Solutions / Game Servers / Source Engine
Source Engine DDoS Protection
CS2, TF2, and Garry's Mod servers protected at the edge, with A2S query floods answered from cache so server browsers keep working mid-attack.
How Source Engine Servers Are Protected
A2S Floods
A2S_INFO and A2S_PLAYERS floods are a favorite cheap attack on Source servers. The edge answers them from cache, so they cost your box nothing. How query caching works.
Game Traffic
Gameplay on 27015 is filtered with protocol-aware profiles across TCP and UDP, keeping tick stable through volumetric attacks.
Visibility Mid-Attack
Because queries are answered upstream, your server stays listed and joinable in browsers even while a flood is being absorbed. Players find you; the flood does not.
Setup in Practice
Change the address in your server config and point players at the protected IP; 27015 is filtered across TCP and UDP with profiles tuned for Source. A2S answers come from edge cache at every site, which is why your listing stays live even while a flood is being absorbed.
Host It on the Edge
Or skip the forwarding hop entirely: run the server on Sentry Compute and it lives behind its anycast address inside the perimeter, with the same filtering in front and nothing public between the edge and the game.
Keep Exploring
All Game Servers
Every supported game, the three-step setup, and the built-in extras.
Game Query Caching
How A2S answers are served from the edge at every site.
Sentry Compute
Host the server on the protected edge instead of forwarding to it.
Getting Started
Account to protected traffic in about fifteen minutes.
Frequently Asked Questions
How does Gateway Sentry handle A2S query floods?
Keep the Server Up
Provision a protected IP and point your record at it; setup takes minutes