How to Protect Game Servers from DDoS Attacks: UDP Flood Mitigation & IPTables Filters
Shield your multiplayer servers from NTP amplification, SYN floods, and UDP volumetric attacks. Deploying hardware scrubbing proxies, Anycast GRE tunnels, and kernel rate-limiting.
D
By Darius King, Esports Network Engineer
The Nature of Game Server DDoS Attacks
Unlike websites that operate over stateful TCP HTTP/HTTPS, game servers rely heavily on connectionless UDP. This allows attackers to forge source IP addresses and flood your server with hundreds of gigabits of spoofed packets.
Kernel UDP Buffer Hardening
Append these directives to /etc/sysctl.conf to prevent buffer exhaustion and enable SYN cookies:
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.core.netdev_max_backlog = 50000
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864IPTables Hashlimit for UDP Query Flood Protection
# Drop UDP packets larger than standard game payload (1400 bytes)
iptables -A INPUT -p udp --dport 27015 -m length --length 1400:65535 -j DROP
# Rate-limit A2S_INFO query floods (Source Engine)
iptables -A INPUT -p udp --dport 27015 -m string --hex-string "|54536f7572636520456e67696e6520517565727900|" --algo bm -m hashlimit --hashlimit-name a2s --hashlimit-above 20/sec --hashlimit-burst 40 --hashlimit-mode srcip -j DROP