How to protect a Minecraft server from DDoS attacks

Minecraft servers are attacked more than almost any other kind of game server, often by banned players or rival servers. Attacks come in two kinds, and each needs a different defence. Here is how to keep your server online.

By the Nodewave team · Updated 4 November 2026

Two kinds of attack

• Network floods. Huge amounts of junk traffic fill the server's connection until real players time out. Nothing on the server itself can stop them, because the link is full before the traffic arrives.
• Bot attacks. Thousands of fake players try to log in, or flood the server with status requests, using up CPU and memory. They look like real Minecraft traffic, so they need limits in the server and the proxy.

1. Filter floods upstream

Choose hosting with DDoS protection on every IP, ideally with filtering that understands Minecraft traffic, so real players still get through during an attack. A firewall on the server only helps against small floods.

2. Keep your real IP hidden

• Give players a domain name, not an IP address, and point it at a protected address.
• Don't host your website or panels on the same IP as the game server.
• If your real IP has already leaked, for example through old DNS records, change it once your protection is in place.

3. Close the back door

A protected address only helps if the real one stops answering. Remove any rule that opens the game port to everyone, and accept it only from your protection provider's addresses. On a Velocity or BungeeCord network, the game servers should accept connections only from the proxy, never from the internet.

sudo ufw allow from provider-or-proxy-ip to any port 25565 proto tcp

4. Keep real player IPs with PROXY protocol

Behind a protection proxy, every player seems to come from the proxy's address, which breaks IP bans and anti-cheat checks. PROXY protocol passes each player's real IP along. Turn it on only when every connection reaches the server through a proxy that sends it, because direct connections then stop working.

• Paper: in config/paper-global.yml, set proxies.proxy-protocol to true.
• Velocity: in velocity.toml, under [advanced], set haproxy-protocol = true.
• BungeeCord: in config.yml, set proxy_protocol: true on the listener.

5. Slow down bot attacks

• Keep online-mode on, on the proxy for a network, so only real Minecraft accounts get in.
• On Velocity, login-ratelimit sets the minimum time between logins from one IP address.
• An anti-bot plugin on the proxy can hold back new players during a join flood.
• During a heavy bot attack, turn the whitelist on until it passes.

During an attack

1. Work out the kind: everyone timing out with a traffic spike is a flood; a console full of joins is bots.
2. Note the time and what players see, and send it to your host.
3. Check that your real IP isn't answering directly.
4. Keep your community updated on Discord.

How Nodewave helps

Every Nodewave VPS sits behind Gcore DDoS filtering at no extra cost. If your server runs somewhere else, NodeShield puts a protected Singapore address in front of it, with Gcore's Minecraft filter and PROXY protocol, for Java Edition servers and Velocity or BungeeCord proxies. Running FiveM too? See how to protect a FiveM server from DDoS attacks.