Protecting a Conan Exiles server from DDoS attacks

A Conan Exiles server that becomes unreachable exactly when the raid window opens rarely has a hardware problem. In the vast majority of cases an attack is running, and it runs precisely when it does the most damage. This article shows why a Conan Exiles server needs DDoS protection, what you can secure yourself in the next ten minutes at no extra cost, where those measures technically end, and what has to happen in the network in front of the server after that.

Everything here refers to the Funcom dedicated server, meaning ConanSandboxServer.exe or StartServer.bat. The configuration lives in three files in the directory ConanSandbox\Saved\Config\WindowsServer\: ServerSettings.ini, Engine.ini and Game.ini. That is also true if you run the server on Linux through a compatibility layer, because Funcom ships the Windows application only, which is why the path is called WindowsServer even there.

If the attack is running right now: capture the measurements first (section 9), because once the attack is over they are gone. And do not edit any INI file at this moment. Conan Exiles keeps its configuration in memory and writes it back when it shuts down, so any change made while the server is running is lost.

Why a Conan Exiles server needs DDoS protection

In most games a server outage is annoying. In Conan Exiles, on a PvP server, it is a move in the game. Losses are permanent, a base can only be damaged inside a defined time window, and whoever takes the defenders out of the game during that window is raiding against nobody. The attack therefore has a concrete payoff and a time that is known in advance, and it repeats as soon as it has worked once.

That time window is no secret. It sits in ServerSettings.ini under RestrictPVPTime for player combat and under RestrictPVPBuildingDamageTime for building damage, and every operator voluntarily writes it into the server name, the rule set and the Discord, because otherwise the players would not know it. So an attacker does not have to scout anything: he reads the raid time where it is advertised and schedules his attack for the same hour.

The effort on the other side is minimal. So-called booter or stresser services sell a flood against a given IP address and a given port by the minute. A port DDoS against 7777 UDP requires neither access to the game nor any knowledge about your server, the address and the port number are enough. That is exactly why it hits small servers just as reliably as large ones.

On top of that comes a trait that sets Conan Exiles apart from most survival games. ServerSettings.ini has a switch called LogoutCharactersRemainInTheWorld. With it set to True, the character stays standing in the world after a disconnect instead of vanishing. An attack that throws every player out at the same time then leaves behind a row of motionless characters together with their gear. For the details of what happens technically during such an attack, read What is a DDoS attack?.

Technically, all game traffic runs over UDP. UDP has no connection setup you could insist on, and source addresses can be spoofed. So an attacker does not have to join your server, or even address it correctly, in order to create load. He does not even need to know whether anybody is online.

The ports that actually matter

A Conan Exiles server needs exactly three UDP ports facing the outside: 7777, 7778 and 27015. Everything else is optional or has no business on the open internet at all. Funcom documents the layout like this:

Three things about this go wrong regularly. First, 7778 is not a freely chosen port, it is always the game port plus one. If you run two instances on the same machine you therefore have to step in twos: 7777 and 7778 for the first, 7779 and 7780 for the second, plus 27015 and 27016 as query ports. Putting the second instance on 7778 takes the pinger away from the first.

Second, the TCP rule on 7777 is the mod transfer. Funcom opens it only when a client requests it, and only clients from the Epic Games Store request it. Steam clients still fetch mods through the Steam Workshop interface. If all of your players come through Steam, you do not need that rule.

Third, RCON is off by default. RconEnabled ships as 0. Anyone who finds that port open either switched it on themselves or adopted a ready-made template from a provider.

What you can do yourself before spending money

The following nine steps cost nothing and work against what actually happens most often: small targeted floods from a few sources, abused query ports, login floods on RCON, and overload caused by a single mod. They are worth doing even when a network filter is already working in front of you.

