Voice is a common target
UDP 9987 carries everything a client does in normal use. Knock it over during a match or an event and the whole community goes quiet.
TeamSpeak DDoS protection
A voice server is a small UDP service a community depends on at exactly the moments someone wants to disrupt it. Floods big enough to fill the link are absorbed upstream. What reaches the machine is checked against TeamSpeak's own protocol for voice, server query and file transfer.
- Ports the preset opens
- UDP 9987, TCP 10011, TCP 30033
- Protocol validation
- Yes: voice, server query and file transfer
- One-click preset
- TeamSpeak 3
- Upstream capacity
- 17 Tbps, the same on every plan
- What it costs
- Included on every plan
The ports, and who should reach each one. The defaults; open whichever you actually configured.
| Port | What it carries | Exposure | In the preset |
|---|---|---|---|
| UDP 9987 | Voice, and everything a client does in normal use: connecting, moving between channels, text chat. | Open to players | Yes |
| TCP 30033 | File transfer: avatars, channel and group icons, uploads. | Open only if you use it | Yes |
| TCP 10011 | ServerQuery, the raw text admin interface used by bots and panels. | Restrict to your own addresses | Yes |
A rule is TCP or UDP, never both.
Why TeamSpeak servers get attacked. Voice, ServerQuery and file transfer are each a target, and each fails in its own way.
ServerQuery is scanned continuously
The serveradmin account on TCP 10011 can do everything, over a plain TCP port with no encryption. Assume a query port open to the internet will be found.
File transfer failures look like a broken client
TCP 30033 carries avatars, icons and uploads. When it fails, voice still works and the problem reads as a client fault rather than a network one.
What Prism checks on a TeamSpeak rule. All three gates, in order, and the last one reads the TeamSpeak protocol itself.
Every rule the TeamSpeak preset writes
The last gate is what catches a flood that uses the right port and a plausible packet size.
- UDP 9987Layer 3 Address and packet sanityLayer 4 pps_limit 10000Layer 7 TeamSpeak validator
- TCP 10011Layer 3 Address and packet sanityLayer 4 No ceiling as shippedLayer 7 TeamSpeak validator
- TCP 30033Layer 3 Address and packet sanityLayer 4 No ceiling as shippedLayer 7 TeamSpeak validator
TeamSpeak protocol validation
Voice, server query and file transfer are checked against how TeamSpeak actually behaves. Traffic that does not speak the protocol is dropped, however well it matches the port.
A ceiling on the voice port
The preset ships UDP 9987 with a whole-port packet ceiling. Set yours from your own normal traffic rather than a guessed number.
Zero-day signature engine on UDP
Learns the payload pattern of an attack while it is happening and refuses traffic matching it, without a rule being written first.
TCP fingerprint on file transfer and query
SYNs whose TCP stack fingerprint looks forged are dropped on the TCP rules.
The TeamSpeak 3 preset. One click writes the rules, added to yours exactly as if you had written them by hand.
What one click writes
One click writes UDP 9987, TCP 10011 and TCP 30033. Most preset rules arrive with protocol validation switched on; check each rule in the table after applying.
Applying a preset adds its rules, it never replaces yours, and applying it twice adds a second copy. A server holds 15 inbound rules, so check the table afterwards.
| Protocol | Port | Policy | Status |
|---|---|---|---|
| UDP | 9987 | 10K pps | Enabled |
| TCP | 10011 | No extra limits | Enabled |
| TCP | 30033 | No extra limits | Enabled |
Quick setup: apply a preset for a common workload
TeamSpeak 33 rulesApplied
The preset opens ServerQuery. Close it again.
Only UDP 9987 needs to face the internet, plus TCP 30033 if you use icons or uploads. After applying the preset, delete the TCP 10011 rule, or edit it to allow only the one address that needs query access, and set query_ip in ts3server.ini to the loopback address.
Read the guideWhat no network filter can see
A serveradmin login with the right password is valid ServerQuery traffic. Keep query on loopback and reach it through an SSH tunnel, leave query_skipbruteforcecheck at 0, and give bots their own query logins. query_ip_whitelist.txt exempts addresses from flood protection; it keeps nobody out.
Read the guideWhich plan for a TeamSpeak server. Bigger plans add cores, memory and disk, not clock speed.
A TeamSpeak server is a single binary with an SQLite database beside it. It is undemanding compared with a game server and runs happily alongside other things on the same machine.
Deploy in
Nano VPS
On its own. A single binary with an SQLite database beside it, undemanding next to a game server, so the smallest plan carries it.
- vCPU
- 1
- Memory
- 2 GB
- NVMe
- 20 GB
- Traffic
- 1 TB
How to size it
Or run it on the server that already hosts your game. Only UDP 9987 needs to face the internet, plus TCP 30033 if you use icons and uploads.
- Processor on every plan
- AMD EPYC 4584PX, up to 5.7 GHz
- Memory and disk
- DDR5 and NVMe
- Port
- 1 Gbit/s
- DDoS protection
- Included, always on
- Billing
- Monthly, prices exclude GST
Guides for running it. Step by step, in the help center, written against the same panel you will use.
Running a TeamSpeak server
docs.clouduxe.com/game-servers/teamspeak
Which ports each game server needs
docs.clouduxe.com/game-servers/game-server-ports
Rate limits
docs.clouduxe.com/ddos-protection/rate-limits
Protocol validation
docs.clouduxe.com/ddos-protection/protocol-validation
When players cannot connect
docs.clouduxe.com/ddos-protection/when-players-cannot-connect
What every TeamSpeak server on Clouduxe starts with.
- Boost clock, the same on every plan
- 5.7GHz
- Written by the TeamSpeak preset in one click
- 3rules
- Upstream mitigation, every plan
- 17Tbps
- Port on every plan
- 1Gbit/s
- Server uptime in the SLA, attacks excluded
- 99.99%
- Mumbai, Singapore and Limburg
- 3regions
TeamSpeak protection questions
Is TeamSpeak traffic protocol validated?
Yes. Prism ships a TeamSpeak validator covering voice, server query and file transfer. A rule you add by hand starts with Protocol validation off; most preset rules switch it on.
Does TeamSpeak DDoS protection cost extra?
No. The same filter and the same upstream capacity protect every plan in every region.
Which ports should face the internet?
UDP 9987 for voice, and TCP 30033 if you use avatars, icons or file uploads, which most communities do. TCP 10011, ServerQuery, should not be open.
Does query_ip_whitelist.txt restrict ServerQuery access?
No, despite the name. It exempts the listed addresses from flood and brute-force protection. query_ip_blacklist.txt blocks addresses. To keep query off the internet, bind it to the loopback address with query_ip.
Can I run TeamSpeak next to my game server?
Yes. It is undemanding and runs happily alongside other things on the same machine. Each virtual server takes its own voice port; file transfer and ServerQuery are shared.
Which region should a TeamSpeak server use?
The one closest to your users: Mumbai for India, Singapore for Southeast Asia, Limburg for Europe. Protection is identical in all three.
Run TeamSpeak where the filter speaks its protocol.
The same 17 Tbps upstream and the same filter on every plan, in every region, enabled from the first boot.