DDoS protection
Floods stop at the network, not at your server.
Every Loafhosts server sits behind Terabit, our parent network. Each packet is checked against what your game expects, from the first one, so there is no attack to spot before it is stopped. It comes with the server: nothing to switch on and no tier to buy.
The internet
Players and floods arrive together.
Stage 1, the edge
500+ Tbpsof capacity
Floods built on sheer volume are absorbed here.
Stage 2, Terabit
13+ Tbpsstateful, across 13+ locations
Each packet is checked against what the game expects.
Your server
Only traffic shaped like your game arrives.
There is no attack to detect first.
Protection that waits has to recognise an attack before it can stop it, and players drop while it decides. Terabit filters every packet from the first one, so traffic takes the same filtered path on a quiet night as it does in the middle of a flood.
Players are cut off for as long as it takes to notice the attack and switch mitigation on.
The attack arrives at the same filters that were already there. Players stay connected.
What gets dropped, and where.
Two stages, each with its own job and its own capacity. The two figures measure different things.
Stage 1
The edge
500+ Tbpsof capacity
Takes the floods that try to fill the pipe, before they reach the network your server is on.
- Volumetric
- TCP floods (SYN, ACK, RST and mixed flags), UDP floods, ICMP floods, tunnel protocol floods and botnet floods.
- Reflection and amplification
- Spoofed TCP reflection, UDP amplification (DNS, NTP, Memcached, SSDP, LDAP, SNMP, Chargen, TFTP) and QUIC reflection.
Stage 2
Terabit
13+ Tbpsstateful, across 13+ locations
Catches what is shaped to look like real players, so it gets past the first stage on purpose.
- Exhaustion
- Malformed packets, impossible TCP flag combinations, IP fragmentation, packets from reserved addresses and packets to reserved ports.
- Game protocols
- Arma Reforger handshake floods and malformed packets, server query floods, Rust connection floods and Minecraft handshake and bot floods.
Not a complete list. Traffic that does not match what your game expects is dropped, whether it is on this list or not.
See what protects each port.
In the ArthOS panel, each server's Network page has a Protection tab: every port, the filter on it, and what Terabit has.
- Automatic
Each port gets the filter made for what it is for, and the panel checks it against what Terabit has.
- Your call
Pick another filter for a port, or turn it off. The panel asks first: a change disconnects everyone on that port for a moment.
- Allow rules
Let one address through on a game port, for a tool or a friend the filter blocks. Up to 25 per server.
What each port gets
- The game port
A filter made for the game: Minecraft Java and Minecraft Bedrock (a crossplay server gets both), Arma Reforger, Rust, DayZ and Squad.
- The query port
A filter for server list queries, on every game that has a query port.
- BattlEye RCON
On Arma Reforger and DayZ, a filter for BattlEye RCON, so admin tools keep working.
- Enshrouded
No filter made for Enshrouded exists yet, so its ports have the edge in front of them but no game filter.
- Project Zomboid
Its game filter is not switched on yet, so its ports have the edge in front of them but no game filter.
- 7 Days to Die
No filter made for 7 Days to Die exists yet, so its ports have the edge in front of them but no game filter.
- Valheim
Its game and query ports have the edge in front of them but no game filter. Crossplay players come in through the game's own relay.
- Satisfactory
Its game and reliable messaging ports have the edge in front of them but no game filter.
- VEIN
Its game and query ports have the edge in front of them but no game filter. The game's own API is never open to the internet: only the panel reaches it, through a gate of its own.
- Palworld
Its game port has the edge in front of it but no game filter yet. The game's own API is never open to the internet: only the panel reaches it, through a gate of its own.
Support
Straight answers.
Something else about protection? Our team answers from the Support page in the panel. Contact support
Do I need to switch anything on?
No. Every server is behind the network from the start, and the panel puts the right filter on each port by itself.
Does it cost extra?
No. It comes with every game server and dedicated server. There is no add-on and no higher tier to buy.
Does it add latency?
No extra hops. The filtering sits on the path your traffic already takes to your server.
What happens if something gets through?
Terabit has its own mitigation engineers. They patch a leak themselves, usually within minutes.
A friend or a tool cannot connect. What now?
Add an allow rule for their address on the game port, from the Protection tab on the server's Network page. If that does not help, open a ticket with the address and the port.
Is it the same on dedicated servers?
Yes. Dedicated servers sit behind the same network and the same filtering. There is no lighter version.