Remote DDoS Protection: Shield Your Server at Any Host
Keep your server with your current provider and put a protected anycast IP in front of it: attacks are filtered with up to 17 Tbps, using profiles for Minecraft, FiveM and other games. From €25.99 per month for one protected port.
17 Tbpsmitigation capacity of the anycast network
Under 1 stime to mitigate an attack
25filtering locations worldwide
From €25.99per month for one protected port
Game server DDoS protection without moving your server
Game servers, voice servers and other online applications are frequent targets of DDoS attacks, whether they run at a hosting provider, in the cloud or at home. Moving to a new host is not always an option, for example when your setup has grown over the years or other services depend on it. Remote DDoS Protection is an external DDoS protection service that shields your server right where it is.
Instead of a migration, you put a protected anycast IP in front of your server. The filtering network is designed to absorb attacks, and clean traffic is forwarded to your server, wherever it is hosted. For an overview of all protection levels, see our DDoS protection page. If you can move your server to us in Frankfurt, Advanced DDoS Protection in our own network gives you our most comprehensive protection.
How Remote DDoS Protection works in three steps
Choose ports and profiles
When ordering, enter the static public IPv4 address of your server. You can add the ports you want to protect right away or later in the client area, each with its protocol (TCP or UDP) and a filter profile such as Minecraft or Rust. Changes go live within a few minutes.
Get your protected IP
You receive your own protected IP address, which you give to your players instead of the real one. The setup guide in the client area shows you the firewall commands to accept traffic on the protected ports only from our filter nodes.
Connect your players
Your players and users connect to the protected IP, and clean traffic is forwarded to your server. If you enable the PROXY protocol for the port and in your server software, your server still sees their real IP addresses (version 1 for TCP only, version 2 for TCP and UDP).
Important: change your server's IP at least once After setting up Remote DDoS Protection, change the real IP address of your server at least once and enter the new address as the server IP in the client area. Do not publish the new IP anywhere and give your players only the protected IP. Otherwise attackers who know the old address can keep hitting your server directly, bypassing the protection. You get the new IP from your hosting provider, or from your internet provider if the server runs at home. On our Edge VPS and Unlimited Traffic VPS, the IP cannot be swapped: there, you get the new IP with a new server in the same plan.
Anycast DDoS protection: what you get
Up to 17 Tbps anycast filtering network
The network is designed to absorb attacks at the filtering location closest to their source and to filter out attack traffic before it reaches your server.
Always-on Layer 4 protection for TCP and UDP
The protection is active around the clock and is designed to mitigate attacks in under one second, without null-routing your protected IP during an attack. It covers TCP and UDP on Layer 4; web filtering on Layer 7 is not part of this product.
Your own protected IP address
Your players and users connect only to the protected IP. After the IP change, the new real IP address of your server stays hidden as long as you do not publish it anywhere.
PROXY protocol v1 and v2
With the PROXY protocol, your server can still see the real IP addresses of your players. Version 1 works for TCP only, version 2 for TCP and UDP.
Billing by port tier
The tier price covers all protected ports together. Each port counts for one protocol, so TCP and UDP on the same port number are two ports, and a port range counts every port in it. You can add more ports at any time with an upgrade; reducing the number of ports is not possible.
Clean traffic included
Clean traffic is included under fair use, and attack traffic is never billed. You only pay for your port tier, so an attack does not drive up your costs.
Filtering locations: 25 cities on five continents
Your players' traffic enters the anycast network at the filtering location closest to them, is filtered there and then continues to your server, no matter where it runs. If your players and your server are close to one of these cities, the detour is small.
- Europe: Frankfurt, Amsterdam, London, Paris, Warsaw, Munich, Marseille, Manchester, Helsinki
- North America: Ashburn, Los Angeles, Chicago, Dallas, Miami, Toronto
- Asia: Hong Kong, Singapore, Osaka, Jakarta
- Oceania: Sydney
- Africa: Johannesburg, Cairo
- Turkey and the Middle East: Istanbul, Dubai, Riyadh
- Traffic from other regions is automatically routed to the nearest filtering location
DDoS protection for game servers: filter profiles for Minecraft, FiveM, Rust and more
You choose a filter profile for every protected port. Optimized profiles are available for the games and services below, and the generic profiles protect any other TCP or UDP application. All profiles work on Layer 4 and do not filter web traffic.
- Minecraft (Java and Bedrock)
- Counter-Strike 2, CS:GO and 1.6
- FiveM (GTA V)
- Rust
- Garry's Mod
- San Andreas Multiplayer (SA-MP)
- TeamSpeak 3
- Battlefield 2
- Games built with Unity (UNet and UTP)
- Any other TCP or UDP application with the generic profiles
Who Remote DDoS Protection is right for
- Minecraft network operators (Java and Bedrock)
- FiveM communities around GTA V that cannot or do not want to move their server
- Rust server owners and admins
- Counter-Strike 2 clans and teams with their own server
- Guilds, clans and teams with their own TeamSpeak 3 server
- Studios and developers making games with Unity (UNet or UTP)
- Developers of custom TCP and UDP services, protected by the generic profiles
- Operators of servers at large cloud providers or at home with a static public IPv4 address
DDoS protection compared: included, Advanced or Remote
| Included | Advanced DDoS Protection | Remote DDoS Protection | |
|---|---|---|---|
| Mitigation capacity | 3.2 Tbps | Up to 17 Tbps | Up to 17 Tbps |
| For servers | At KernelHost | In our Frankfurt network | At any provider |
| Filtering | Basic protection against common floods | Profiles for 40+ games and services, custom rules | Profiles for Minecraft, CS2, FiveM, Rust, SA-MP, TeamSpeak and more |
| IP address | Your server's own IP | Dedicated protected IP | Your own protected anycast IP |
| Setup | Active automatically | Switch-over within our network | Ports in the client area, PROXY protocol |
| Price | Included | From €50.00 per month | From €25.99 per month |
Frequently asked questions about Remote DDoS Protection
How does Remote DDoS Protection work?
