DDoS protection: what is filtered and what is not

How your servers are connected

The public IPv4 addresses of your game servers, VPS and containers come from our network partner Noez and reach us through a GRE tunnel. Traffic from the internet therefore passes through the Noez network first and is filtered there before it reaches your server.

What is filtered

• Volumetric attacks at network and transport level (layers 3 and 4): floods of packets meant to overload a line or a server.
• The filtering is on around the clock, for every public address, without you switching anything on. It costs nothing extra.

What is not filtered

• Attacks at application level (layer 7): many requests that look like normal traffic, for example to a website, a login or a game server's query. Your software's settings, a plugin or, for websites, a service in front such as Cloudflare help against these.
• We do not run filter rules of our own for individual games.

During a persistent attack

If an attack does not stop, Noez may null-route the attacked address for a while: traffic to that address is then dropped, and your server cannot be reached at it for some time. This protects everyone else on the same network. We therefore cannot promise that a server stays reachable during an attack.

What you can do yourself

• VPS and containers: keep only the ports open that you need, most easily with the server's firewall in the Firewall tab, which works outside the server, or in addition with a firewall in the system such as ufw or nftables.
• Minecraft: the whitelist and online-mode=true keep strangers and bots out. In the Players tab, Lock down kicks all players from the server and switches the whitelist on.
• The state of the network is on the status page under Network.