A website gets attacked by strangers. A game server gets attacked by people who know it: a player who was banned, a rival community, someone who lost a raid. The tools cost a few dollars and the timing is predictable, which is why "wipe day DDoS" is a phrase every Rust server owner knows.
What a game flood looks like
Web attacks are mostly TCP, aimed at port 80 and 443. Game servers talk UDP on their own ports, 28015 for Rust, 25565 for Minecraft, 30120 for FiveM, with packet formats the game defines. An attacker floods those ports with traffic shaped to look like game packets, or simply with enough UDP to fill the server's link.
From the inside, the server's tick rate collapses, players rubber-band, then disconnect. On a shared node, the neighbouring servers often go with it. From the outside, the Discord fills with "server down?" and the attacker posts a screenshot.
Why generic protection often misses it
Scrubbing tuned for web traffic knows what a SYN flood and an HTTP flood look like. It does not necessarily know that a burst of 1,200-byte UDP packets to port 28015 is an attack rather than a busy Rust server, so it either passes the flood through or, worse, filters the legitimate game traffic along with it. Some providers' answer to a UDP flood is to null-route the server, which means the attacker wins by default.
What the protection has to do differently
Understand the protocol. Filtering that knows what a valid Rust, Source engine or Minecraft packet looks like, so it can drop the fakes and keep the players.
Isolate the port and the server. An attack on one game server should not degrade the other servers on the node or the IP range. Port isolation keeps the blast radius to the target.
Be always on. On-demand scrubbing with a two-minute detection window means two minutes of empty server at the exact moment it matters. Wipe day attacks are timed; the protection cannot afford a warm-up.
Rate-limit, not blackhole. Above the protected capacity, slow the attack down. Taking the server offline is what the attacker wanted.
What you can do on your side
Keep RCON and admin ports closed to the internet or limited to your IP. Do not publish the server IP more widely than you need; use a DNS name. On Rust, run the server behind a queue and keep the player cap realistic for the plan size, because an overloaded server looks like an attacked one. And have a plan for the Discord: "we are mitigating, back in ten" beats silence.
What we include
Every URLStart gaming plan sits behind always-on scrubbing with game-protocol filtering and port isolation, on our own network. Above capacity, traffic is rate-limited. It is included in the plan price from the 4 GB size up, which is why the Rust, Minecraft and FiveM pages lead with it.
Questions we get asked
Is the protection different from the Cloud VPS plan? The scrubbing is the same network. Gaming plans add the game-protocol filtering and port isolation.
Will protection cause lag? Not on an always-on, in-network setup. Diversion to a remote scrubbing centre can; ours is in the path.
Can an attack on another customer affect my server? Port isolation is there to prevent exactly that.
What happens if the attack is bigger than the capacity? Rate limiting rather than null-route. The server stays reachable, slower, rather than disappearing.
Do I pay anything during an attack? No.
