DDoS Protection: 3.2 Tbps Included, up to 17 Tbps for Game Servers
DDoS protection in three tiers: included, Advanced and Remote
Our always-on DDoS protection filters attacks in real time, in three tiers. Included is 3.2 Tbps of basic protection against common floods, automated, permanently active and at no extra cost; in our own network in Frankfurt this is handled by on-premise Arbor filtering. For heavily attacked projects in our Frankfurt network, Advanced DDoS Protection additionally routes traffic through a global scrubbing network with 17 Tbps mitigation capacity that absorbs volumetric attacks close to their source. For Edge VPS, unlimited bandwidth VPS and servers at other providers, there is Remote DDoS Protection with a protected anycast IP and up to 17 Tbps of mitigation capacity, with no migration. Your infrastructure stays online even during an attack.
17 Tbpswith Advanced or Remote, 3.2 Tbps always included
24/7always-on protection, zero reaction delay
40+profiles for games and services with Advanced DDoS Protection
0 €extra cost: included with all servers
Real-time filtering
Attacks are detected and filtered within a few milliseconds. No null-routing, your server stays continuously reachable.
Automatic detection
Continuous protection runs permanently in the background, no configuration required. Common attack patterns are detected automatically and filtered 24/7.
Basic protection against common floods
The included protection automatically filters UDP, SYN and ICMP floods as well as amplification attacks. Layer 7 and your own filter rules are covered by Advanced DDoS Protection.
DDoS protection for game servers
The included protection also shields game servers against common floods. For targeted attacks on Minecraft, FiveM, CS2 or Rust, Advanced DDoS Protection adds dedicated game profiles.
Included free of charge
Enabled on every KernelHost server package at no extra cost. No separate protection tiers, no hidden fees, simply included.
Emergency support
Under attack at your current provider? Contact us for a fast migration, we'll pull you out of the fire.
Arbor always-on DDoS protection
The second protection layer right in front of your server: Arbor DDoS protection detects common floods automatically and filters them out, even when several attack patterns hit at once.
The protection is developed and adapted daily to detect new attack patterns. It runs continuously and automatically for all root servers, game servers and web servers in our own network in Frankfurt am Main.
Advanced DDoS Protection for servers in our Frankfurt network
Advanced DDoS protection with 17 Tbps technology for heavily attacked game servers and demanding projects: a dedicated protected IP from our Frankfurt core, with self-managed protection and firewall rules in the client area.
Order
Order Advanced DDoS Protection and instantly receive your dedicated protected IP address from our low-latency Frankfurt core.
Connect
We switch your server to the dedicated protected IP directly inside our own network. No changes needed on your side, protection is active immediately.
Protected
Pick a protection profile in the client area, rules apply in real time. Attacks are absorbed in the global scrubbing network close to their source.
- Layer 3, 4 and 7: any game and any application on any TCP or UDP port
- Your own protection rules, self-managed in the client area
- Also protects TeamSpeak, Mumble, OpenVPN, WireGuard, websites, SSH and RDP
- Custom and modded games fully supported
Optimized protection profiles for 40+ games, services and protocols
Games
Minecraft Java EditionMinecraft Bedrock EditionFiveMRedMRustCounter-Strike 2Counter-Strike 1.6Counter-Strike: SourceARK: Survival EvolvedArma 3PalworldDayZGarry's ModTeam Fortress 2Half-Life 2: DeathmatchLeft 4 Dead 2Sven Co-opCall of DutyRageMPalt:VSA-MPopen.mpMulti Theft AutoUnturnedProject ZomboidTerrariaMordhauConan ExilesLineage 2Hytale
Services & protocols
HTTPHTTPSSSL/TLSTCPUDPICMPSSHRDPOpenVPNWireGuardTeamSpeakMumblecPanelWordPressStratum Mining Custom TCP applications
Custom UDP applications
and many more on request
Order Advanced DDoS Protection
from €50.00 per month, prepaid with no minimum term
Remote DDoS Protection for servers at any hosting provider
Your server stays where it is. Remote DDoS Protection places a protected anycast IP in front of your server at any hosting provider and filters attacks with up to 17 Tbps of mitigation capacity, with no migration and no tunnel.
Choose ports
When ordering, you enter your server's static public IPv4 address, choose which ports and protocols to protect and pick a filter profile, for example Minecraft or FiveM.
Get a protected IP
You receive your own protected IP address. Then change your server's IP address at least once (on our Edge VPS and unlimited bandwidth VPS: with a new server in the same plan) and enter the new one in the client area, so its real address stays hidden. The setup guide there gives you the firewall commands to accept traffic only from our filter nodes.
