HTTPS only from the CDN’s IP ranges at your firewall, so attackers can’t bypass it.
  4. Configure WAF and rate-limiting rules at the edge. See Cloudflare WAF rules.

Server-side hardening (helps with smaller and L7 attacks)

  • Rate limiting in Nginx (limit_req, limit_conn). See Nginx rate limiting.
  • Caching, so most requests never reach PHP or the database. See Nginx FastCGI cache.
  • SYN cookies and sensible kernel network settings:
sudo sysctl -w net.ipv4.tcp_syncookies=1
sudo sysctl -w net.ipv4.tcp_max_syn_backlog=4096
  • A firewall that drops everything you don’t serve, and limits new connections per IP. See nftables and iptables.
  • Fail2ban for abusive patterns in logs. See Fail2ban.
  • Don’t run open amplification services (open DNS resolvers, memcached on public interfaces). They get abused to attack others.

Game servers

Game servers use UDP, and can’t hide behind an HTTP CDN. Options: a provider with DDoS mitigation in front of your IP, a dedicated game protection proxy service, or a protected dedicated server. Keep RCON and admin ports restricted, and don’t reveal the real IP of backend servers. See game server VPS.

During an attack

  1. Confirm it: traffic graphs, iftop/nload, ss -s connection counts. See iftop and nethogs.
  2. Identify the type (UDP flood? HTTP flood on one URL?).
  3. Contact your provider with the details (timestamps, target IP and port, traffic volume).
  4. Apply temporary rules: block the attacked port if it’s unused, raise rate limits on hot URLs, or enable stricter CDN modes (“under attack” challenge pages).
  5. Afterwards, review: move the service behind protection if attacks recur.

Quick reference

Threat Defence
Volumetric floods Upstream mitigation (provider, scrubbing, CDN)
HTTP floods CDN + WAF + Nginx rate limits + caching
SYN floods SYN cookies, firewall, upstream filtering
Game server attacks Protected IP / game DDoS proxy
Origin exposure Hide IP, allow only CDN ranges

Related: Linux server hardening checklist and VPS vs dedicated server.

  • DDoS
  • Security
  • VPS Guide