What to do when your server gets attacked

A classic volumetric attack takes care of itself: layer 3 and 4 filtering spots the pattern and drops the traffic before it reaches your node. That kind of attack used to take whole servers down; today it's a solved problem at any serious provider.

The ones that still hurt are at layer 7, because they imitate a real player. A bot that connects, completes the handshake and disconnects a thousand times a minute consumes resources exactly like a thousand legitimate players, and no volume filter can tell them apart.

Three measures work against that. First, limit connections per IP in the game server itself. Second, use a reverse proxy with an allowlist for administrative ports, so RCON and web panels aren't exposed. Third, and the one most people ignore: never hand out the node's direct IP — always give a subdomain.

If a layer 7 attack is affecting you right now, open a ticket with the exact start time. We can apply game-specific rules within minutes.