Multiplayer game servers are targeted by distributed denial of service (DDoS) attacks more frequently than almost any other internet service. The overwhelming majority of attacks against game daemons leverage UDP: attackers flood servers with spoofed payloads or exploit third-party services for volumetric reflection amplification.
Even a modest UDP flood of 10–20 Mbps can completely stall a single-threaded game engine tick loop if the host kernel attempts to deserialize and pass every malformed packet into the application socket. This guide details Linux kernel-level filtering using nftables and iptables to drop malicious traffic before it degrades tick rates.
Attack architecture: why UDP is vulnerable to flooding#
The UDP protocol does not require an initial handshake, allowing adversaries to forge arbitrary source IP addresses (IP spoofing). Consequently, the Linux kernel consumes valuable CPU cycles inside ksoftirqd software interrupts, receiving incoming packets and pushing them toward the application socket.
When the socket receive buffer saturates, legitimate player synchronization packets are dropped. In-game, this causes severe latency spikes, rubber-banding, and widespread client disconnects (Connection timed out).
To inspect current socket backlog queues on your host, execute ss:
ss -u -a -n -p
If the Recv-Q column displays non-zero values persistently, the game process is failing to drain incoming datagrams from the kernel buffer quickly enough.
Baseline packet filtering with nftables#
The modern packet classification framework in Linux is nftables. It provides superior throughput compared to legacy iptables by compiling filtering rules into optimized bytecode with fewer kernel context switches.
Construct a baseline ruleset table protecting your game port (using port 27015 as a representative baseline):
cat << 'EOF' | sudo tee /etc/nftables.conf
table inet filter {
chain input {
type filter hook input priority filter; policy accept;
# Allow established connections
ct state established,related accept
# Drop invalid connection states
ct state invalid drop
# Drop fragmented UDP packets
ip frag-off & 0x1fff != 0 drop
# Allow loopback traffic
iif "lo" accept
# Rate limit game traffic per IP
udp dport 27015 meter flood { ip saddr limit rate over 60/second burst 120 packets } drop
}
}
EOF
Load and activate the ruleset:
sudo nft -f /etc/nftables.conf
sudo nft list ruleset
The ip frag-off rule discards fragmented UDP packets commonly used in firewall evasion attacks, while the meter flood directive limits individual IP rates while allowing legitimate client handshake bursts up to 120 packets.
Mitigating SYN floods on RCON and administrative TCP ports#
If your game instance exposes TCP ports for remote administration (RCON) or metrics endpoints, attackers may attempt to overwhelm kernel connection queues via TCP SYN floods.
Enable SYN cookie validation directly within the kernel networking stack:
sudo sysctl -w net.ipv4.tcp_syncookies=1
sudo sysctl -w net.ipv4.tcp_max_syn_backlog=4096
Persist these parameters across system restarts:
cat << 'EOF' | sudo tee /etc/sysctl.d/99-game-security.conf
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 4096
net.core.somaxconn = 4096
EOF
sudo sysctl --system
Expanding Linux kernel socket receive buffers#
By default, Linux allocates modest memory buffers for UDP sockets. During transient traffic surges, the kernel drops legitimate datagrams before they reach the game application loop.
Expand both the default and maximum socket receive allocations:
sudo sysctl -w net.core.rmem_max=16777216
sudo sysctl -w net.core.rmem_default=2097152
Audit kernel-level packet drop counters:
netstat -s -u | grep -E "(buffer errors|packet receive errors)"
When drop counters stabilize, your networking stack can process bursty player loads without packet starvation.
For high-profile community clusters, local firewall rules on a single VPS cannot prevent uplink bandwidth saturation from multi-gigabit volumetric attacks. In these production environments, teams rely on an integrated server management platform that pairs upstream DDoS scrubbers with resilient host configurations.
