Applying adds, it never replaces
A preset appends its rules to what is already there. Applying it twice adds a second copy of each rule; there is no button that removes a preset.
DDoS protection for game servers
Every game server here gets the same filter at the network driver. For the games with a protocol validator, that filter also reads the game's own protocol. For the rest it enforces port rules, packet ceilings and behavioural checks. This page says which is which.
- Protocol validator families
- 8
- One-click game presets
- 8
- Games on presets only
- 3 (Rust, ARK: Survival and SA-MP / open.mp)
- Upstream capacity
- 17 Tbps, every plan
Every game, and how deep the filter reads it. Validated games also get a protocol check.
FiveM (GTA RP) preset writes
- UDP 3012050K pps
- TCP 30120No ceiling
Minecraft (Java) preset writes
- TCP 2556510K pps, 250 per connection
Minecraft (Bedrock) preset writes
- UDP 1913220K pps
Source / CS2 preset writes
- UDP 2701530K pps
TeamSpeak 3 preset writes
- UDP 998710K pps
- TCP 10011No ceiling
- TCP 30033No ceiling
Ragnarok Online (rAthena)
ValidatedDefault ports Login, char and map ports
No preset. Add a rule for each port you run.
Rust preset writes
- UDP 2801530K pps
- TCP 28016No ceiling
ARK: Survival preset writes
- UDP 777725K pps
- UDP 270155K pps
SA-MP / open.mp preset writes
- UDP 777720K pps
Validators also ship for RDP, DNS and VPN traffic. Ports are defaults; if you moved one, open the one you set. Ceilings are the values each preset ships with and can change without a panel update.
A rate limit counts packets. A validator reads them. Prism asks the cheapest question first and stops at the first gate that decides.
Four kinds of traffic against the three gates
A blocked source ends at the address, a spoofed flood at the transport. The one that needs a validator is the protocol impostor: right port, plausible packet size, but not the protocol the port serves. A rate limit cannot see this attack, because every packet is individually reasonable. The validator can, because the flood never holds the conversation a real client holds. Switch the diagram to a preset-only port to see what changes when there is no validator to read it.
TrafficLayer 3, the addressLayer 4, the transportLayer 7, the protocolOutcome
A player joining A real client on the game portLayer 3 Allowed sourceLayer 4 A real conversationLayer 7 Speaks the protocolLayer 7 No check hereReaches your serverReaches your server
A blocked source An address on your deny listLayer 3 BlockedLayer 4 Not reachedLayer 7 Not reachedDropped at layer 3
A spoofed flood Forged sources, one packet eachLayer 3 Allowed sourceLayer 4 No real conversationLayer 7 Not reachedDropped at layer 4
Protocol impostor Right port, plausible packet size, but not the protocol the port serves.Layer 3 Allowed sourceLayer 4 Under every ceilingLayer 7 Not the protocolLayer 7 No validatorDropped at layer 7Reaches your server unless a behavioural engine catches it
Validated or preset only. Six of the eight lines are the same. The difference is the last gate.
The difference is layer 7, and the protocol abuse that only that gate can see.
| Check | Validated | Preset only |
|---|---|---|
| Layer 3: blocked sources and malformed packets | Yes | Yes |
| Layer 4: spoofed and stateless floods | Yes | Yes |
| Your packet ceilings, per port and per connection | Yes | Yes |
| Signature (zero-day), on UDP rules | Yes | Yes |
| TCP fingerprint, on TCP rules | Yes | Yes |
| Behavioural scoring, timing regularity and reputation | Yes | Yes |
| Layer 7: protocol validation | Yes | No |
| Protocol abuse: invalid payloads, malformed and replayed connects | Yes | No |
What each preset writes. A bundle of inbound rules, written exactly as if you had added them yourself.
| Preset | Rule | Ceiling as shipped | Protocol |
|---|---|---|---|
| FiveM (GTA RP) | UDP 30120 | pps_limit 50000 | Validated |
| FiveM (GTA RP) | TCP 30120 | None | Validated |
| Minecraft (Java) | TCP 25565 | pps_limit 10000, estab_flow_pps 250 | Validated |
| Minecraft (Bedrock) | UDP 19132 | pps_limit 20000 | Validated |
| Rust | UDP 28015 | pps_limit 30000 | Preset only |
| Rust | TCP 28016 | None | Preset only |
| Source / CS2 | UDP 27015 | pps_limit 30000 | Validated |
| SA-MP / open.mp | UDP 7777 | pps_limit 20000 | Preset only |
| ARK: Survival | UDP 7777 | pps_limit 25000 | Preset only |
| ARK: Survival | UDP 27015 | pps_limit 5000 | Preset only |
| TeamSpeak 3 | UDP 9987 | pps_limit 10000 | Validated |
| TeamSpeak 3 | TCP 10011 | None | Validated |
| TeamSpeak 3 | TCP 30033 | None | Validated |
A server holds 15 inbound rules
Close to the cap, a preset can stop partway. The confirmation reports what the preset holds, not what landed, so check the table.
