How to protect your MU Online server against DDoS

DDoS attacks against MU Online servers are a common reality for servers that grow beyond a small friend group. Understanding the threat and implementing layered protection before you're attacked is the only effective strategy.

Why MU servers are targeted

THE THREAT LANDSCAPE:

COMPETITION BETWEEN ADMINS:
→ MU Online private servers compete for the same player base
→ Taking down a rival server for 24-48 hours can drive their players to join yours
→ This is the most common motivation and can be sustained over weeks
→ Cost for attacker: $5-50/hour for a basic attack (very low barrier)

BANNED PLAYER REVENGE:
→ Players who were banned for cheating, rule violations, or drama
→ Motivation: emotional retaliation
→ Attack may be brief (hours) or sustained (days)
→ The attacker usually announces themselves — compare your ban log to attack timing

EXTORTION:
→ "Pay X amount or I'll keep attacking"
→ More common on servers with active donation systems
→ Never pay — it confirms you're a profitable target and attacks continue
→ Document and report to hosting provider

THE MATH OF THE PROBLEM:
→ A basic 5 Gbps attack costs ~$10-30/hour on attack services
→ A VPS with no DDoS protection goes offline at ~1 Gbps
→ An unprotected server is extremely cheap to attack indefinitely
→ Investment in protection fundamentally changes this equation

Types of attacks used against MU servers

ATTACK TYPES:

1. VOLUMETRIC FLOOD (most common):
   → Sends massive UDP or ICMP packets to saturate the network pipe
   → The datacenter's connection is overwhelmed before traffic reaches the server
   → The server goes offline not because it crashed, but because its pipe is full
   → Mitigation: hosting with upstream scrubbing capacity (20+ Gbps absorption)

2. SYN FLOOD:
   → Sends thousands of TCP SYN packets (connection requests) to the server ports
   → Server allocates resources for each half-open connection
   → Resources exhaust → new legitimate connections can't be established
   → Mitigation: SYN cookies (Windows handles this), connection rate limits

3. DNS/NTP AMPLIFICATION:
   → Attacker spoofs your IP and sends requests to public DNS/NTP servers
   → Those servers send large responses to YOUR IP (amplification up to 100x)
   → Mitigation: handled by the hosting provider's network, not your server

4. APPLICATION LAYER / HTTP FLOOD:
   → Sends thousands of HTTP requests to your website
   → Exhausts PHP/Apache resources without saturating bandwidth
   → Appears like legitimate traffic — harder to filter
   → Mitigation: Cloudflare (free tier is very effective for website protection)

Layer 1: Hiding the real IP

WHY IP PROTECTION IS FIRST:

If attackers don't know your IP: attacks can't reach you.
Once they know it: the IP is effectively public in attacker communities.
Protect BEFORE being attacked — changing IPs after is very disruptive.

HOW ATTACKERS DISCOVER YOUR IP:

A) THROUGH THE WEBSITE:
→ If www.yourserver.com is on the same IP as the game VPS:
  ping www.yourserver.com → reveals game server IP
→ Solution: put the website on SEPARATE hosting (Linux shared hosting)
  The website's IP is unrelated to the game VPS IP

B) THROUGH DNS:
→ If play.yourserver.com points directly to the VPS: nslookup reveals it
→ Solution: don't create public DNS records that point to the game VPS IP
  Use the raw IP in the game client, or use a proxy that hides the real IP

C) THROUGH THE GAME CLIENT:
→ Wireshark analysis of client traffic shows: Client → [ConnectServer IP]
→ Any player can capture this
→ Solution: a traffic proxy — players connect to the proxy IP, not the real VPS

D) ONCE YOUR IP IS KNOWN:
→ It circulates in attacker communities and in DDoS-for-hire logs
→ The only full solution is an IP change (disruptive — requires client updates)
→ Future: use a proxy so the game VPS IP never needs to be public

Layer 2: Anti-DDoS hosting

CHOOSING HOSTING WITH REAL PROTECTION:

