Included with every VPS and dedicated server
DDoS protection that records why every packet died.
Floods big enough to fill the link are absorbed upstream. Everything that reaches your machine is judged packet by packet by Clouduxe Prism, at the network driver. When a player cannot connect, you look up their address and read which check stopped them.
- 17 Tbps
- absorbed upstream
- XDP/eBPF
- at the network driver
- 3 · 4 · 7
- layers judged
- 99.99%
- uptime SLA
01
The split
Two layers. You control the second.
The network edge removes what would fill the link, before it reaches the machine. Clouduxe Prism, on the machine itself, decides what is left: which ports are reachable, how fast traffic may arrive, and whether it speaks the service's protocol.
Upstream
The network edge
Answers how big an attack you can take. You do not configure it, and what it removes is folded into the same drop counters you read on the Attacks tab.
Yours to tune
Clouduxe Prism, on the host
Port rules, packet-rate ceilings, protocol validation and per-address allow and deny lists, set from the Firewall tab of each server.
Layer 3
The address
Is this source allowed to talk to this server at all, and is the packet structurally sane?
Ends here: Blocked sources and malformed packets, at the lowest possible cost.
Layer 4
The transport
Is this a real TCP or UDP conversation, or a packet pretending to be one?
Ends here: Spoofed and stateless floods, and traffic above the ceilings on your port rules.
Layer 7
The protocol
Is this actually the protocol the port claims to serve?
Ends here: Floods that look like players on the wire but never speak the game.
Each layer runs only if the one before it did not already decide, so the expensive question is only ever asked of traffic that survived the cheap ones.
02
Attack by attack
Pick an attack. See where it ends.
Seven shapes of attack, the gate that stops each one, and the record it leaves behind. Detection thresholds are not published: what each vector is helps you, the number it trips at mainly helps someone trying to sit underneath it.
L4 · The transport
Forged source addresses, one packet each, aimed at the game port.
- Asks
- Is this a real conversation, or a packet pretending to be one?
- Ends
- Under load an unknown source has its first packet dropped. A real client retransmits and gets through. A forged source never answers, because the reply goes to an address that never sent anything.
- Players
- Nothing. Connected players keep the trust they earned before the flood started.
- source
- 203.0.113.7
- target
- udp/30120
- protection
- udp_challenge
- packets
- 18,430
03
The difference
Most protection stops at the edge. This one follows the packet home.
Scrubbing upstream is how you survive volume, and every Clouduxe server has it. What you cannot do from a scrubbing centre is read the game's protocol, hold a per-port ceiling, or tell one customer which check dropped one player.
| Capability | Clouduxe | Upstream-only scrubbing |
|---|---|---|
| Ask why one player was dropped | Address lookup names the check that did it, with exact counts | No record of a single address |
| Judge the game protocol | Validators for FiveM, Minecraft, Source, rAthena, TeamSpeak, DNS and RDP | Volume and known signatures |
| Where filtering happens | At the network driver of your own machine, before the kernel allocates a buffer | In a scrubbing centre, then relayed on to you |
| Ceilings you control | Per port, per source and per connection, from the Firewall tab | One profile for the whole address |
| Why a packet was dropped | A reason recorded per packet, grouped into incidents | A dropped total |
| Players already connected | Sources that proved themselves keep priority when pressure rises | Every packet is equally anonymous |
| A check that misfires on your traffic | Switch it off for that rule yourself | Open a ticket |
04
What you get back
An attack you can read afterwards.
Dropped packets are grouped into time-bounded incidents, each with its sources, the ports it targeted and what the attack was made of. The dropped figure is an exact count, and anything rebuilt from a sample is labelled an estimate.
2.4M pps
Peak received
2.3M pps
Peak dropped
94%
Removed upstream
6 min 40 s
Lasted
- Protocol validation61%
- Spoofed transport24%
- Per-source ceiling9%
- Blocked source6%
Check whether an address was filtered before it reached your server, and which protection acted. Counts are exact, not sampled.
4 packets filtered across 1 attack window
This address had completed a valid session, so some of these drops affected legitimate traffic. Worth reporting to support.
| Protection | Target | Packets |
|---|---|---|
| protocol | udp/30120 | 3 |
| per_source_rate | udp/30120 | 1 |
| Rule | Service | Validation | Per source | Conns |
|---|---|---|---|---|
| udp/30120 | FiveM | on | 300 pps | - |
| tcp/30120 | FiveM | on | - | 100 |
| udp/9987 | TeamSpeak | on | 200 pps | - |
| tcp/22 | SSH | off | - | 10 |
Address lookup
When a player cannot connect, look up their address and read exactly which check dropped it.
Rules for sources
Allow or deny a source address, independent of any port rule.
