Game and query share one port
Source answers A2S queries on the port players connect to. A query flood and a game flood arrive at the same rule, and the validator has to tell both apart from real traffic.
CS2 and Source server DDoS protection
Source engine servers answer players and Steam queries on the same UDP port, which makes the query protocol part of your attack surface. Floods big enough to fill the link are absorbed upstream, and Prism validates Source traffic and the shared query protocol on the host.
- Ports the preset opens
- UDP 27015
- Protocol validation
- Yes: cS2, CS:GO, TF2, Garry's Mod and the shared query protocol
- One-click preset
- Source / CS2
- Upstream capacity
- 17 Tbps, the same on every plan
- What it costs
- Included on every plan
The ports, and who should reach each one. The defaults; open whichever you actually configured.
| Port | What it carries | Exposure | In the preset |
|---|---|---|---|
| UDP 27015 | Game traffic and Steam queries, on the same port. | Open to players | Yes |
| UDP 27020 | SourceTV, only when enabled. | Open only if you use it | Add it yourself |
| TCP 27015 | RCON. | Restrict to your own addresses | Add it yourself |
A rule is TCP or UDP, never both.
What gets attacked. Players and Steam queries share one UDP port, so the query protocol is part of the target.
Reflection floods
Small forged requests sent to exposed query and DNS services elsewhere come back as much larger replies aimed at you. The largest are absorbed upstream; what reaches the machine meets your port ceilings.
Spoofed UDP
UDP has no handshake, so a forged source costs an attacker nothing. The first-packet challenge separates sources that retransmit like real clients from single-shot floods.
What Prism checks on a CS2 rule. All three gates, in order, and the last one reads the Source protocol itself.
Every rule the CS2 preset writes
The last gate is what catches a flood that uses the right port and a plausible packet size.
- UDP 27015Layer 3 Address and packet sanityLayer 4 pps_limit 30000Layer 7 Source validator
Source protocol validation
Game traffic and the shared A2S query protocol are checked against how CS2, CS:GO, TF2 and Garry's Mod actually behave.
Query flood detection
The query endpoint hit far harder than any server browser would is recognised as an attack, not as popularity.
UDP first-packet challenge
Under load, an unknown source's first packet is dropped. Real clients retransmit and get through; single-shot spoofed floods never do.
Zero-day signature engine
Learns the payload pattern of an attack while it runs and refuses traffic matching it, with no rule written in advance.
What CS2 puts on the wire. Same port, but only a real player holds the conversation.
Joining
Players and Steam queries arrive on the same UDP port, so the query protocol is part of your attack surface whether you use it or not.
Being listed
A2S queries answer with more than they receive, which is the shape used to reflect traffic at someone else. The validator reads the query protocol as well as gameplay.
Admin
RCON is a full administrative channel on TCP. It gets its own rule, with the sources that may reach it restricted.
The tell
A real client answers a challenge and then speaks Source. A query flood and a spoofed UDP flood both fail one of those two steps.
A real player
UDP 27015 Queries the server from the browser, to the server, passes Prism
UDP 27015 A2S reply: name, map, players, from the server, passes Prism
UDP 27015 Retransmits when challenged under load, to the server, passes Prism
UDP 27015 Connects and speaks the Source protocol, both ways, passes Prism
- Reaches the server and plays
A booter
UDP 27015 Floods A2S queries from one source
Ends at: Query flood detection
UDP 27015 Spoofed UDP that never retransmits
Ends at: UDP first-packet challenge
UDP 27015 Traffic that does not speak Source
Ends at: Source protocol validation
- Dropped at the network driver, before the server sees it
Step by step on UDP 27015. Four steps each. The booter can copy the port and the packet size; it cannot copy the steps.
StepPlayerBooter
1PlayerQueries the server from the browserBooterFloods A2S queries or spoofed UDP at 27015
2PlayerRetransmits when challenged under loadBooterNever retransmits, never completes a real connection
3PlayerConnects and speaks the Source protocolBooterFails the Source protocol check
4PlayerReaches the server and playsBooterDropped at the network driver, before the server sees it
The Source / CS2 preset. One click writes the rules, added to yours exactly as if you had written them by hand.
What one click writes
One click writes the UDP 27015 rule with a packet ceiling. A second server listens on 27016 and a third on 27017, and each needs its own rules.
Applying a preset adds its rules, it never replaces yours, and applying it twice adds a second copy. A server holds 15 inbound rules, so check the table afterwards.
| Protocol | Port | Policy | Status |
|---|---|---|---|
| UDP | 27015 | 30K pps | Enabled |
Quick setup: apply a preset for a common workload
Source / CS21 ruleApplied
Without a login token, nobody finds you
A server with no Steam game server login token never registers with the master server list. If the server runs but is not in the browser, check the token before any firewall rule.
Read the guideWhat no network filter can see
RCON is a full administrative channel on TCP 27015. Prism can restrict which sources reach it, but a leaked password is still a leaked password. Use a long one, and share configs without it.
Read the guideWhich plan for a CS2 server. Bigger plans add cores, memory and disk, not clock speed.
Source servers are one process per server, and a second server listens on the next port up. Size for how many you run side by side.
Deploy in
Pro VPS
One busy server. A Source server is one process. The cores around it carry SourceTV, RCON tools and updates without crowding the game.
- vCPU
- 6
- Memory
- 12 GB
- NVMe
- 120 GB
- Traffic
- 8 TB
MicroCore VDS
One server that must never share a core. The same one process, on cores reserved for it, so the tick never waits for a shared core. Pick it for a match server where a stall is noticed.
- Dedicated cores
- 2
- Memory
- 8 GB
- NVMe
- 100 GB
- Traffic
- 8 TB
OmniCore VDS
Several servers for one community. Every extra server is its own process listening on the next port up, with a rule of its own. Reserved cores let several run side by side without taking turns.
- Dedicated cores
- 6
- Memory
- 24 GB
- NVMe
- 500 GB
- Traffic
- 12 TB
- Processor on every plan
- AMD EPYC 4584PX, up to 5.7 GHz
- Memory and disk
- DDR5 and NVMe
- Port
- 1 Gbit/s
- DDoS protection
- Included, always on
- Billing
- Monthly, prices exclude GST
Guides for running it. Step by step, in the help center, written against the same panel you will use.
What every CS2 server on Clouduxe starts with.
- Boost clock, the same on every plan
- 5.7GHz
- Written by the CS2 preset in one click
- 1rule
- Upstream mitigation, every plan
- 17Tbps
- Port on every plan
- 1Gbit/s
- Server uptime in the SLA, attacks excluded
- 99.99%
- Mumbai, Singapore and Limburg
- 3regions
CS2 protection questions
Does CS2 DDoS protection cost extra?
No. It is part of every VPS, VDS and bare metal server, in every region, on every plan.
Which Source games are covered?
CS2, the legacy CS:GO server, Team Fortress 2 and Garry's Mod all share the Source validator and the shared query protocol.
Are Steam queries protected?
Yes. Source answers A2S queries on the game port, and the validator covers the query protocol as well as game traffic, so a query flood is recognised on the same rule.
How should RCON be exposed?
As its own TCP rule on 27015, with a long password and the sources that can reach it restricted. RCON is a full administrative channel, so treat the password as a credential.
Which region should a CS2 server use?
The one closest to your players: Mumbai for India, Singapore for Southeast Asia, Limburg for Europe. Protection is identical in all three.
Run CS2 where the filter speaks its protocol.
The same 17 Tbps upstream and the same filter on every plan, in every region, enabled from the first boot.