All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Creating own Game DDoS Protection Infrastructure
Hi everyone
I’m currently struggling to find an affordable provider offering game-specific DDoS protection in the Singapore/Malaysia region. Many providers only offer standard DDoS protection, which doesn't perform very well.
I’ve tried using XDP/eBPF to handle DDoS attacks, but massive attacks exceeding the server's bandwidth still cause downtime—mostly because servers typically only have 1–10 Gbps capacity, and XDP requires a specialized NIC to function optimally.
Since finding a provider with game-specific protection in Singapore is so difficult, I want to build my own protection system on a tight budget that is robust enough to handle attacks of around 1 Tbps.
Does anyone here have expertise in XDP, eBPF, or Edge technologies and could share some insights? Or are there other users facing similar challenges?
Thanks 
Comments
@advinservers @gatewaysentryllc @bbmmsvr4u @webhorizon @DigitalFyre @oloke @onidel can?
Thanks so much for the mention, but we don't touch game servers at all
It's not our specialty, and we tend to stay away from things we don't have experience with!
I used to use Advinserver back when they still utilized NeoProtect for game protection.
As for Gatewaysentry—that’s actually one of the reasons I’m making this post; they’re shutting down their Singapore POP this month.
Get OVH game server in Singapore, it's probably the most cost effective solution.
@wadhah @SilverCreek
OVH Game Servers in Singapore are indeed still affordable; however, certain game filters—such as those for FiveM—are unavailable, and outdated game filters can be bypassed, leading to bandwidth exhaustion.
I am currently planning to use a provider that offers DDoS protection capable of handling botnet attacks or large-scale attacks, and to run XDP/eBPF directly on the server.
I think i can recommend you something good
which game ?
I run a lot of games, Fivem, Minecraft, Palworld, SA:MP, etc.
We can handle any sized flood, just open a ticket with us @ https://support.terabit.io/en/. It's worth noting that in Singapore & Malaysia, the bandwidth pricing is usually pretty expensive so you should budget about $1.5-2/Mbps in these regions at the low end.
Wtf, clean, right?
For clean traffic yes.
what is the minimum package you offer?
In Singapore our minimum is $100/month.
Everything always ends with volumetric avalanche. No matter sofistication of attack - just raw sewage will do the job. Brutal pwnage in Tbps scale. The only thing stopping such attacks - they cost a lot to attackers. The longer they keep manure flowing the faster they are detected and identified by carriers to handle.
So are you a company looking for a GRE provider? Or are you hosting game servers for a community/yourself?
I don't want to discourage you regarding your idea, We handle game servers and I know the kind of problems you're facing, but there's nothing to be done you can't do absolutely anything on your end, I have been looking for a solution since 2020 and I have tested I think many anti-DDOS solutions
so,,, The problem is simple: you need the capacity to filter these attacks. For instance, if you have a clean 10 Gbps pipe and receive an 11 Gbps attack, you're done for.
To filter 1 Gbps, you need direct connections with various providers that aggregate a total capacity exceeding 1 Tbps, There is a GREE tunnel option, but if you have CS 1.6 or SA-MP servers requiring the lowest possible latency, you will run into issues here; the GREE tunnel can increase latency by as much as 50–80ms...
We have our own data center, in which we have invested a huge amount of money only on equipment alone......
The only solution is for providers to offer the necessary protection, while you use XDP simply to filter small packets—such as those in the 500 Mbps to 1 Gbps range, or depending on the port.
So, there are 3 solutions.
You receive direct protection from your providers, and with XDP, you simply filter the remaining packets for various games.
You use a GREE tunnel from a gaming-focused provider that can apply all the necessary filters for you, but latency increases by 50–80ms.
You need multiple internet connections from various providers and must filter these attacks using specific equipment; but I repeat: if you face a 1 Tbps attack while having only 500 Gbps of connectivity, you're dead for and securing connections exceeding 1 Tbps costs an enormous amount of money.
Try path or cyber filters
(a) "around 1 Tb/s" - and you'll buy a 1 Tb/s pipe?
