DDoS Protection and Server Security: A Complete Guide

DDoS Protection and Server Security

A DDoS (Distributed Denial of Service) attack tries to knock your server offline by drowning it in traffic. Game servers, e-commerce sites and popular web applications are the most frequent targets. This guide covers the attack types, how to defend against each one, and the security practices that make your server a harder target overall.

Types of DDoS Attack

1. Volumetric Attacks

These aim to saturate your bandwidth:

• UDP Flood: floods the link with spoofed UDP packets
• DNS Amplification: abuses DNS resolvers to multiply traffic volume
• NTP Amplification: the same trick using NTP servers

2. Protocol Attacks

These aim to exhaust server resources:

• SYN Flood: a barrage of half open TCP connections
• Ping of Death: oversized ICMP packets
• Smurf Attack: an ICMP echo reply flood

3. Application Layer Attacks

These target a specific service:

• HTTP Flood: overwhelming a web server with requests
• Slowloris: holding connections open as slowly as possible
• DNS Query Flood: keeping a DNS server permanently busy

Why Game Servers Get Hit

Game servers are unusually attractive targets:

• FiveM servers: attacked by competing server owners
• Minecraft servers: griefers and rivals
• Rust servers: heavy attack traffic on wipe days
• MTA servers: community disputes spilling over

⚠️ Running a game server on a VDS without DDoS protection is asking for trouble.

How to Defend

1. Protection at the Provider Level

The most effective DDoS mitigation happens upstream, in the network, before traffic ever reaches your server.

🛡️ White Bilişim includes DDoS protection on every Xeon Enterprise VDS and Ryzen Premium VDS plan. Our security infrastructure at the Istanbul / Datacasa data centre absorbs volumetric and protocol attacks on your behalf.

2. Firewall Configuration

# A sane UFW baseline
sudo ufw default deny incoming
sudo ufw default allow outgoing
 
# Open only what you need
sudo ufw allow 22/tcp        # SSH
sudo ufw allow 80/tcp        # HTTP
sudo ufw allow 443/tcp       # HTTPS
sudo ufw allow 30120/tcp     # FiveM
sudo ufw allow 30120/udp     # FiveM
sudo ufw allow 25565/tcp     # Minecraft
 
sudo ufw enable

3. Advanced iptables Rules

# SYN flood protection
sudo iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
sudo iptables -A INPUT -p tcp --syn -j DROP
 
# ICMP rate limiting
sudo iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
 
# Drop invalid packets
sudo iptables -A INPUT -m state --state INVALID -j DROP

4. Fail2Ban

# /etc/fail2ban/jail.local
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

5. Cloudflare Proxy (For Websites)

Putting a website behind Cloudflare lets you:

• Stop attacks at the edge before they reach your server
• Hide your origin IP address
• Speed up delivery through the CDN
• Filter malicious requests with a WAF

General Server Security Practices

1. Strong passwords: 16 characters or more, mixed character classes
2. SSH keys: disable password authentication entirely
3. Regular updates: keep the OS and all services patched
4. Port discipline: only open what is genuinely needed
5. Log monitoring: watch for suspicious activity
6. Regular backups: free daily backups are included on every plan
7. Limit root access: create separate user accounts with sudo

Conclusion

DDoS protection is not optional for game servers or commercial websites. Every White Bilişim VDS ships with mitigation included, and the hardening steps above cover the rest of the attack surface.

👉 For a DDoS protected VDS, see Xeon Enterprise VDS or Ryzen Premium VDS, and add a backup server so an incident never costs you data.