DDoS attacks and null-routing

What this is#

What happens when a DDoS attack is aimed at your VPS, and what your options are.

How attacks are handled#

• Smaller attacks: our network has some mitigation capacity built in, so modest attacks are often absorbed without you noticing.
• Large attacks: to protect the other customers sharing the network, we null-route the target IP. Traffic to that IP is dropped at the edge until the attack subsides. Your VPS itself keeps running, but it's unreachable on the null-routed IP for the duration.
• Null-routes are reviewed every 6 hours. If the attack has stopped, the null-route is lifted; if it's still going, the null-route stays in place and is checked again at the next review.

If you expect to be attacked regularly#

Being attacked doesn't make you a rule-breaker, but a VPS on its own isn't the right tool for absorbing regular DDoS. If you expect to be a frequent target:

• Put the site behind a mitigation service. For websites, Cloudflare works well (the free tier is often enough): it hides your VPS's IP and soaks the attack before it reaches us. Set it up properly, including firewalling your web ports so only Cloudflare can reach them, with Cloudflare best practices.
• Keep your origin IP secret. Mitigation only helps while attackers don't know the IP behind it. If the IP has already leaked, see the IP-change policy below.

IP change requests#

A request we get during attacks: "just give me a new IP." We don't change IPs on the strength of a suspected attack alone, and the reason is practical, not bureaucratic: without protection in front, a new IP buys you minutes. The attacker re-resolves your domain (or re-scans), finds the new address, and the attack resumes, now with one more burned IP in the story. An IP change only helps as the last step of the sequence, not the first:

1. Put mitigation in place first. Cloudflare for websites (set up properly, origin locked to their ranges), or the game-server options in the next section for non-web services.
2. Then, if the old IP is already exposed and attacks are still hitting it directly, open a ticket and request the change. A fresh IP issued behind active protection stays unknown, which is what makes the change worth doing exactly once.

Requested in that order, an IP change is the finishing move that makes mitigation complete. Requested on its own, it's a treadmill, which is why step 1 comes first.

If the target isn't a website (game servers and other ports)#

Cloudflare's normal proxy only handles web traffic (HTTP and HTTPS). A Minecraft server, a voice server, or anything else on its own TCP or UDP port gets no protection from an orange-clouded DNS record, so this class of service needs a different tool. The self-serve options, roughly in order of how easy they are:

• Minecraft: a game proxy service. TCPShield is the standard for Java Edition: a genuinely free tier for small and medium servers, premium plans from $30/month (Bedrock needs premium). NeoProtect is the same model, with a free tier and paid plans from around €15/month, including Bedrock/Geyser support. Both work like Cloudflare does for websites: players connect to the proxy's address, and the proxy forwards clean traffic to your VPS.
• Minecraft or SSH, if you're already on Cloudflare: Spectrum. Cloudflare's Pro plan ($25/month) includes Spectrum proxying for Minecraft and SSH with 5 GB of Spectrum traffic per month included (Business adds RDP and 10 GB), billed per GB beyond that. TCP only, and the per-GB meter makes it a poor fit for high-traffic servers, but it's the shortest path if the domain is already there.
• Anything else, including UDP: a protected tunnel. Services like X4B and Evolution Host's EvoShield sell remote protection with public pricing: you get a protected IP at their edge, and traffic reaches your VPS through a GRE or similar tunnel, any port, any protocol. This is the answer for UDP games (FiveM, Source engine, and similar) that the proxies above don't cover. Setup is real command-line work on the VPS (a tunnel interface plus routing), but both document it and it's well within one person's reach. Pick the provider location nearest your VPS, since the tunnel adds a network hop.
• What's not a customer option: BGP-based mitigation. Providers in that class (Path.net, Cosmic Guard, Voxility) protect whole IP ranges announced over BGP, which requires owning IP space and an ASN. They mostly sell to hosting companies with pricing on request, so if a guide's setup steps start with "announce your /24", it's written for a different audience.

Whichever you pick, the same rule as Cloudflare applies: the protection only works if your VPS's own firewall accepts game traffic only from the protection service (or only over its tunnel). A protected front door with the origin still answering to the whole internet mitigates nothing.

Troubleshooting#

• My VPS is unreachable and I think it's being attacked. Check the service status page first, then open a ticket. If the IP was null-routed, we can tell you and confirm when it was last reviewed.
• How long will the null-route last? Until the attack stops. Reviews happen every 6 hours, so the typical wait after an attack ends is at most a few hours.

Still need help?#

You can open a support ticket. So we can help on the first reply, it's worth mentioning:

• the VPS hostname or IP,
• when the trouble started,
• whether you've had attacks against this service before.

Related questions#

• "Do you have DDoS protection?"
• "My VPS is under a DDoS attack, what happens now?"
• "Why is my IP null-routed and how long does it last?"
• "My VPS is unreachable during an attack."
• "What should I do if my site gets attacked often?"
• "How do I protect a game server from DDoS? Cloudflare doesn't cover it."
• "What DDoS protection works for Minecraft?"
• "How do I protect a UDP service like FiveM from attacks?"
• "My VPS is under attack, can I just get a new IP?"
• "When will you change my IP because of DDoS?"