DDoS protection on every IP, always on

Network-level DDoS attacks try to exhaust bandwidth or connection state: UDP floods, reflection and amplification attacks that abuse open DNS, NTP or memcached servers, and SYN floods. These are the attacks edge filtering is built for, because they have to be stopped before they reach a single server's port.

Application-layer attacks are different. An HTTP flood that sends valid-looking requests, or a bot hammering a login page, can look like ordinary traffic at the network level. Plan for those in your own stack:

• Rate limiting in NGINX, HAProxy or your API gateway.
• Caching, so expensive pages are not rebuilt for every request.
• A CDN or web application firewall in front of public web applications that are frequent targets.

If you see unusual traffic or degraded service, open a support ticket, 24/7, with the affected IP and a time window.

DDoS protection works best on a server that exposes as little as possible. A short checklist:

• Default-deny firewall: with nftables or ufw, allow only the ports you serve, and restrict SSH, RCON, databases and admin panels to your own addresses or the private network.
• Don't become an amplifier: never expose open DNS resolvers, NTP monlist, memcached or SSDP to the internet. Misconfigured services are what attackers use against others, and our acceptable use policy applies.
• Kernel settings: keep SYN cookies enabled (net.ipv4.tcp_syncookies = 1, the Linux default) and size connection tracking for your peak traffic.
• Application limits: cap connections and requests per client IP in your web server or game server.

For game servers and other UDP services, also restrict query ports and keep server software updated, since protocol-level bugs can be exploited with very little traffic.