Validation on for most preset rules
Most preset rules switch Protocol validation on. A rule you add by hand starts with it off, whichever service you pick.
Players' ports only
Query ports, RCON, SourceTV and Rust+ are not part of a preset. Add them yourself, and restrict the administrative ones to your own addresses.
Fit the ceiling to your busy hour
A preset is sized for a typical server. A ceiling below your real peak drops players and looks exactly like an attack.
Read the rules table after applying
The ceilings above can change without a panel update, so the rules table is the record of what was written.
Players who already joined keep their place. What Prism tracks is whether a source has behaved like a real client, not only how fast it sends.
1
Trust is earned
Completing a genuine handshake counts in a source's favour, so does answering a challenge, and so does the irregular timing of a human rather than the metronome of a script.
2
Under pressure, it is kept
A player who has already proved themselves is not thrown away when the server comes under attack. The filter has a reason to keep them that a rate limit does not.
3
A stranger mid-flood starts from nothing
An unknown source arriving during an attack has to earn its way in at the moment the bar is highest. That is also why pausing protection mid-attack is worse than it sounds.
Where to start, game by game. The processor is the same on every plan. What grows is the room around the game.
| Game | Start on | Why |
|---|---|---|
| FiveM | MicroCore VDS, up to 32 players | Room for a framework such as ESX or QBCore with its MySQL or MariaDB database on the same machine. Its cores are never shared, so the main game thread keeps its tick while the database and streaming run beside it. |
| Minecraft | Mini VPS, a small world | A small world and a few plugins, with memory left over for the operating system and for what the Java runtime uses outside the heap. Giving the heap every gigabyte on the machine is the common mistake. |
| CS2 and Source | Pro VPS, one busy server | A Source server is one process. The cores around it carry SourceTV, RCON tools and updates without crowding the game. |
| TeamSpeak | Nano VPS, on its own | A single binary with an SQLite database beside it, undemanding next to a game server, so the smallest plan carries it. |
| Rust | Pro VPS, one busy server | Memory is what Rust runs out of first, and it climbs through each wipe as players build. Start with headroom and check the RustDedicated process at the end of a cycle. |
| ARK | Pro VPS, one map | A bare map needs several gigabytes before anyone connects, and a busy modded map considerably more. Start with room to grow and measure. |
| SA-MP and open.mp | Nano VPS, to start | Start on Nano and resize as the server grows. CPU and traffic changes apply straight away; memory and disk at the next restart. |
Each game page explains the sizing in full.
Game server protection questions
Which games have protocol validation?
Validators ship for FiveM, Minecraft, Source, rAthena, TeamSpeak, RDP, DNS and VPN. Source covers CS2, CS:GO, TF2, Garry's Mod, and Minecraft covers Java and Bedrock.
Are Rust, ARK and SA-MP servers protected?
Yes, by port presets, packet ceilings, the layer 3 and layer 4 filter and the behavioural engines. They are not protocol validated: no validator ships for them, and we do not claim one.
Does game server protection cost extra?
No. Every plan in every region sits behind 17 Tbps of upstream capacity and is filtered by Prism. There is nothing to add at checkout.
My game is not listed. Can I still host it?
Yes. Add a rule for each port it uses. The layer 3 and layer 4 checks, your ceilings and the behavioural engines apply to every rule. If the service has no validator, the Protocol validation switch renders dim and has no effect.
Why is protocol validation off on a rule I added myself?
It starts off on every rule you create by hand, whichever service you pick, and most preset rules switch it on. A validator drops anything that does not speak the protocol, so it is left for you to turn on while you can watch the result.
Can a validator drop a modded or unusual client?
It can, if the client speaks the protocol loosely. Address lookup on the Attacks tab names the check that dropped a player, and you can switch validation off for that one rule.
Pick the game, then the size.
Every plan carries the same filter and the same 17 Tbps upstream, enabled from the first boot.