What is DDoS protection? What to check when buying a server

Almost every hosting site says "DDoS protected". On its own the phrase tells you nothing, because attacks come in two very different families and protection against one does nothing against the other.

What a DDoS attack does

DoS (Denial of Service) means making a service unreachable. The "distributed" in DDoS says the attack arrives from thousands of different sources — which is why blocking a single IP address is never the answer.

Attacks work in two ways:

Volumetric: filling the pipe. Your server runs perfectly well, but the bandwidth reaching it is exhausted. Measured in Gbps or Mpps.
Resource exhausting: keeping the server busy without filling the pipe. Half-open TCP connections, unfinished HTTP requests, forged game queries.

The difference between L3/L4 and L7 protection

This distinction sits at the centre of the buying decision.

L3/L4 protection works at the network and transport layers. It looks at the packet header: is the source address forged, should this protocol arrive on this port, how many new connections per second are coming from this source? It does not look at content. This is the correct layer for volumetric attacks and SYN/UDP floods.

L7 protection works at the application layer. It looks at the HTTP request itself: is this a real browser, is this request pattern a bot, how many times per second is this URL requested? It is only meaningful for HTTP/HTTPS.

	L3/L4	L7
Inspects	Packet header	Request content
Stops	SYN/UDP floods, amplification, forged sources	HTTP floods, bots, scraping
Game server	This is what you need	Unusable (game traffic is not HTTP)
Website	Required	Useful in addition
Typical provider	Network operator / data centre	A CDN such as Cloudflare

The practical consequence: Cloudflare is not a solution for a game server. Cloudflare fronts HTTP traffic; it does not front FiveM's 30120 UDP traffic. What a game server needs is L3/L4 filtering at the network layer.

Why UDP is a specific problem on game servers

In TCP, a connection is established with a three-way handshake, so there is a way to verify the source address. UDP has no such step: a packet is sent, and its source address can easily be forged.

That has two consequences:

An attacker can name you as the source. They send queries to other servers using your address so the replies come back to you (amplification), filling your pipe with traffic you never generated.
You cannot block the attacker. Because the incoming address is forged, blocking IPs is pointless; the address you block is probably an innocent third party.

This is why filtering for UDP-based game servers cannot be solved at the application layer. Closing a port with iptables or blocking IPs with an in-game plugin does not help, because the traffic has already reached your pipe.

What "unlimited DDoS protection" does and does not mean

The phrase usually means: "we will not shut your service down during an attack and we will not charge extra." That is a real commitment and it is valuable — some providers null-route a server under attack in order to protect their other customers.

It does not mean "we can stop an attack of any size." No provider absorbs an attack larger than the data centre's total transit capacity. So the right question is not "is it unlimited?" but:

"What is your total filtering capacity in Gbps, and what happens if an attack exceeds it?"

An honest answer contains a number and says what happens at the limit.

Five questions to ask a provider

Is the protection L3/L4, L7, or both? L3/L4 is mandatory for a game server.
What is the filtering capacity in Gbps? If they will not give a number, there is no measurable commitment.
Is the server null-routed under attack? This is the real test of "unlimited protection".
Can I write rules? Being able to define profiles for your own ports and protocols is clearly more effective than a generic filter.
Is legitimate traffic affected? An aggressive filter can stop the attack and lock your players out with it.

How this works at Datafex

Fexwall performs DPDK-based L3/L4 filtering and is included free on every plan. Forged source addresses are filtered automatically while legitimate game traffic (30120 UDP, for example) passes through. You can define rules for your own ports from the customer panel, and if your attack profile needs custom filtering, you can request a project-specific security profile.

Transit capacity is 100 Gbps domestic and 10 Tbps international.