Game Server Anti-DDoS

01 / The problem

FiveM roleplay communities get attacked all the time, often by rival communities and usually during evening peaks when the most players are online. One flood is enough to take a server offline. Once its IP has leaked, the attacks keep coming. Generic anti-DDoS filtering has no idea how a FiveM client joins a server, so it either lets fake connections through or blocks real players.

02 / What I built

I built the whole platform from scratch as the only engineer, from the architecture to the filtering and the infrastructure. Players reach the game server through proxy nodes, so the real server IP is never published. A connect API behind a CDN relays the official FiveM join handshake to the server. When a join succeeds, the API adds the player's IP to the allowlist on the proxy assigned to them. Everything else gets dropped by an eBPF/XDP program written in Rust before it reaches the Linux network stack, while nftables forwards the accepted traffic to the server. Each protected server has its own port, the same on every proxy, which lets one fleet serve many customers. Rendezvous hashing spreads players across healthy proxies and handles failover without waiting on DNS. I also designed the server-side Lua resource that keeps the proxy list in sync and an edge cache for the heavy resource downloads. The same goes for protected access to the admin panel and for packet sampling inside the filter, which writes pcap incident files for upstream providers. The proxy fleet is deployed with Ansible and I set up the monitoring, with Grafana dashboards fed by the proxy agents.

03 / Impact

At peak the protected servers added up to more than 20,000 concurrent players. The origin stays hidden and fake joins or volumetric floods stop at the edge, while legit players connect through the normal FiveM flow without installing anything. I checked every design choice against the FiveM documentation and the FXServer source code.