Connect your users
Your players and users connect to the protected IP. With the PROXY protocol (v1 or v2) enabled for the port and on your server itself, you still see their real IP addresses.
- Anycast filtering network with up to 17 Tbps, mitigation in under one second
- Always-on Layer 4 protection for TCP and UDP, no null-routing of your protected IP
- Billed per protected port, add more ports at any time with an upgrade
- Clean traffic included (fair use), attack traffic is never billed
Filtering locations of the anycast network:
- Europe: Frankfurt, Amsterdam, London, Paris, Warsaw, Munich, Marseille, Manchester, Helsinki
- North America: Ashburn, Los Angeles, Chicago, Dallas, Miami, Toronto
- Asia: Hong Kong, Singapore, Osaka, Jakarta
- Oceania: Sydney
- Africa: Johannesburg, Cairo
- Turkey and the Middle East: Istanbul, Dubai, Riyadh
- Traffic from other regions is automatically routed to the nearest filtering location
Optimized filter profiles for:
- Minecraft (Java and Bedrock)
- Counter-Strike 2, CS:GO and 1.6
- FiveM (GTA V)
- Rust
- Garry's Mod
- San Andreas Multiplayer (SA-MP)
- TeamSpeak 3
- Battlefield 2
- Games built with Unity (UNet and UTP)
- Any other TCP or UDP application with the generic profiles
Order Remote DDoS Protection
from €25.99 per month for one protected port, prepaid with no minimum term
DDoS protection compared: included, Advanced or Remote
| Included | Advanced DDoS Protection | Remote DDoS Protection | |
|---|---|---|---|
| Mitigation capacity | 3.2 Tbps | Up to 17 Tbps | Up to 17 Tbps |
| For servers | At KernelHost | In our Frankfurt network | At any provider |
| Filtering | Basic protection against common floods | Profiles for 40+ games and services, custom rules | Profiles for Minecraft, CS2, FiveM, Rust, SA-MP, TeamSpeak and more |
| IP address | Your server's own IP | Dedicated protected IP | Your own protected anycast IP |
| Setup | Active automatically | Switch-over within our network | Ports in the client area, PROXY protocol |
| Price | Included | From €50.00 per month | From €25.99 per month |
Emergency: is your project currently under a DDoS attack?
Reach us via ticket or WhatsApp emergency chat at +43 650 8209883. We'll help immediately.
For special cases and heavily attacked projects: our Advanced DDoS Protection with 17 Tbps technology and self-managed protection rules in the client area is ready within minutes.
Server hosted with another provider? The lightweight alternative: Remote DDoS Protection shields it without migration, billed per port.
DDoS Protection: Frequently Asked Questions
What is DDoS protection?
DDoS (Distributed Denial of Service) protection is a security system that detects and filters malicious traffic before it reaches your server. It analyses incoming data packets in real time and blocks attack traffic while allowing legitimate users to connect normally. Without DDoS protection, a targeted attack can overwhelm your server's network connection and take it offline.
How does permanent DDoS protection work?
KernelHost's DDoS protection is always active, not just triggered when an attack is detected. In our own network in Frankfurt am Main, all traffic passes through the Arbor scrubbing infrastructure 24/7, where common floods are identified and filtered within milliseconds. This ensures zero reaction delay and no disruption to normal server operation.
Is null-routing used during a DDoS attack?
No. KernelHost does not null-route IP addresses during DDoS attacks. Null-routing means blocking all traffic to your IP, which effectively takes your server offline. Instead, attack traffic is filtered out while your server stays online and accessible throughout the attack; in our own network in Frankfurt am Main, this is done by Arbor permanent protection.
Does the DDoS filter add latency?
No. In our own network in Frankfurt am Main, Arbor DDoS filtering adds no latency to your traffic. The filtering is performed at hardware level directly within the network infrastructure, with no measurable impact on ping times. Ideal for gaming applications where every millisecond counts.
Does KernelHost protect against Layer 7 attacks?
Yes, with Advanced DDoS Protection. Layer 7 (application-layer) attacks such as HTTP floods, DNS query floods and SIP invite floods target the application logic rather than network capacity. The included 3.2 Tbps protection is basic protection against common network floods. Against Layer 7 attacks, Advanced DDoS Protection for servers in our Frankfurt network filters on Layer 3, 4 and 7, with protection profiles for your game or application per port and protocol and your own rules in the client area.
Is there special DDoS protection for game servers?
