17 Tbps Always-on DDoS Protection

DDoS (Distributed Denial of Service) protection is a security system that detects and filters malicious traffic before it reaches your server. It analyses incoming data packets in real time and blocks attack traffic while allowing legitimate users to connect normally. Without DDoS protection, a targeted attack can overwhelm your server's network connection and take it offline.

KernelHost uses Arbor DDoS permanent protection, which is always active, not just triggered when an attack is detected. All traffic passes through the Arbor scrubbing infrastructure 24/7, where attack patterns across Layer 3 to Layer 7 are identified and filtered within milliseconds. This ensures zero reaction delay and no disruption to normal server operation.

No. KernelHost does not null-route IP addresses during DDoS attacks. Null-routing means blocking all traffic to your IP, which effectively takes your server offline. Instead, our Arbor permanent protection filters out attack traffic while keeping your server online and accessible throughout the attack.

Arbor DDoS filtering adds no latency to your traffic. The filtering is performed at hardware level directly within the network infrastructure, with no measurable impact on ping times. Ideal for gaming applications where every millisecond counts.

Yes. The Arbor DDoS protection at KernelHost filters all attack patterns from Layer 3 through Layer 7 in real time. Layer 7 (application-layer) attacks such as HTTP floods, DNS query floods, and SIP invite floods are identified and blocked within milliseconds without disrupting legitimate traffic.

Yes. KernelHost's Arbor permanent protection includes dedicated gameserver mitigation logic for UDP-based game protocols used by Minecraft, FiveM, CS:GO, Ark, Rust, Valheim and others. Attack packets are filtered while legitimate player traffic passes through unaffected. Voice servers such as TeamSpeak are fully covered as well.

Because KernelHost operates a permanent (always-on) protection, there is no detection delay. All traffic is continuously routed through the Arbor scrubbing infrastructure 24/7. Attack packets are identified and removed within milliseconds, with zero downtime for your server.

Yes. With Advanced DDoS Protection you manage your protection rules yourself in the client area: you choose protection profiles for your game or application per port and protocol, and changes apply in real time. This lets you adapt the mitigation to your project without a ticket, while attack traffic is absorbed in the 17 Tbps scrubbing network before it ever reaches your server.

Your protected IP address is assigned automatically right after ordering. Once your server is connected, you pick a protection profile for your game or application in the client area, with optimized profiles for 40+ games such as Minecraft, FiveM, Rust or Counter-Strike. Rule changes apply in real time.

In practice, KernelHost's 17 Tbps DDoS protection has filtered, among others, a complex multi-vector attack of over 473.4 Gbps and over 41.5 million packets per second against a TeamSpeak server (port 9987 UDP), and a UDP flood of over 112.2 Gbps against an ARK gameserver, each in real time with zero downtime and no packet loss. All-port attacks across every port (0 to 65535) are reliably mitigated as well.

The 17 Tbps always-on DDoS protection is included at no extra charge with every KernelHost server, from KVM VPS starting at 4.99 euro per month through gameservers to dedicated servers. There is no separate protection package and no hidden fees. For particularly heavily attacked projects, Advanced DDoS Protection is additionally available with a dedicated protected IP and self-managed rules from 50 euro per month, PrePaid and with no minimum term.

Yes. The DDoS protection is specifically optimized for gameservers and includes ready-made mitigation profiles for 40+ games and protocols, including Minecraft (Java port 25565, Bedrock 19132), FiveM, alt:V, RageMP, Rust, ARK, CS2 and Valheim, as well as voice servers such as TeamSpeak and Mumble. Game-specific attacks such as Nullping or fake-handshake floods are filtered in real time without affecting legitimate player traffic.