Rust server operators experience DDoS attacks at a disproportionate rate compared to other game communities. Competitive PvP creates grievances, and grievances lead to "offline raids" of a different kind: attacking the server when a target player is online. Understanding why protection built for websites struggles with game traffic is the first step to selecting protection that actually works.
The UDP Problem
Rust communicates over UDP (unlike Minecraft's TCP). UDP is a connectionless protocol: there is no handshake, no authentication, no validation that traffic is from a legitimate source. A DDoS attacker can send millions of spoofed UDP packets per second that perfectly mimic the source IP of real players.
DDoS mitigation built for websites (HTTP proxies, basic volumetric filtering) understands HTTP and TCP well. UDP game traffic from legitimate clients and UDP flood traffic look almost identical at the network layer.
Gaming-Specific Mitigation
Protection that works for a Rust server has to do three things:
- Tell game packets from flood packets. Game traffic and floods look alike at the network layer, so filtering has to look beyond packet counts.
- Add as little latency as possible. Extra delay in the filtering path is felt by players as desync.
- Absorb volumetric floods upstream. The attack has to be stopped before it reaches the server's network interface.
At Space-Node, DDoS protection is included on every plan in every region, at no extra cost. The level depends on the hardware line. Premium servers in the Netherlands, Germany, Poland and Canada, and every server in our USA locations (California and Virginia), sit behind Cloudflare Magic Transit, which filters attack traffic on Cloudflare's network before it reaches the server. Our Rust plans in Europe and Canada currently run on the Standard tier with our standard DDoS protection, and the same standard protection applies in Singapore, India and Australia. The plan selector on the Rust hosting page shows the hardware and protection for the region you pick.
Client-Side: IP Privacy for Server Owners
The server IP is public knowledge for any game to connect. However, ensuring your personal IP is never exposed prevents targeted attacks:
- Always connect to your server admin tools through VPN
- Use the server's hostname (DNS name) in your admin tools, not the raw IP
- Never stream your server admin panel on Twitch/YouTube while live
What to Do During an Active Attack
- Document: Screenshot your server panel's connection stats and note when the problem started. This is your evidence for a support ticket.
- Contact your host: At Space-Node, open live chat or a ticket (the team is online 12/7, every day from 08:00 to 20:00 UTC) with your server name, the start time and your screenshots. There is no extra mitigation to buy or switch on: the protection included with your plan is already active, and support can look into the attack with you from there.
- Check for RCON exposure: Make sure RCON is not exposed on a publicly known port, because an attacker may be targeting RCON specifically.