Alerts in Discord
Send attack alerts to a channel of your own with a webhook.
05
Detection
Attacks fail differently. There is a check for each.
Grouped by what the attacker is trying to run out of, because that is what decides which gate can see it.
- Volumetric floods
More than the link or the server can absorb. The largest are absorbed upstream; what arrives meets your port ceilings.
Amplification · Aggregate flood · Per-source flood · Out-of-band flood
- Spoofed and stateless traffic
Packets claiming an address that never sent them. A real client answers a challenge by connecting normally; a spoofed source cannot.
SYN flood · Spoofed UDP · Fingerprint mismatch
- Connection exhaustion
Aimed at the finite number of connections a server can track. This is what takes game servers down while bandwidth graphs look normal.
Connection flood · New connection rate · Distributed connection spread · Half-open and idle abuse
- Protocol abuse
Traffic that reaches the right port but is not the service speaking. Every packet is well formed, so a plain rate limit cannot see it.
Invalid protocol · Failed handshake ratio · Query flood · Malformed connect · Replayed connect · Command abuse
- Web and HTTP
For servers running an HTTP service alongside the game.
Request flood · Missing client identity · Off-path requests
- Behavioural and unknown
Detections that do not depend on recognising a specific attack, which is why a novel one does not have to be seen before it can be stopped.
Behavioural scoring · Timing regularity · Reputation · Zero-day pattern · Tier demotion
06
Your game
It knows your game.
A rate limit cannot tell a player from a booter, because both send packets. A protocol validator can, because only one of them speaks the protocol correctly.
- FiveM
- The Cfx.re game and listing traffic
- Minecraft
- Java edition, and Bedrock over RakNet
- Source
- CS2, CS:GO, TF2, Garry's Mod and the shared query protocol
- rAthena
- Ragnarok Online logins and zone traffic
- TeamSpeak
- Voice, server query and file transfer
- RDP
- Remote Desktop
- DNS
- Query and response validation
- VPN
- Common tunnel protocols
Nine one-click presets
Open the right ports for a common workload, then fit the limits to your own busy hour.
- FiveM (GTA RP)TCP 30120, UDP 30120
- Minecraft (Java)TCP 25565
- Minecraft (Bedrock)UDP 19132
- RustUDP 28015, TCP 28016
- Source / CS2UDP 27015
- SA-MP / open.mpUDP 7777
- ARK: SurvivalUDP 7777, UDP 27015
- TeamSpeak 3UDP 9987, TCP 10011, TCP 30033
- Web serverTCP 80, TCP 443
07
Regions
Three regions. The same protection in each.
Pick the one closest to your players. Nothing about the filtering changes between them.
- MumbaiIndia
- VPS from ₹890
- Dedicated available
- Same stack
- SingaporeSingapore
- VPS from $9.49
- Dedicated available
- Same stack
- FrankfurtGermany
- VPS from $9.49
- Dedicated available
- Same stack
08
Questions
Questions
Is DDoS protection included with every server?
Yes. Every Cloud VPS and dedicated server in Mumbai, Singapore and Frankfurt sits behind the same upstream network and runs Clouduxe Prism on the host. There is nothing extra to buy.
How large an attack can you absorb?
The upstream network carries up to 17 Tbps of mitigation capacity. That figure is the same on every plan, because it is the same network in front of every server, and it is not metered or divided per customer.
Does DDoS protection add latency?
There is no scrubbing hop. Prism runs on the machine serving your traffic, so nothing is re-encapsulated or relayed through another city. Traffic that passes reaches your service the same way it would with no protection at all.
Will the filter block my players?
Prism separates players from attackers by protocol and behaviour, not by volume alone. If a real player is ever dropped, Address lookup on the Attacks tab names the exact check that dropped them, and that rule can be tuned.
Which games does the filter understand?
Protocol validators ship for FiveM, Minecraft Java and Bedrock, the Source engine (CS2, CS:GO, TF2 and Garry's Mod), rAthena and TeamSpeak, plus RDP, DNS and common VPN protocols. One-click presets also cover Rust, ARK and SA-MP.
Can I see the attacks against my server?
Yes. The Attacks tab groups what was dropped into incidents, with their sources, the ports they targeted and what the attack was made of. Attack alerts can also go to a Discord channel of your own.
Do I have to configure anything?
Upstream filtering needs nothing from you. On the host you choose which ports are open and how fast traffic may arrive on each, usually by applying the preset for your game and then fitting the limits to your own busy-hour traffic.
Does another customer being attacked affect my server?
No. Every server has its own filtering state and its own rules, so another customer's attack does not tighten anything on yours, and a rule you set never leaks outwards.
Deploy a server. The protection is already there.
Same capacity on every plan, in every region, with nothing to switch on.