The Best DDoS Protection for Your Server: Which Combination Really Protects

In short: You get the best possible DDoS protection with a Professional VDS or a Professional Dedicated Server in our data center in Frankfurt am Main, combined with our Advanced DDoS Protection. Attack traffic is filtered in real time directly in our network with specialized profiles and a mitigation capacity of up to 17 Tbps. This combination is designed to make a successful DDoS attack practically impossible.

If you absolutely need unlimited traffic or a location outside Germany and still want strong DDoS protection, an Unlimited Traffic server or an Edge server together with our Remote DDoS Protection is the best choice. This guide explains why and what you need to watch out for during setup.

The three levels of DDoS protection at a glance

Every server at KernelHost includes basic protection with 3.2 Tbps. It stops common floods such as UDP, TCP, SYN and ICMP floods as well as reflection and amplification attacks. It has no specialized profiles for individual games or services. Against targeted attacks that disguise themselves as real game traffic, you therefore need one of the two upgrades:

Why Professional servers with Advanced DDoS Protection protect best

DDoS protection is only as strong as its weakest point. With the combination of a Professional server and Advanced DDoS Protection, four things work together.

Filtering directly in our network

Your server sits in our own network in Frankfurt am Main and gets its own protected IP address. Traffic is filtered directly in our network and delivered to your server. This adds no extra delay for your players and users.

Specialized profiles instead of blanket rules

Advanced DDoS Protection has optimized protection profiles for more than 40 games and services, including Minecraft, FiveM, Rust, Counter-Strike 2, ARK, DayZ and TeamSpeak. A profile knows what the real traffic of a game looks like and drops packets that only pretend to be it. You choose the profile, port and protocol yourself in the client area, for an unlimited number of ports. You can protect custom and modded games on any TCP or UDP port, as well as websites, SSH, RDP and VPN services such as OpenVPN and WireGuard.

Up to 17 Tbps mitigation capacity, always on

The protection is always active, not only after an attack has been detected. Large attacks are absorbed by the global scrubbing network close to their source, with a mitigation capacity of up to 17 Tbps on layers 3, 4 and 7. Your IP address is not null-routed: only the malicious packets are dropped, and your users still get through. Our article on null routing explains why this matters so much.

Hardware with headroom

The Professional VDS runs on AMD EPYC cores with DDR4 ECC memory, NVMe SSDs in RAID and a 2x 1 Gbit/s connection, starting at €59.99 per month. The Professional Dedicated Server is your own bare metal server in Frankfurt with an AMD Ryzen or Intel processor, starting at €169.99 per month. This keeps your project stable under load, and the Frankfurt location provides low latency across Europe.

Together, this combination is designed to make a successful DDoS attack practically impossible. It is our recommendation for every project that is targeted by attackers or where every outage costs players, customers and revenue.

Unlimited traffic or another location: Remote DDoS Protection

Advanced DDoS Protection works for servers in our network in Frankfurt. If you absolutely need unlimited traffic or a server at another location, combine one of these servers with Remote DDoS Protection:

• Unlimited Traffic VPS starting at €14.99 per month, with traffic without a volume limit and locations in Europe, North America, Asia and Australia.
• Edge servers with unlimited traffic, a connection of up to 1 Gbit/s and up to 25 locations worldwide.

Remote DDoS Protection works as an upstream filter. You get your own protected IP address from our anycast filtering network. Traffic on the ports you protect arrives at the nearest filtering location, is cleaned there and forwarded to your server. The filter mitigates attacks in less than a second. The real IP address of your server stays hidden. With PROXY protocol v1 or v2, your server still sees the real IP addresses of your players. Billing is per protected port, and attack traffic is never charged.

Because traffic passes through a filtering location, an extra leg is added to the route. Choose a server location close to a filtering location, for example Frankfurt, Amsterdam, London, Paris, Warsaw, Helsinki, Istanbul, Dubai, Johannesburg, Singapore, Hong Kong, Sydney, Chicago or Washington DC. The full list of filtering locations is on the Remote DDoS Protection page.

How to set up Remote DDoS Protection correctly

An upstream filter only protects the traffic that actually passes through it. To keep attackers from bypassing it, three rules apply:

1. Publish only the protected IP address. Use only the protected IP in DNS records, server lists, on Discord and on your website. The real IP address of your server must stay secret.
2. Lock down the server firewall. On the protected ports, allow only the addresses of our filtering locations. You will find the list and a script that keeps it up to date automatically in the client area, in the setup section of your protection service.
3. Change the server IP at least once after setup. The previous IP address of your server is usually already known, for example from server lists, DNS records or earlier attacks. An attacker can use it to bypass the filter. After setup, switch at least once to a new server IP and enter it in the client area. The easiest way is to order the protection together with a new server.

For VPN servers: Advanced DDoS Protection

Remote DDoS Protection is meant for games and applications on fixed ports. For VPN servers that need the best possible DDoS protection, we recommend Advanced DDoS Protection: it is designed for this and also protects OpenVPN and WireGuard. Learn more in our guide Protecting VPN servers against DDoS attacks.

Which solution fits your project?

• Game servers facing targeted attacks with players in Europe: Professional VDS or Professional Dedicated Server with Advanced DDoS Protection.
• VPN servers with high requirements: Advanced DDoS Protection on a server in Frankfurt.
• Projects with a lot of traffic: Unlimited Traffic VPS with Remote DDoS Protection for the ports that are attacked.
• Players in Asia, North America, Africa or Australia: an Edge server close to a filtering location with Remote DDoS Protection.
• Servers at another provider: The strongest protection is a move to our network with Advanced DDoS Protection. If moving is not an option, Remote DDoS Protection protects the server where it is.
• Small projects without targeted attacks: The included basic protection with 3.2 Tbps is often enough. You can upgrade at any time.

What else you should do

• Do not expose management access such as SSH, RDP, databases, RCON and panels to the whole internet. Restrict it to your own IP addresses instead.
• Set a per-source rate limit on the server for query and login ports.
• Keep the operating system and game server up to date so that application layer attacks find no weak spots.
• During an attack, save the measurements and send us a ticket with the time, target IP and port. Our article How to recognize a DDoS attack on your server explains how to spot an attack.

How a DDoS attack works technically and why filtering on the server alone is not enough is explained in our basics article What is a DDoS attack?

Summary

You get the strongest DDoS protection with a Professional VDS or Professional Dedicated Server in Frankfurt and Advanced DDoS Protection: filtering directly in our network, specialized profiles, up to 17 Tbps of mitigation capacity and no additional latency. If you need unlimited traffic or another location, combine an Unlimited Traffic or Edge server with Remote DDoS Protection and follow the three rules: publish only the protected IP, lock down the firewall and change the server IP at least once after setup.