Yes, with Advanced DDoS Protection. The included protection filters common floods for game servers too. Dedicated game server mitigation for game protocols such as Minecraft, FiveM, CS2, ARK, Rust and Palworld comes with Advanced DDoS Protection for servers in our Frankfurt network: attack packets are filtered while legitimate player traffic passes through unaffected, and voice servers such as TeamSpeak are covered as well. For game servers on Edge VPS, unlimited bandwidth VPS or at other providers, Remote DDoS Protection offers filter profiles for Minecraft, FiveM, Rust, TeamSpeak and more.
How quickly are DDoS attacks detected and filtered?
Because KernelHost operates a permanent (always-on) protection, there is no detection delay. In our own network in Frankfurt am Main, all traffic is continuously routed through the Arbor scrubbing infrastructure 24/7. Attack packets are identified and removed within milliseconds, with zero downtime for your server.
Can I manage my protection and firewall rules myself?
Yes. With Advanced DDoS Protection you manage your protection rules yourself in the client area: you choose protection profiles for your game or application per port and protocol, and changes apply in real time. This lets you adapt the mitigation to your project without a ticket, while attack traffic is absorbed in the 17 Tbps scrubbing network before it ever reaches your server.
How quickly is Advanced DDoS Protection ready to use?
Your protected IP address is assigned automatically right after ordering. Once your server is connected, you pick a protection profile for your game or application in the client area, with optimized profiles for 40+ games and services, including Minecraft, FiveM, Rust and Counter-Strike. Rule changes apply in real time.
What DDoS attack sizes has KernelHost already mitigated?
In practice, KernelHost DDoS protection has filtered, among others, a complex multi-vector attack of over 473.4 Gbps and over 41.5 million packets per second against a TeamSpeak server (port 9987 UDP), and a UDP flood of over 112.2 Gbps against an ARK gameserver, each in real time with zero downtime and no packet loss. All-port attacks across every port (0 to 65535) are reliably mitigated as well.
How much does DDoS-protected hosting cost at KernelHost?
Always-on DDoS protection with 3.2 Tbps is included at no extra charge, from KVM VPS through game servers and web hosting to dedicated servers. There is no separate protection package and no hidden fees. For heavily attacked projects in our Frankfurt network, Advanced DDoS Protection adds a dedicated protected IP, global scrubbing of up to 17 Tbps and self-managed rules from €50.00 per month. For Edge VPS, unlimited bandwidth VPS and servers at other providers, Remote DDoS Protection starts at €25.99 per month. Both are prepaid with no minimum term.
Does KernelHost offer DDoS protection specifically for Minecraft and FiveM?
Yes, with Advanced DDoS Protection for servers in our Frankfurt network. It includes ready-made mitigation profiles for 40+ games and protocols, including Minecraft (Java port 25565, Bedrock 19132), FiveM, alt:V, RageMP, Rust, ARK, CS2 and DayZ, as well as voice servers such as TeamSpeak and Mumble. Game-specific attacks such as Nullping or fake-handshake floods are filtered in real time without affecting legitimate player traffic. Against common floods, every Minecraft and FiveM server at KernelHost is already covered by the included protection. For Edge VPS, unlimited bandwidth VPS and servers at other providers, Remote DDoS Protection offers filter profiles for Minecraft and FiveM.
Can I protect my game server at another hosting provider from DDoS attacks?
Yes. If you can move your server to us, we recommend Advanced DDoS Protection in our Frankfurt network: our most comprehensive protection, with custom filter rules and low ping across Europe. If moving is not an option, Remote DDoS Protection shields your server where it is: you get a protected anycast IP in front of it, with no migration and no tunnel, and attacks are filtered with up to 17 Tbps of mitigation capacity. With the PROXY protocol enabled, your server still sees your players' real IP addresses. Your server needs a static public IPv4 address. After setting up Remote DDoS Protection, change your server's IP address at least once and enter the new one in the client area, so attackers cannot keep hitting the old address.
Where does Remote DDoS Protection filter attacks?
In 25 cities on five continents, including Frankfurt, Amsterdam, London, Paris, Warsaw, Ashburn, Los Angeles, Toronto, Hong Kong, Singapore, Sydney, Johannesburg, Istanbul and Dubai. Traffic from other regions is automatically routed to the nearest filtering location.
How much does Remote DDoS Protection cost?
From €25.99 per month for one protected port. You can add more ports at any time with an upgrade. The service is prepaid with no minimum term, and attack traffic is never billed.
Further guides on DDoS protection