1. Take stock: what is listening at all?

Before you write a single rule, check what your server actually offers to the outside. Do not guess, look. On Windows:

Get-NetUDPEndpoint | Where-Object LocalPort -in 7777,7778,27015
Get-NetTCPConnection -State Listen | Sort-Object LocalPort
netstat -ano -p UDP | findstr "7777 7778 27015"

If the server runs on Linux inside a compatibility layer, the equivalent is:

ss -lnup
ss -lntp

The interesting column is the local address. 0.0.0.0:7777 means "reachable from the entire internet", 127.0.0.1:25575 means "local only" and needs no firewall rule. A port scan from outside gives you the attacker's view, and it has to cover UDP explicitly, because a pure TCP scan finds almost nothing on a Conan Exiles server:

nmap -Pn -sU -p 7777,7778,27015 YOUR.SERVER.IP.ADDRESS
nmap -Pn -p 7777,25575 YOUR.SERVER.IP.ADDRESS

2. Open only the three UDP ports

On Windows, two rules in the built-in firewall are enough. The first opens normal play, the second restricts RCON to your own address instead of opening the port for everybody:

New-NetFirewallRule -DisplayName "Conan Exiles" -Direction Inbound -Protocol UDP -LocalPort 7777,7778,27015 -Action Allow
New-NetFirewallRule -DisplayName "Conan RCON" -Direction Inbound -Protocol TCP -LocalPort 25575 -RemoteAddress 203.0.113.10 -Action Allow
Get-NetFirewallRule -DisplayName "Conan*" | Format-Table DisplayName,Enabled,Direction,Action

On Linux the same thing with UFW looks like this, and in exactly this order so that you do not lock yourself out:

ufw allow 22/tcp comment 'SSH'
ufw allow 7777/udp comment 'Conan Exiles'
ufw allow 7778/udp comment 'Conan Exiles Pinger'
ufw allow 27015/udp comment 'Conan Exiles Query'
ufw allow from 203.0.113.10 to any port 25575 proto tcp comment 'RCON'
ufw default deny incoming
ufw --force enable
ufw status verbose

Replace 203.0.113.10 with your own address. The full guide including the escape route is in Setting up the UFW firewall without locking yourself out. Leave the TCP rule on 7777 out as long as none of your players comes through the Epic Games Store.

3. Secure RCON or switch it off entirely

RCON is a remote control with full access to your server: kick players, ban them, send messages, run commands. It sits on TCP 25575 and is configured in Game.ini:

[RconPlugin]
RconEnabled=0
RconPort=25575
RconPassword=
RconMaxKarma=60

If you do not need RCON, leave RconEnabled=0 in place. That is the default and the safest setting. If you do need it, three rules apply. First, RconPassword has to be long and random, because the RCON protocol sends the password over the wire unencrypted. Second, the port does not belong on the open internet, it belongs restricted to your own address or behind an SSH login. Third, RconMaxKarma is the built-in protection against login floods and its default value is 60. The counter limits how many requests one source may fire in quick succession before it is turned away.

An open RCON port is also a reliable hint that you are there at all. Anyone scanning broadly for 25575 finds game servers, and a game server with no filtering in front of it is a worthwhile target.

4. Rate limit the query port instead of closing it

Port 27015 UDP answers status queries in the Steam format. An A2S query is a short UDP request with which a client retrieves the server name, the map, the player count and the uptime without starting the game. That is exactly what the server list, your status page and every Discord bot showing the player count depend on.

Do not close that port. Your server would disappear from the server list and new players would no longer find it. The correct handling is an upper limit per source address. On Linux:

iptables -I INPUT -p udp --dport 27015 -m hashlimit --hashlimit-name conan_query --hashlimit-mode srcip --hashlimit-above 10/sec --hashlimit-burst 20 -j DROP
iptables -L INPUT -n -v | head -20

Ten queries per second per source are enough for real players and for any monitoring, but they drop a source that sends thousands of requests per second. Persist the rule with apt-get install -y iptables-persistent and netfilter-persistent save, otherwise it is gone after the next reboot. Under UFW it belongs in /etc/ufw/before.rules.

