Game server protection

Coritan protects a game server in one of two ways, depending on how players reach it:

• A join address puts Coritan's edge between the players and the server. Players connect to the edge at a name such as survival-smp.coritan.gg, and the edge checks each connection before it forwards it. Players never see the server's own address.
• DDoS Shield filters all the traffic sent to a floating IP. It protects a server that players reach at its address, whatever the game.

A server can have both. Players who use the join address then reach it through the edge, and players who type its floating IP reach it through DDoS Shield.

A Minecraft or TCP game server that has a floating IP gets DDoS Shield as well, for the players who join at the address.

Players connect to the edge, and the edge opens its own connection to your server (How join addresses work). On the way, the edge:

• limits how many connections each address may have open at once, and blocks for a while an address that opens too many in a short time;
• for Minecraft Java, turns away each address's first join while the edge is under a flood of connections, and lets the next one through, so a flood of single connections does not reach your server;
• closes a Minecraft Java connection that does not start with a valid Minecraft handshake;
• for Minecraft, answers players' server lists from a copy of your server's status that it keeps for a few seconds, so a flood of server list requests stops at the edge.

What players see lists the messages players get when the edge turns them away. A TCP service closes the connection with no message, because a plain TCP connection has no way to show one.

The edge does not sign players in or check their accounts. Your server still does that, as it would without the edge.

A Minecraft Bedrock join address carries only NetherNet, which Bedrock uses from version 26.50, so older Bedrock clients cannot join through it (Editions and ports).

A join address protects a server only from attackers who do not know the server's own address. An attack sent straight to that address does not pass through the edge.

• Give players the join address only. Take the server's own address out of server lists, websites and DNS records.
• For a server you host elsewhere, allow only the Edge addresses through its firewall on the game's port (Set up your server). If attackers already know the server's address, move the server to a new address before you give out the join address.
• For a server hosted here, attach a floating IP, so that DDoS Shield filters the traffic sent to the server's address as well. Traffic sent to the shared address of the server's machine still does not pass through DDoS Shield (How the Coritan network works).

DDoS Shield filters every packet sent to a floating IP at Coritan's points of presence, for any game and any port (How DDoS Shield works). There is nothing to turn on: a floating IP is protected from the moment we assign it.

• The address that comes with a Cloud Compute instance is a floating IP, so DDoS Shield already filters it.
• A Container Apps server needs a floating IP attached (Attach and detach a floating IP). Its ports and join addresses move to the floating IP, and a Minecraft server can also answer on the game's default port (Publish a port on the default game port).

For a game server, DDoS Shield:

• drops traffic that games do not send, such as IP fragments, protocols other than TCP, UDP and ICMP, and UDP answers from the ports that reflection attacks use. A game server that listens on one of those ports, such as 27015, still receives its players (Reflection ports);
• limits how fast each sender, and all senders together, may send to the address (Rate limits);
• applies the rules you add on the address's Shield tab (Add a rule);
• records what it drops as attack events on the Events tab of DDoS Shield (Read attack events).

Rules that often help a game server:

• A Rate limit rule for UDP on the game's port limits what each player's address may send, such as 2000 packets per second to port 19132.
• When no rule matches set to Drop, with an Allow rule for each port the game uses, stops traffic to every other port before it reaches the server. Add Allow rules for the UDP replies the machine expects too (When no rule matches).

DDoS Shield reads packet headers only. It cannot tell a real player from a program that speaks the game's protocol, and it does not hide the server's address.

An external server gives a Minecraft Java or Bedrock server that you run elsewhere a join address, as a plan you pay for (How external servers work). A Bedrock server must accept NetherNet connections. To order one, select New proxy… on the Edge Proxy page, choose the edition and then A server elsewhere, which opens the order page (Order an external server).

You cannot set up protection yourself for any other game that runs elsewhere. A TCP service join address forwards only to a server hosted here, and DDoS Shield filters only Coritan's floating IPs. Move the game to a Cloud Compute instance, or ask the sales team (Reach sales and the other teams).

The public Game Protection page describes game server protection for buyers. Some of what it says differs from what you can set up:

• It describes a protection profile for each game. There are no profiles for particular games: every join address gets the checks above, and DDoS Shield applies the same checks to every address, with the rules you add.
• It lists Minecraft Bedrock as RakNet. A join address carries Bedrock over NetherNet only.
• Most of the titles it lists, such as Rust, Counter-Strike 2 and Valheim, connect over UDP. A join address cannot carry them, so they rely on DDoS Shield on a floating IP.
• It says we check each connection so that only real game clients get in. The edge checks connections as How a join address protects a server describes, but it does not sign players in.
• It says monitoring alerts you to attacks. We send no alerts. Attack events on your floating IPs appear on the Events tab.
• It says a server can go live as play.you.coritan.gg. A join address is one name under coritan.gg, such as survival-smp.coritan.gg. For a name such as play.alex.coritan.gg, claim a free coritan.gg name and link play under it to the join address (Use your own domain for a join address).

Connect your own server on the page opens the order page for an external server. Request Custom Protection and Partner With Us open the contact page, whose form sends nothing, so email sales@coritan.com instead.

• How join addresses work
• How external servers work
• How DDoS Shield works
• Change a floating IP's DDoS protection
• TCP proxy protection