Minecraft DDoS protection: what a plugin can and cannot do

Three kinds of attack

Network flood

Huge amounts of traffic fill the server's connection. The server becomes unreachable or lags for everyone, and nothing new shows up in the login log.

Connection flood

Thousands of connections or server list pings that never become players. They do not saturate the connection, but they keep the proxy busy until it stops answering real players.

Bot attack

Fake players complete the login, take the slots and spam the chat. Each bot is a real connection, usually through a proxy list, so it looks like a player to the server.

Why a plugin cannot stop a DDoS

A plugin runs inside the proxy or the server. When the connection is saturated or the machine is busy dropping packets, the plugin never gets to run. Filtering has to happen before the traffic reaches your machine: at your host's network or at a service in front of it.

Where real DDoS protection comes from

• Many Minecraft hosts and some data centres, for example OVHcloud with its game filtering, include DDoS protection and filter attacks on their network before they reach you.
• A protection proxy such as TCPShield or Cloudflare Spectrum (paid plans) sits in front of the server: players connect to its network and only clean traffic reaches you. Turn on PROXY protocol in the service and set haproxy-protocol = true in velocity.toml or proxy_protocol: true in BungeeCord's config.yml (or install the service's plugin), otherwise your proxy sees the service's addresses instead of the players', and IP bans and address checks stop working.
• Keep the real address hidden. If attackers know the direct address of your proxy or backend, they go around the protection, so do not use that address for anything else and change it if it has leaked.

These services filter traffic. They know nothing about VPN users, ban evasion or bots that complete the login.

What you can set on the proxy

Both proxies can slow down one address that connects too often:

• Velocity: login-ratelimit in velocity.toml, the minimum time between logins from one address in milliseconds.
• BungeeCord: connection_throttle and connection_throttle_limit in config.yml.

This helps against a flood from a few addresses, not from thousands. On your own machine a firewall rule that limits new connections per address helps with small connection floods.

Bot attacks: where plugins do help

A bot attack is the case where a plugin is the right tool, because every bot comes in as a login. Kordon checks the address of each login, switches the server to attack mode when a wave starts and closes the networks the bots use; attack mode is on every plan, the free one included. A verification plugin such as Sonar catches bots that come from clean addresses. The two work well together on one proxy.

Kordon does not filter network traffic, so against a real DDoS you still need your host. See what to do during a bot attack.

How to tell which one you have

If the server is unreachable or everyone has huge ping, while the login log shows no new joins and the host's graphs show a spike of traffic, it is a DDoS: contact your host. If the log fills with new nicknames and the slots are taken, it is a bot attack: protection on the proxy handles it. The two are sometimes combined, so check both.