There is a hard limit here, though, and it affects the majority of Conan Exiles operators: the Windows firewall has no rate limiting per source address. It can open a port, close it or restrict it to fixed addresses, but it cannot say "at most ten packets per second per sender". On a Windows server there is simply no built-in tool for that job, and the limiting has to happen in the network in front of the server.

The second point concerns abuse in the other direction. Reflection means: the attacker sends queries with a forged source address to thousands of game servers, and every answer lands on a third party. Because an A2S response is larger than the request, the traffic multiplies along the way. Your server is then not the victim but the weapon, and you pay for the outbound traffic. Valve introduced a challenge mechanism for this: the server may answer an A2S query with a counter question first, which a sender using a forged address cannot answer. That only works where it is actually switched on, which is why a rate limit on 27015 belongs in the picture in every case.

5. Server password, admin password and slots

ServerSettings.ini holds three settings that directly decide how large your attack surface is:

[ServerSettings]
AdminPassword=
ServerPassword=
MaxPlayers=40
IsBattlEyeEnabled=True

AdminPassword is the single most critical value in the whole file. It is not a console login, it is the password with which a regularly connected player grants themselves admin rights inside the game. A short or guessable admin password does not mean lag, it means losing the server. Set it long and random, and rotate it as soon as a team member leaves.

ServerPassword turns a public server into a private one. It works against trolls, against throwaway accounts and against anybody who uses the regular join path. It does not work against an attack on your uplink: whoever floods your server does not want to join at all. His packets get rejected, but they have arrived all the same, and that is exactly the point.

MaxPlayers caps the slot count and can additionally be set through the launch parameter -MaxPlayers=. A realistic ceiling is a protective measure too: every connected client produces packets continuously, and a server with more slots than the machine can carry breaks down under normal operation already.

6. What BattlEye does, and what it does not

Conan Exiles ships an anti-cheat check through IsBattlEyeEnabled in ServerSettings.ini. It should be on, but it is not DDoS protection, and for a structural reason: anti-cheat inspects clients that are already connected. It runs in the same process as the game and only gets to see a packet once the server is processing it anyway. If that process is saturated, the checking logic goes down with it.

The same applies to every server-side tool you install on top. Anything running on the server can only drop something that is already there. Anti-cheat protects the rules of the game, not availability.

7. Keep the mod list clean

A significant share of reported outages on modded Conan Exiles servers is not an attack at all. The mod list sits as modlist.txt in the same configuration directory, and every mod runs in the same process as the game. A single mod with a loop, a tick interval that is too tight or an unbounded database query brings the server to a halt just like an attack does, only without any conspicuous packet rates.

Telling the two apart is easy and should always come first. If the packet rate on the network card climbs sharply while the machine is barely working, it is an attack. If the packet rate stays normal and everything stutters anyway, it is the software. When in doubt, remove half of the mod list and restart, which narrows the cause down in two passes.

A second, very practical point: after a game update, mods and server version often no longer match. Players get dropped on join, the Discord says "server down", and everybody looks for an attack that never happened. Check the mod list first after every update.

8. The address and the raid window

Your IP address cannot be kept secret. It is in the server list entry, because otherwise nobody could join, and every player who has connected once knows it. Changing the address buys time but is not a solution: the attacker reads the new address from the same source as the old one, usually within minutes or hours.

Two habits help nevertheless. Never publish the raw IP address yourself, so neither in the Discord nor on the project website, and connect your players through a hostname so that changing the address does not break every reference. The classic pitfall is a forgotten A record pointing at the old address, which makes any change pointless.

With the raid window the opposite of hiding applies: you need it public, otherwise your server does not work. Use it for diagnosis instead. If your server goes down at 6:05 pm on three evenings in a row and your raid window opens at 6:00 pm, that is no longer a guess, it is a pattern you can attach to a ticket.