Remote DDoS Protection is DDoS protection for servers at any provider. You get a protected anycast IP in front of your server, and your players connect to this IP. The anycast network with up to 17 Tbps of mitigation capacity is designed to filter out attacks on Layer 4 for TCP and UDP, and clean traffic is forwarded to your server. With the PROXY protocol, your server still sees the real IP addresses of your players. There is no migration and no tunnel to set up.
Do I have to move my server?
No. With Remote DDoS Protection, your server stays with your current provider, in the cloud or at home. All it needs is a static public IPv4 address, because with a changing IP address the forwarding stops working. After the setup, you must change your server's real IP address at least once, enter the new address in the client area and give your players only the protected IP. We also recommend allowing traffic on the protected ports only from our filter nodes; the setup guide in the client area shows you how. You need no tunnel and no other changes to your network.
Which games and applications are protected?
Remote DDoS Protection offers optimized filter profiles for Minecraft (Java and Bedrock), Counter-Strike 2, CS:GO and 1.6, FiveM (GTA V), Rust, Garry's Mod, San Andreas Multiplayer (SA-MP), TeamSpeak 3, Battlefield 2 and games built with Unity (UNet and UTP). Whether you need DDoS protection for Minecraft servers, FiveM DDoS protection for a GTA V community or protection for Rust servers, you choose the matching profile for each port. Any other TCP or UDP application is protected with the generic profiles. The protection works on Layer 4 and does not filter web traffic.
Do I still see my players' real IP addresses?
Yes. Remote DDoS Protection supports the PROXY protocol: enable it for the port in the client area and in your server software, and your server receives the real IP addresses of your players instead of the addresses of our filter nodes. Version 1 works for TCP only, version 2 for TCP and UDP.
Where are the filtering locations?
The anycast network of Remote DDoS Protection filters attacks in 25 cities. Europe: Frankfurt, Amsterdam, London, Paris, Warsaw, Munich, Marseille, Manchester and Helsinki. North America: Ashburn, Los Angeles, Chicago, Dallas, Miami and Toronto. Asia: Hong Kong, Singapore, Osaka and Jakarta. Oceania: Sydney. Africa: Johannesburg and Cairo. Turkey and the Middle East: Istanbul, Dubai and Riyadh. Traffic from other regions is automatically routed to the nearest filtering location.
Does the protection increase my latency?
That depends on where your players and your server are. With Remote DDoS Protection, traffic always runs from your players to the nearest filtering location and from there to your server. If both are close to a filtering location, for example in Europe or North America, the detour is small. In regions without a nearby filtering location, the ping can rise noticeably: traffic from South Korea, for example, runs through Osaka in Japan, and India, South America and Central Asia see similar detours. If your players or your server are in such a region, ask us for advice via ticket before you order.
What does one port cost and how do I add more ports?
Remote DDoS Protection starts at €25.99 per month for one protected port. You can choose tiers from 1 to 20 ports as well as 25, 30, 40 and 50 ports, and the tier price covers all ports together; TCP and UDP on the same port number count as two ports. You can add more ports at any time with an upgrade, but you cannot switch to fewer ports. Quarterly, semi-annual and annual terms cost three, six and twelve times the monthly price, all PrePaid with no minimum term.
Is attack traffic billed?
No. With Remote DDoS Protection, attack traffic is never billed, and clean traffic is included under fair use. You only pay the price of your port tier.
What is the difference between Remote and Advanced DDoS Protection?
Advanced DDoS Protection is for servers that run in our own network in Frankfurt, so your server has to be hosted at KernelHost. It comes with a dedicated protected IP, profiles for over 40 games and services and your own protection rules, and it is our most comprehensive protection. Remote DDoS Protection is for servers that stay where they are, at any provider: you get your own protected anycast IP, Layer 4 filter profiles and billing by port tier. If you can move your server to us, choose Advanced; if not, Remote protects it without a migration.
How quickly is the protection active?
If you enter your ports when ordering, Remote DDoS Protection is set up with these ports as soon as your service is provisioned, and your protected IP is ready. If you order without ports, it is created with your first port in the client area. In both cases, it is usually active within a few minutes. Then change your server's real IP address at least once, enter the new one in the client area and share only the protected IP.
Protect your server now with Remote DDoS Protection
Game server DDoS protection with your own protected anycast IP and up to 17 Tbps of mitigation capacity, from €25.99 per month for one protected port. PrePaid with no minimum term.
All KernelHost Products
