What Happens When Your Rust Server Is Attacked

Rust servers use several ports at once: the game port, the Steam query port, RCON and the Rust+ companion app. VibeSHIELD, the DDoS protection network built into every VibeGAMES server, has a filter for each of them. Here is what happens when your Rust server comes under attack and where you can follow it.

1What VibeSHIELD Does for Your Rust Server

• A RakNet filter protects the game port UDP 28015. Rust talks RakNet, and packets that do not follow that protocol are dropped before they reach the server.
• An A2S query cache sits on the query port. Steam server-list queries are answered from the VibeSHIELD edge, so a flood of fake queries never reaches your server and your listing stays visible.
• A TCP filter covers the RCON port 28016 and the Rust+ app port 28082.
• All of this is applied at the point of presence nearest to the traffic source. Only clean traffic travels on to your server. There is nothing to enable or configure.

2What Players Notice

• Usually nothing.
• In a very large attack there can be a few seconds of higher ping or packet loss while the filtering ramps up.
• A server that has gone offline is almost never offline because of the attack. Check the console in the game panel first. A plugin crash, running out of memory or a wrong port are the usual causes.

3Where to See the Attack

• Open the website dashboard, click your Rust server and go to the DDoS protection tab.
• The tab is in the website dashboard at vibegames.com, not in the game panel at game.vibegames.com.
• Status reads Active and Attack status reads Not under attack or Under attack.
• The Attack history table lists the attacks of the last 30 days: ID, peak size in Mbps or Gbps, start time and stop time.
• Expand a row for the breakdown: a traffic chart, source countries, source networks (ASN), source ports, destination ports, protocol, TTL and packet sizes.

4The Email You Receive

• Your account email receives a message with the subject DDoS attack detected on your server <ip> when an attack targets your server's port.
• It states that VibeSHIELD is filtering the traffic and that no action is needed on your side.
• The IP in the subject is shared by several servers on the node. The attack is linked to your server through the attacked port.

5What to Do

• Let VibeSHIELD do its work. There is no button to press.
• Never share your server IP with someone who threatens you, and never pay anyone who promises to stop an attack.
• Leave the ports as they are. Changing them does not help against attacks.
• A move to another location is not needed. Every location is behind the same network.
• If players report problems during an attack, open a ticket with the attack ID from the history table.

Good to Know

• The query cache keeps your server in the list. Because A2S queries are answered at the edge, a query flood does not stop Steam from showing your server.
• RCON and Rust+ keep working. Both ports have their own filter, so you can still use RCON tools and the companion app during an attack.
• Read more. See how VibeSHIELD protects your game server for the network as a whole.