A query port every browser reads
The in-game browser, Steam and every third-party list send a small query to UDP 27015 and read back the name, map, player count and ping. Close it and the server runs but nobody finds it.
ARK server DDoS protection
ARK is covered by a port preset, not a protocol validator. The preset opens the game port and the Steam query port with a ceiling on each, and every packet passes the address and transport checks and the behavioural engines. Prism does not read the ARK protocol, and we would rather you knew that before you order.
- Ports the preset opens
- UDP 7777, UDP 27015
- Protocol validation
- No. Port preset only
- One-click preset
- ARK: Survival
- Upstream capacity
- 17 Tbps, the same on every plan
- What it costs
- Included on every plan
The ports, and who should reach each one. The defaults; open whichever you actually configured.
| Port | What it carries | Exposure | In the preset |
|---|---|---|---|
| UDP 7777 | Game traffic, set by ?Port= in the launch string. | Open to players | Yes |
| UDP 27015 | Steam queries, set by ?QueryPort=. What every server browser reads. | Open to players | Yes |
| UDP 7778 | Raw socket traffic, Survival Evolved only, always the game port plus one. | Open only if you use it | Add it yourself |
| TCP 27020 | RCON, off by default. No encryption on the password. | Restrict to your own addresses | Add it yourself |
A rule is TCP or UDP, never both.
What an ARK server exposes. Our ARK guides do not document attack patterns specific to ARK, so this page does not invent any.
These are the surfaces they do describe.
RCON with an unencrypted password
ARK RCON is off by default, listens on TCP, and carries the admin password with no encryption. ServerAdminPassword is both full in-game admin and the RCON password.
Every map in a cluster is another pair of ports
Each map is its own process with its own game and query port, so a three-map cluster is three sets of rules to open and three sets of ceilings to fit.
What Prism checks on a ARK rule. Layers 3 and 4, your ceilings and the engines that need no validator. There is no ARK protocol validator.
Every rule the ARK preset writes
The diagram stops where the checking stops.
- UDP 7777Layer 3 Address and packet sanityLayer 4 pps_limit 25000Layer 7 No validator
- UDP 27015Layer 3 Address and packet sanityLayer 4 pps_limit 5000Layer 7 No validator
Layer 3, the address
Blocked sources and structurally malformed packets end here, at the lowest cost, exactly as on every other port.
Layer 4, the transport, and your ceilings
Spoofed and stateless floods are separated from traffic belonging to a real conversation, and the packet-rate ceilings on each rule apply. The preset ships UDP 7777 and UDP 27015 each with its own whole-port ceiling, the query port much lower than the game port.
Signature (zero-day) engine on UDP rules
Learns the payload pattern of an in-progress attack and blocks it, without a rule being written first. It needs no validator.
Behavioural scoring
Timing regularity, reputation and tier demotion judge how a source behaves rather than what its payload says, which is why they work on a port with no validator.
Protocol validation for ARK
No validator ships for ARK. On a ARK rule the Protocol validation (L7) switch renders dim and reads "This service has no protocol validator. No effect on this one." A flood that uses the right port, stays under your ceilings and looks like nothing the behavioural engines recognise can reach your server.
Checked on every ARK ruleNot checked
The ARK: Survival preset. One click writes the rules, added to yours exactly as if you had written them by hand.
What one click writes
One click writes UDP 7777 for the game and UDP 27015 for queries. Survival Evolved also uses the game port plus one, UDP 7778, which the preset does not open; ask the server with ss -lunp | grep ShooterGame and add a rule for what it bound.
Applying a preset adds its rules, it never replaces yours, and applying it twice adds a second copy. A server holds 15 inbound rules, so check the table afterwards.
| Protocol | Port | Policy | Status |
|---|---|---|---|
| UDP | 7777 | 25K pps | Enabled |
| UDP | 27015 | 5K pps | Enabled |
Quick setup: apply a preset for a common workload
ARK: Survival2 rulesApplied
Clusters need a gap between game ports
Because of the game port plus one behaviour, give each map its own game and query port with a gap: 7777 with 27015, 7779 with 27017, 7781 with 27019. Each pair needs its own rules.
Read the guideWhat no network filter can see
An RCON password sent in the clear, or a weak ServerAdminPassword, is a valid login on a port you opened. Keep RCON off the internet and reach it over an SSH tunnel.
Read the guideWhich plan for a ARK server. Bigger plans add cores, memory and disk, not clock speed.
An ARK server holds the whole map, every structure and every tame in memory at once, and it does not shrink until you restart. On a machine with 1 or 2 GB of RAM it starts, loads for minutes, then dies. No configuration fixes that.
Deploy in
Pro VPS
One map. A bare map needs several gigabytes before anyone connects, and a busy modded map considerably more. Start with room to grow and measure.
- vCPU
- 6
- Memory
- 12 GB
- NVMe
- 120 GB
- Traffic
- 8 TB
OmniCore VDS
A cluster. A cluster shares saves, not resources. Each map is its own process with its own memory and its own ports, so three maps is three of everything.
- Dedicated cores
- 6
- Memory
- 24 GB
- NVMe
- 500 GB
- Traffic
- 12 TB
How to size it
Measure your own server with ps -o pid,rss,etime,args -C ShooterGameServer at your busiest hour, then again a week later. The gap is your real growth rate.
- Processor on every plan
- AMD EPYC 4584PX, up to 5.7 GHz
- Memory and disk
- DDR5 and NVMe
- Port
- 1 Gbit/s
- DDoS protection
- Included, always on
- Billing
- Monthly, prices exclude GST
Guides for running it. Step by step, in the help center, written against the same panel you will use.
What every ARK server on Clouduxe starts with.
- Boost clock, the same on every plan
- 5.7GHz
- Written by the ARK preset in one click
- 2rules
- Upstream mitigation, every plan
- 17Tbps
- Port on every plan
- 1Gbit/s
- Server uptime in the SLA, attacks excluded
- 99.99%
- Mumbai, Singapore and Limburg
- 3regions
ARK protection questions
Is the ARK protocol validated?
No. ARK has a port preset, not a protocol validator. Its rules get the layer 3 and layer 4 checks, your packet-rate ceilings, the zero-day signature engine and the behavioural engines. The Protocol validation switch has no effect on an ARK rule.
Does ARK DDoS protection cost extra?
No. The same filter and the same upstream capacity protect every plan in every region.
Which ports does an ARK server need?
UDP 7777 for the game and UDP 27015 for Steam queries. Survival Evolved also uses UDP 7778, the game port plus one. Survival Ascended does not. RCON is optional, on TCP, and should stay off the internet.
My server works by direct IP but nobody can find it. Why?
UDP 27015, the query port, is closed or is not the port the server actually uses. That is the cause of almost every report of this kind.
Will a small VPS run ARK?
No. On 1 or 2 GB of RAM the server starts, loads for several minutes, then dies during world load or when the first players join. A bare map needs several gigabytes before anyone connects.
Which region should an ARK server use?
The one closest to your players: Mumbai for India, Singapore for Southeast Asia, Limburg for Europe. Protection is identical in all three.
Every ARK rule gets the full layer 3 and layer 4 filter.
The same 17 Tbps upstream and the same filter on every plan, in every region, enabled from the first boot.