9. Measure instead of guessing

The most important step is the one almost nobody takes beforehand: build a baseline while everything is still normal. Without a normal value you cannot say after an incident whether 40,000 packets per second was a lot or simply a busy Friday evening. On Windows the built-in tools are enough:

Get-NetAdapterStatistics
typeperf "\Network Interface(*)\Packets Received/sec" -sc 20
typeperf "\Network Interface(*)\Bytes Received/sec" -sc 20

On Linux the equivalent is:

sar -n DEV 1 10
ip -s link show eth0
tcpdump -ni eth0 udp port 7777 or udp port 27015 -c 200 -q

One rule for tcpdump: always cap it with -c, because a capture under full load puts extra strain on a server that is already overloaded. The Conan Exiles server log lives in ConanSandbox\Saved\Logs\ and is additionally written to a window with the launch parameter -log. The savegame is a single file at ConanSandbox\Saved\game.db: copy it before you change anything under pressure. How to read the numbers is covered in Detecting a DDoS attack.

Where these measures stop: bandwidth and packet rate

Now the part that no INI file can solve. Everything so far runs on your server, which means at the far end of the uplink. A firewall rule decides about a packet that has already traveled down the wire. You can drop it, but you cannot un-send it.

Do the math once. A typical game server sits on 1 Gbps, which is 125 megabytes per second, and the uplink is full as soon as somebody sends more. Attacks against survival servers usually range between 5 and 50 Gbps, so five to fifty times your uplink. Whether your rule behind it is any good no longer matters, because the packets of your players stop getting through before that.

The second figure is the packet rate, and it almost always hits earlier than the bandwidth does. With small packets of 64 bytes, around 1.49 million packets per second fit into an uplink of 1 Gbps. Depending on CPU and network card, a normal server handles a few hundred thousand of them before it starts dropping. So an attack that does not even fill a third of your uplink can still take your Conan Exiles server down, because the processing time goes into the dropping. Operators experience this as "the utilization was not even high, and yet everything was gone".

With Conan Exiles there is an aggravating factor: the entire game world runs in a single process. There is no second instance that keeps going while the first one is busy. As soon as that process stops getting processing time, combat, building and saving stall at the same moment.

For a sense of the magnitudes that really occur: on KernelHost servers we have filtered, among others, an attack of over 473.4 Gbps at over 41.5 million packets per second against a voice server, and a UDP flood of over 112.2 Gbps against a game server. There is no local setting for that. Volumetric attacks have to end in the network in front of the server.

What KernelHost puts up against it

The always-on protection included with every server

DDoS protection at KernelHost is built in two layers and permanently active, with nothing for you to switch on, order or configure:

• Layer 1: 17 Tbps of mitigation capacity in the global scrubbing network. Volumetric attacks are scrubbed close to their source, before they reach the datacenter.
• Layer 2: Arbor real-time filtering with 3.2 Tbps in Frankfurt am Main. Directly in front of the server, protocol-specific patterns are detected and dropped, packet by packet.

Two properties make the difference. The protection runs permanently and does not have to react to an attack first, so there are no opening minutes in which the server is gone. That is exactly what matters for a raid window that only lasts a few hours anyway. And no null-routing is used: your IP address stays on the network, only the malicious packets are dropped. Whoever takes the IP address off the network achieves the same result for you as the attacker does. Which games and protocols are covered is listed in Game server DDoS protection with real-time filtering.

Advanced DDoS Protection for servers under constant fire

Some servers are attacked not occasionally, but deliberately and for weeks on end, as a rule always at the same hour. For those there is Advanced DDoS Protection from €50.00 per month, PrePaid, with no minimum term and no setup fee. The difference is not more capacity, it is control:

• A dedicated protected IP from the Frankfurt core, which your server is switched over to inside our own network. Nothing has to be rebuilt on your side.
• Self-managed protection rules per port and protocol in the customer panel: you define separately what is allowed on 7777 UDP, on 7778 UDP and on 27015 UDP. That separation is exactly what the server itself cannot give you, especially on Windows.
• Changes take effect in real time, so you can fine-tune while an attack is still running instead of waiting until the next morning.
• A protection profile matched to the game, and profiles for modified and custom applications on any TCP or UDP port.

