What is DDoS protection? What to check when buying a server

By Datafex Engineering TeamPublished 14 September 2026Updated 30 September 20265 min read

Almost every hosting site says "DDoS protected". On its own the phrase tells you nothing, because attacks come in two very different families and protection against one does nothing against the other.

What a DDoS attack does

DoS (Denial of Service) means making a service unreachable. The "distributed" in DDoS says the attack arrives from thousands of different sources — which is why blocking a single IP address is never the answer.

Attacks work in two ways:

Volumetric: filling the pipe. Your server runs perfectly well, but the bandwidth reaching it is exhausted. Measured in Gbps or Mpps.
Resource exhausting: keeping the server busy without filling the pipe. Half-open TCP connections, unfinished HTTP requests, forged game queries.

The difference between L3/L4 and L7 protection

This distinction sits at the centre of the buying decision.

L3/L4 protection works at the network and transport layers. It looks at the packet header: is the source address forged, should this protocol arrive on this port, how many new connections per second are coming from this source? It does not look at content. This is the correct layer for volumetric attacks and SYN/UDP floods.

L7 protection works at the application layer. It looks at the HTTP request itself: is this a real browser, is this request pattern a bot, how many times per second is this URL requested? It is only meaningful for HTTP/HTTPS.

	L3/L4	L7
Inspects	Packet header	Request content
Stops	SYN/UDP floods, amplification, forged sources	HTTP floods, bots, scraping
Game server	This is what you need	Unusable (game traffic is not HTTP)
Website	Required	Useful in addition
Typical provider	Network operator / data centre	A CDN such as Cloudflare

The practical consequence: Cloudflare is not a solution for a game server. Cloudflare fronts HTTP traffic; it does not front FiveM's 30120 UDP traffic. What a game server needs is L3/L4 filtering at the network layer.

Why UDP is a specific problem on game servers

In TCP, a connection is established with a three-way handshake, so there is a way to verify the source address. UDP has no such step: a packet is sent, and its source address can easily be forged.

That has two consequences:

An attacker can name you as the source. They send queries to other servers using your address so the replies come back to you (amplification), filling your pipe with traffic you never generated.
You cannot block the attacker. Because the incoming address is forged, blocking IPs is pointless; the address you block is probably an innocent third party.

This is why filtering for UDP-based game servers cannot be solved at the application layer. Closing a port with iptables or blocking IPs with an in-game plugin does not help, because the traffic has already reached your pipe.

What "unlimited DDoS protection" does and does not mean

The phrase usually means: "we will not shut your service down during an attack and we will not charge extra." That is a real commitment and it is valuable — some providers null-route a server under attack in order to protect their other customers.

Read the SLA text alongside it: at most providers, downtime during an attack in progress is excluded from the availability calculation. So "unlimited protection" does not mean the minutes lost during an attack count towards the uptime commitment. What makes an SLA real: what do uptime and SLA mean?

It does not mean "we can stop an attack of any size." No provider absorbs an attack larger than the data centre's total transit capacity. So the right question is not "is it unlimited?" but:

"What is your total filtering capacity in Gbps, and what happens if an attack exceeds it?"

An honest answer contains a number and says what happens at the limit.

Five questions to ask a provider

Is the protection L3/L4, L7, or both? L3/L4 is mandatory for a game server.
What is the filtering capacity in Gbps? If they will not give a number, there is no measurable commitment.
Is the server null-routed under attack? This is the real test of "unlimited protection".
Can I write rules? Being able to define profiles for your own ports and protocols is clearly more effective than a generic filter.
Is legitimate traffic affected? An aggressive filter can stop the attack and lock your players out with it.

How this works at Datafex

Protection at Datafex is layered, and the answer to the "L3/L4 or L7?" question above is both. Volumetric L3/L4 floods are removed where traffic comes in: traffic from Turkish ISPs is scrubbed at distributed nodes inside Türkiye and international traffic at filters abroad; what remains passes the filters on our DPDK + VPP router. Fexwall comes last, working between L4 and L7: forged source addresses and connection-level attacks are handled there, and so are application-layer request floods. All of it is included free on every virtual server and dedicated server plan; the DDoS protected VDS page explains how the layers work together. Legitimate game traffic (30120 UDP, for example) passes through. You can define rules for your own ports from the customer panel, and if your attack profile needs custom filtering, you can request a project-specific security profile.

Transit capacity is 100 Gbps domestic and 10 Tbps international.

If you are thinking about putting your own hardware in the data centre, the filtering and transit side stays the same and only the cost structure changes: renting or a cabinet, which works out cheaper shows the monthly amounts alongside cabinet size and uplink options.