DDoS Protection
DDoS attacks can be devastating for any gaming community. Here is how we ensure that your server stays online, even when it's under heavy fire.
A Distributed Denial of Service (DDoS) attack happens when someone tries to overwhelm your server's network connection with massive amounts of fake data. If someone doesn't like your server or wants to cause trouble, they can send hundreds of thousands of fake players' requests to your IP address.
Our Layered Defense Strategy
Rather than relying on one single tool, we use a multiple-layered approach to filter out malicious traffic before it ever reaches your Minecraft world.
What about GeyserMC and Bedrock?
Bedrock players use UDP, which is notoriously harder to protect than the TCP traffic used by Java players. We have custom-tuned our firewalls to specifically handle UDP floods, ensuring that your friends on mobile and console can play without lag, even during an attack.
Why use a Domain Name?
One of the most important things you can do to protect yourself is to give out your server's domain name (e.g., yourname.deduck.de) instead of your server's numeric IP.
Expert Tip: By using a domain via a service like TCPShield or Cloudflare Spectrum, you can hide your server's true IP. That way, if an attacker tries to flood your domain, the proxy will absorb the attack before it ever hits your actual Deduck hardware.
What if I'm under attack right now?
Most attacks are mitigated automatically, and you won't even notice them. If your server is lagging or players can't connect, check your Web Console. If you see thousands of "Lost connection: Timed out" messages, it's possible you're being flooded. Reach out to us on Discord if this happens.
Understanding Layer 4 vs Layer 7 Attacks
In 2026, attackers have become more sophisticated, moving beyond simple volumetric floods.
- Layer 4 (Transport): These are "brute force" attacks like SYN floods or UDP reflection. They aim to fill your network pipe with junk data. Hetzner’s core infrastructure filters these at the multi-terabit edge level.
- Layer 7 (Application): These are surgical. The attacker sends valid-looking Minecraft "handshake" packets at high frequency, trying to crash the server's CPU by forcing it to process thousands of fake player logins. Our custom Heuristic Filter identifies these patterns and blocks the source IPs before they hit your RAM.
Built by gamers, for gamers, that's the Deduck way.