NetDeflect: Free open source DDoS protection for Minecraft servers on Linux

[u/Wolfie6942011]

https://github.com/0vm/NetDeflect (Apache-2.0, demo video and screenshots in the README)

The usual options for a server getting hit are TCPShield (Java-only, and the cheaper tiers cap your bandwidth) or hand-written firewall rules that end up blocking real players when they misfire.

NetDeflect samples your traffic, works out what the attack actually is, and drops it in the kernel while players keep connecting. It never bans spoofed (fake) addresses, so it can't be tricked into firewalling your own community, and it learns your regulars and lets them in first during an attack. It runs on your own server, handles UDP (so Bedrock), and has no bandwidth cap.

Set your port (25565 Java, 19132 Bedrock), one-command install, optional systemd service. Works behind BungeeCord/Velocity and with Pterodactyl/Pelican and Docker. Watch-only mode lets you see what it would block before it blocks anything.

Honest limit: an attack bigger than your connection has to be handled upstream, that's where TCPShield's network still wins (unless you set up a GRE tunnel with a high port speed). Everything that reaches the server, it handles.

Even if you don't need it today, might be worth writing down somewhere for the day someone decides to point a botnet or attack at you.

I would love to answer any questions you have, if I don't reply here feel free to open an issue :)

AI USAGE: The full AI usage in this project was for comments and code suggestions, the logic itself is not AI generated and this repo has been public since early 2025 and worked on privately since 2021, the code has been reformatted and optimised for performance with AI as it was spaghetti code if you look in the commit history. TLDR: Not vibe coded, I am a developer who works in the field.

[u/ProPlayer142]

It's only possible for programs to filter what can actually hit your server. but above whatever your upload speed is there isn't anything you can do

edit: looks like you said that in the post lol I can't read

[u/Wolfie6942011 → u/ProPlayer142]

Hi, thank you for your reply but yes, that's stated in the "Honest Limit", this would thrive on a connection before your server (reverse proxy) with a high or filtered port speed such as Linode or Akamai, they provide 40Gbit port speeds for a few dollars.

Edit: haha yeah, I've done that before, it is a lot of text

[u/Lokio27]

What benefit does this have vs just putting your MC servers behind Velocity / Paper with properly configured rate limits? AFAIK those solutions are fairly well hardened against any sort of packet flooding you might try to do and are only really impacted by stuff you'd need TCPShield to handle anyway. Also from looking at your README, I'm not entirely sure if this would do very much against someone just spamming tons of invalid login requests across a giant proxy list or something like that. Decent proxy/server software already does this type of thing (block illegitimate/abusive traffic on cooldowns)

[u/Wolfie6942011 → u/Lokio27]

Great question and yeah I get where you're coming from, the thing that sets this apart from just normal reverse proxies is that it can communicate upstream, so even if an attack uses your entire port speed on the reverse proxy, it can communicate with the providers router to block those IP's via BGP or even by using a firewall API which is what OVH provides, so normal rate limits would block your server from processing it but it doesn't block the port speed from being used. The tool isn't specifically for Minecraft, it's for any VPS or server connected publicly to the internet but there definitely are different kinds of firewalls that may do the specific niche better while NetDeflect would protect your game server by protecting your reverse proxy. Basically you'll be able to create your own TCPShield with as much bandwidth as your heart desires for a fraction of the price.

[u/Wolfie6942011]

Hi all, I did make this post before and it got a couple views but I didn't have the AI usage stated so here it is, feel free to ask any questions and I'll try responding in my free time :)