(b) I'm asking because I'm not sure you understood the problem (see below)
Look at it from the attacker's perspective. All they need to do is to flood your providers pipe(s) plus critical equipment like routers, firewall(s), etc. which also leads to your cage/rack(s)/server(s) being flooded. That's enough - in particular for latency sensitive gaming servers.
And the only practical defense is to simply have fatter pipes (to the backbone) than the attacker(s). Which is only feasible for giants (military, billion $ corporations).
All you can do is small scale filtering of some sort. You can do that smartly, e.g. eBPF, Chelsio (or Mellanox) adapter, some smart fast routines, etc. - but at the end of the day you're left with a tea spoon against a giant ocean wave.
On a tight budget at that.
Good luck.
I recently came across this provider: https://clouduxe.com/ddos-protection/game-servers
Note: I have not used them. You can try if it fits your needs. They have SG game servers with ddos protection included.
You can find server NICs up to 800Gbps if you spend some money (400Gbps Ethernet NIC for $2250, it's a lot but it's not a lot a lot). The problem is not the server's network card, it is how much internet you can actually get.
To handle 1Tbps of DDOS traffic you first need to have 1Tbps of bandwidth. It doesn't matter how fast the server behind that pipe is, if the pipe itself is too small. Getting 1Tbps of bandwidth costs a lot but it has good economies of scale. That's why there are a few big DDOS protection providers instead of a lot of small ones.
But obviously it's not completely impossible, since there are some providers. If you're willing to fail several times you could get your ASN and IP range and the fattest single pipe you can (or two pipes, to justify your ASN allocation), wait until you get DDOSed, then start the feedback loop: see what the attacker did, work out how to mitigate it, deploy the mitigations, repeat until it works well.
DDOS mitigation is all about divide and conquer, by dropping the packets as close to the source as possible, when it's still many small floods instead of one big flood. You need to care about how the networks are interconnected and how much you can influence network routing. You can't just advertise your range over BGP and let the packets flow in, you need to know the story of where they're coming from and how they're getting to you, then you can start to manipulate that. The first thing you'd need is a dashboard showing you the source addresses that are sending you the most packets as well as the last-hop physical links that are delivering them to you. As programmers we often think IP addresses are just random numbers, but it is possible to look them up and see which network they come from, and BGP provides more information as well.
The most basic mitigation is something called Remote-Triggered Black Hole or RTBH, which is a type of BGP announcement that tells your upstream network provider to drop packets based on a few limited criteria. Since your upstream drops them for you, you get to utilize their whole bandwidth. Say you have Hurricane Electric as an upstream, and they have a 10Tbps total capacity with Verizon, and Verizon is sending you 100Gbps of attack - if you use RTBH, HE will absorb all of that for you. Of course nobody on Verizon will be able to access your servers while the attack is happening, because HE's routers are pretty dumb and only know to drop all traffic that matches this route. But you can tell them it's only for Verizon, and then British Telecom customers will still be able to. But in reality you're probably getting DDOS packets from the whole world including BT, but you don't have to block the whole world, you can use RTBH on the biggest source networks until the rest of the attack small enough that you can manage it yourself.
For more advanced mitigation, you can do something similar but instead of using RTBH, you actually have a server closer to the source network and you use BGP to get the traffic to go to that server. So in the same example, maybe you have a 100Gbps server at some IX that Verizon is connected to, and you can tell HE to block your route announcement to Verizon (this isn't the same as dropping packets), and then you announce the route at that IX instead (either to Verizon specifically, or to the whole IX). Then you get to filter that traffic yourself and send the legitimate traffic to your main location through a tunnel, instead of stupidly dropping it all, and Verizon customers will be able to access your server if the filter thinks they're legit, even at the same time as a DDOS is going on.
Until you get to the size of Cloudflare (absolutely massive), you won't be able to keep 100% availability during a big DDOS - you'll only be able to reduce the damage compared to what your customer would have without your protection. There's no real cure for DDOS, you can just amputate a leg to save the rest of the body.
You cant. There is a reason why ddos protection costs so much