The two tiers compared

For most Conan Exiles servers the included always-on protection together with a clean configuration is enough. Advanced DDoS Protection is the answer to somebody taking it personally. If your server currently runs somewhere else and keeps getting taken off the network there, the most reliable fix is a move: the filtering belongs in the network the server sits in.

Common mistakes and how to fix them

"My changes in ServerSettings.ini are gone again after a restart": the server was still running while you edited. Conan Exiles keeps the configuration in memory and writes it back to the file on shutdown, which overwrites your change. Stop the server, wait, edit, start. Also edit the files under Saved\Config\WindowsServer\ and not the templates next to them, otherwise the next game update overwrites everything.

"I changed the ports and now the server is no longer in the list": the query port was not moved along. The game port and the query port are two separate values, and the pinger at game port plus one has to be free and allowed as well. Check [URL] Port and PeerPort in Engine.ini against ServerQueryPort and against your firewall rules.

"I changed the IP address and was offline again two hours later": the attacker got the new address from the same source as the old one, usually the server list entry, a Discord bot with a status display or an old DNS record. Changing the address buys time, it is not a solution.

"The RCON log shows hundreds of failed logins": that is a login flood on 25575 TCP and it hits the game logic, not the uplink. RconMaxKarma slows it down, but it really ends when you restrict the port to your own address or switch RCON off with RconEnabled=0.

"There are lag spikes every few minutes, but the server is never fully offline": that is the typical picture of a pulsing flood. Bursts lasting a few seconds are enough to make packets get dropped, yet they stay below any threshold that would trigger an alarm. Measure per second rather than in five-minute averages, otherwise your evaluation shows nothing but an unremarkable average while your players get thrown out of combat every few minutes.

"Every player is stuttering, but the network counters look unremarkable": that is not a DDoS attack. If Get-NetAdapterStatistics or sar -n DEV 1 10 stay in the normal range, the cause is in the software. Check the mod list first, then the server version against the mod versions.

"My previous provider blocked my IP address": that is null-routing. The provider protects its own network with it, and for you the result is identical to a successful attack, usually for hours afterwards. If in doubt, ask whether traffic is filtered or null-routed. The answer says more about your availability than any hardware spec.

"I do not see anything unusual in the capture": if the traffic is already filtered in the network upstream, nothing arrives on the server, exactly as expected. That is the normal case when the filtering works. The other way round applies as well: once the uplink is saturated, even the remote session you wanted to measure with may no longer reach you. Use the VNC console in the customer panel then, which works independently of the network of the guest system.

In short

• A Conan Exiles server needs exactly three UDP ports facing the outside: 7777 for game traffic, 7778 for the pinger and 27015 for the status query. TCP 7777 only for mod transfer to Epic clients, TCP 25575 only with RCON enabled.
• The pinger is fixed at game port plus one. Several instances on one machine are therefore assigned in steps of two.
• RCON ships disabled with RconEnabled=0 and should stay that way until you need it. The password travels over the wire unencrypted.
• Port 27015 gets rate limited, not closed: closed, the server disappears from the server list; unlimited, it is target and reflector at the same time.
• The Windows firewall can open ports, close them and restrict them to addresses, but it cannot limit a rate per source address. That job belongs in the network in front of the server.
• On 1 Gbps the uplink is full at 125 megabytes per second, which with packets of 64 bytes corresponds to around 1.49 million packets per second. Above that, no local rule helps any more.
• At KernelHost, 17 Tbps of mitigation capacity in the global scrubbing network and Arbor real-time filtering with 3.2 Tbps in Frankfurt am Main filter permanently, at no surcharge and without null-routing.

If your server already runs at KernelHost, the filtering is active without you having to do anything. If you still notice something unusual, open a support ticket with the date, the time and your measurements, so that we can fine-tune the filter rules for your IP address. During an ongoing attack you can also reach us through the WhatsApp emergency chat at +43 650 8209883.