Skip to main content

Need a powerful server for your projects?

Discover our offers

Anti-DDoS: which port to use, messages to ignore, bandwidth

The anti-DDoS protection (Gcore) is always active and included on our game servers and VPS: there is nothing to enable and nothing extra to pay. It applies different rules depending on the port range used. This page answers the most frequent questions; the general overview is in Anti-DDoS protection.

Which port range should I use?​

What you hostRange to useProtocols
Minecraft (Java, Velocity / BungeeCord proxy)26000 - 26999TCP and UDP
Any other game or service (Nova-Life, voice chat server…)25000 - 25999TCP and UDP
FiveM30000 - 30200 (game), 40000 - 40200 (txAdmin)see Anti-DDoS protection
26000 - 26999 = Minecraft only

The 26000 - 26999 range goes through a Minecraft-specific filter. Another game or service placed on these ports (for example a Nova-Life server or a voice server) gets its connections blocked. Move it to a port in the 25000 - 25999 range, in TCP and UDP, then restart it.

These rules also apply to VPS IPs: on a VPS you choose your ports, but a non-Minecraft server must avoid 26000 - 26999. Conversely, a Minecraft server exposed outside this range (for example on the default port 25565) only gets generic filtering, which is less effective against Minecraft attacks (connection floods, bots).

On a game server offer, the allocated ports are already in the right range. If you need to change them, open a ticket.

Minecraft on a VPS with a proxy (Velocity)​

  • Make the proxy listen on a port in the 26000 - 26999 range, for example bind = "0.0.0.0:26565" in velocity.toml.
  • The servers behind the proxy (lobby, survival…) must not be publicly exposed: make them listen on 127.0.0.1 (or a private IP if they are on another machine).
  • A voice chat server is not Minecraft traffic: put it in the 25000 - 25999 range.

The proxy connects to the lobby, then "read timed out"​

If Velocity (or another Minecraft proxy) is blocked, or shows lobby has connected and then read timed out after 30 seconds while forwarding and the secret are correct, the Minecraft filtering of the 26000 - 26999 range is the cause: move the proxy to a port in the 25000 - 25999 range (TCP and UDP), for example bind = "0.0.0.0:25577", then restart it. On a game server offer, open a ticket to get a port in that range.

Minecraft server at YorkHost, proxy at another host​

Same symptom when your server (Paper, Spigot…) is hosted at YorkHost and your Velocity / BungeeCord proxy is hosted elsewhere: the proxy connects, then fails with ReadTimeoutException / read timed out after 30 to 45 seconds. Your server's port, the one the proxy connects to, must be in the 25000 - 25999 range. On a game server offer, ask support (ticket or assistant) for this port change: the primary port moves to 25000 - 25999, then you restart the server and update the ip:port address in your proxy configuration (velocity.toml, [servers] section). Your files, worlds and plugins are kept.

Messages to ignore​

These messages are caused by the anti-DDoS protection, which blocks some check requests. They have no impact as long as players can connect:

  • FiveM, in the console: Server list query returned an error: Cfx failed to reach the server at …;
  • FiveM, from outside: /info.json or /dynamic.json answer Empty reply from server.

If, on the other hand, players cannot connect, it is a different problem (port, server.cfg…): see Connecting to the server.

Slow speedtest, bandwidth​

  • A speedtest run from a VPS is not representative: filtering can slow down some test tools. Judge on real use instead (downloads, hosted service).
  • VPS are connected at 1 Gbit/s or 10 Gbit/s depending on the offer.
  • Sustained high bandwidth (several Gbit/s permanently, for example for streaming) is not covered by a standard offer: it requires a network offer on quotation, whose price depends on where the traffic goes. Contact support with your use case and where your users are.

Protecting a service hosted elsewhere: IP tunnels​

To protect infrastructure hosted outside YorkHost, we offer protected IP tunnels, available at clients.yorkhost.fr/cart/tunnel-ip/. If you only need to link machines together, a VXLAN or EoIP tunnel is possible: ask support. Stormwall protection is no longer offered.