New to the topic? Start with what a DDoS attack is. Otherwise, here's how to prevent DDoS attacks, or at least how to mitigate them so your users never notice.
1. Host on a DDoS protected network
This is the single biggest step. Large floods have to be absorbed upstream on high-capacity transit; nothing you configure on the server can fix a saturated link. Choose a host with always-on volumetric mitigation, such as DDoS protected hosting, rather than one that reacts after the fact or null-routes you.
2. Keep your origin IP private
If attackers can find your real IP they can bypass any proxy in front of it. Avoid leaking it through old DNS records, mail headers, subdomains and public config files.
3. Close every port you don't need
Each open port is attack surface. Expose only what your service needs, and close the rest at the network edge rather than only on the host. Glitch Guard lets you toggle SSH, RDP, HTTP/S, MySQL, WireGuard, OpenVPN and IPsec from the client area, and disabled services are closed at the edge.
4. Use protocol-aware filtering
Generic rate limits hurt real users and still let clever floods through. Validating traffic against the protocol your service actually speaks (Source Engine, RakNet, WireGuard and so on) drops spoofed and malformed packets cleanly. See game server DDoS protection.
5. Enable SYN flood protection
Use SYN cookies or a SYN proxy so half-open connections can't exhaust your connection table, and discard out-of-state packets.
6. Rate limit per source, not globally
Limit new connections per IP, but never limit established sessions, and allow normal bursts such as a popular server restart when everyone rejoins at once.
7. Patch, harden and remove amplifiers
Disable open DNS resolvers, public NTP monlist, exposed memcached and other services that can be abused for amplification. Keep software updated and change default credentials so your own machines don't end up in a botnet.
8. Monitor traffic and set up alerts
You can't respond to what you can't see. Keep live traffic graphs and get alerted at the start and end of attacks, for example with a Discord webhook.
9. Build for headroom
Use caching and CDNs for static content, and keep spare capacity so a surge of ordinary load doesn't look like an outage.
10. Write an incident plan
Decide in advance who does what, which services to temporarily disable and when to switch on tighter limits such as Under-Attack Mode. Calm, rehearsed responses beat panic changes at 3 a.m.
Is a firewall enough? No. A server firewall only sees traffic after it has already used your bandwidth and CPU. Floods must be stopped in the network, then filtered at the edge. Learn more about DDoS mitigation.
If you're under attack right now
- Turn on under-attack mode or tighten limits on the affected IP
- Close any ports and services you don't strictly need
- Check whether your provider has null-routed you; if so, you need a host with inline mitigation
- Don't just change IP address; attackers will follow the hostname
- Contact your provider. Glitch Servers customers can open a ticket
FAQ
Can you completely prevent a DDoS attack?
You can't stop someone launching one, but you can make it harmless. Network-level mitigation and edge filtering remove the attack traffic before it affects your service.
How do I stop a DDoS attack that is happening now?
Enable under-attack mode, tighten limits, close unused ports and move to a provider with inline mitigation if you have been null-routed.
Is a firewall enough to stop DDoS attacks?
No. Large floods saturate your connection before a host firewall can act, so they must be stopped upstream.
Keep reading
Stop attacks before they reach your server.
Add Glitch Guard to a Glitch Servers VPS, dedicated server or game server and manage every rule from the client area.