Building DDoS-resilient game server infrastructure

A game server is a UDP socket with a reputation. Attackers do not need to win the match; they need the host to drop packets for twenty minutes while a tournament is live. Designing for that is not “buy a bigger pipe.” It is where state lives and which layer is always on.

Two different floods

Volumetric floods (UDP reflection, SYN, GRE) are solved in the network: drop or absorb before the hypervisor sees them. Application floods (login spam, state-table exhaustion, “legitimate-looking” tick floods) look like players. The first belongs on always-on L3/L4. The second is a policy problem and is quoted as L7 — we do not publish a consumer rate card for it. See DDoS protection.

Putting a software firewall on the game box and hoping is how you learn that conntrack fills before the CPU does.

Keep authority off the edge

A resilient layout we deploy with studios:

• Public anycast or advertised edge that only forwards a narrow UDP/TCP set.
• Game hosts on dedicated or public cloud behind that edge, often on a private VLAN.
• Matchmaking and billing on a separate origin; they are HTTP and fail independently of the tick loop.
• No SSH / RDP / panel on the same anycast prefix the players hit.

When 100 Gbps arrives, the hosts should still see a filtered stream. If the tick process is also your edge ACL, you have already lost.

What “included DDoS” means here

L3/L4 scrubbing on Zenix compute is on by default. It is not a toggle and it is not sized in a public Mbps slider. Capacity and L7 scope are written on the order when the title needs more than the always-on profile.

Ask your current provider three questions:

1. Is filtering always on, or only after a ticket?
2. Does UDP game traffic bypass the same policy as HTTPS?
3. Can you keep the session table off the game process?

If the answer to (1) is “we enable it when you are attacked,” you are buying an incident, not a control.

Operations during an event

Keep a runbook that does not start with “reboot the host.” Confirm the prefix is still announced, confirm the filter counters, then decide whether to shift advertisement or open an L7 policy. The looking glass is there so you can see what the internet sees without guessing.

Studios that treat DDoS as a network product — not a plugin on the gameserver binary — stay in the match. That is the entire design goal.