WHAT "ANTI-DDOS INCLUDED" ACTUALLY MEANS:
→ Most cheap VPS providers say they have "DDoS protection"
→ In reality, protection ranges from 1 Gbps (useless against modern attacks) to 1+ Tbps

QUESTIONS TO ASK THE PROVIDER:
→ "How many Gbps of DDoS can your included protection absorb?"
→ "Do you null-route my IP during an attack or actively mitigate it?"
   (Null-routing = your IP goes offline. Active mitigation = filtering happens transparently)
→ "How long does mitigation take to kick in after attack starts?"
→ "Do you have datacenter capacity in or near [your players' region]?"

PROTECTION TIERS IN PRACTICE:
→ NO PROTECTION: basic VPS providers — your IP goes offline at ~1 Gbps
→ BASIC MITIGATION (20-100 Gbps): OVH, Hetzner, Vultr — good for most private servers
→ ADVANCED MITIGATION (100 Gbps+): Psychz, Path.net — for servers under frequent attacks
→ ENTERPRISE (1 Tbps+): Cloudflare Magic Transit — for large operations

FOR MOST MU PRIVATE SERVERS:
→ OVH or Kimsufi (their budget brand) have excellent DDoS protection included
→ Hetzner (European-based, good protection, good price)
→ Vultr also has decent included mitigation
→ All three are generally better than most specialized "game hosting" providers

Layer 3: Windows Firewall hardening

WINDOWS FIREWALL CONFIGURATION:

PRINCIPLE: CLOSE EVERYTHING NOT NEEDED

PORTS THAT SHOULD BE OPEN (inbound):
→ TCP 44405: ConnectServer (players connect here)
→ TCP 55901: GameServer (game traffic)
→ TCP 80/443: Website (if on the same VPS)
→ TCP [your-rdp-port]: RDP — restrict to YOUR IP ONLY

PORTS THAT MUST STAY CLOSED TO INTERNET:
→ TCP 1433: SQL Server — NEVER open to internet
→ UDP 1434: SQL Server Browser — NEVER open (amplification attack vector)
→ TCP 3306: MySQL — NEVER open to internet
→ TCP 3389: Default RDP port — change to a different port

CHANGE RDP PORT:
→ Attackers scan 3389 constantly with brute-force bots
→ regedit → HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
→ PortNumber → change from 3389 to something like 47899 (decimal)
→ Create firewall rule for new port → block 3389

RESTRICT RDP TO YOUR IP:
→ Windows Defender Firewall → Inbound Rules → Remote Desktop (TCP-In)
→ Properties → Scope → Remote IP → "These IP addresses" → add your home/office IP
→ Now only your IP can connect via RDP

Behavior during an active attack

ATTACK RESPONSE PROTOCOL:

FIRST MINUTES:
1. Identify it as an attack (sudden traffic spike, server goes offline)
2. Contact your provider's support immediately:
   "My server at IP X.X.X.X is under DDoS attack since HH:MM. Please assist."
3. If your provider has a DDoS mitigation panel: activate it now

WHILE THE ATTACK IS ONGOING:
→ DON'T announce your server's current IP to players
   (attackers monitor Discord/Telegram to confirm they hit the right target)
→ DON'T try to "counter-attack" — illegal and counterproductive
→ DO communicate transparently to your community:
   "Server is under a DDoS attack. Our team is working on mitigation.
    We expect to be back online within [time estimate]. Thanks for your patience."
→ Transparency builds loyalty — players who see you handling it professionally tend to stay

AFTER THE ATTACK:
→ Review firewall logs to understand what traffic pattern was used
→ Evaluate: did the hosting's mitigation work? If not, consider migrating to better hosting
→ If you suspect who attacked: document, don't retaliate
→ Consider an IP change if the current IP is now compromised in attack databases

Pair this guide with the network configuration tutorial (for setting up the correct Windows Firewall rules for server ports), the VPS connection tutorial (for securing RDP access), and the server anti-hack tutorial (for protecting against intrusions rather than availability attacks).

Frequently asked questions