Which DDoS-protected dedicated server actually stays online?

OVHcloud has sold its anti-DDoS as a core feature for over a decade, and it shows in the details. Protection is on by default across every product, with no surcharge regardless of attack volume. Detection runs constantly, mitigation starts within seconds and stays on for the whole attack. It's also the only host here that publishes a filtering capacity: several Tbps across its global network.

The first line is the Edge Network Firewall. You get up to 20 rules per IP address to drop everything except your useful ports before traffic ever reaches the box. Two catches. It handles IPv4 only. And it drops QUIC traffic at the edge no matter how you configure it, which means no HTTP/3 for a site behind it. During an attack it switches on by force, even if you left it off.

For gaming, the Game range adds a layer 7 firewall that understands the protocols of 35+ games. It's included, but you enable it IP by IP. Games without a profile, like FiveM, stay poorly covered: on OVHcloud's own community forum, an admin reports an 80 Mbps attack was enough to knock his server down, and the ticket took four days to get an answer. In the US, the RISE line is often flagged "Coming Soon", so check stock before you plan a migration.

Hetzner protects every customer against DDoS for free and says the protection didn't push its prices up. Filtering runs on Arbor and Juniper hardware. It automatically spots attack patterns by volume, packet count, and type, and scrubs the usual suspects: DNS and NTP reflection, UDP floods, SYN floods, invalid packets. Hetzner's own wording is careful: it recognizes "almost all" patterns, and legitimate traffic is "usually" unaffected.

What's missing: no capacity figure and nothing on layer 7. On LowEndSpirit, a long-time customer sums it up: Hetzner itself calls the protection basic, fine for everyday use. Another user reports it can take up to five minutes to kick in on a game server. With Cloudflare in front of a website, you barely notice. On a UDP game server, every player gets kicked.

The Robot firewall is basic: stateless, 10 rules max per direction, IPv4 by default. Classic trap: enable it with no rules and it blocks everything, and TCP replies need an explicit ACK rule. Prices are in euros only, even on the English site: €59 a month excluding VAT for the AX41, with zero setup fee and unlimited traffic.

IONOS bundles "DDoS protection and advanced firewall security" with every dedicated server, according to its US product page. Its technical documentation describes a basic tier, on by default, focused on layers 3 and 4: always-on detection and automatic containment of UDP and SYN floods. For layer 7, the docs point you to a CDN. An advanced tier adds 24/7 expert support, alerts, and reports, with no public price.

No filtering capacity is published, so you can't compare IONOS with OVHcloud on raw numbers. Its edge is the people: phone, chat, and email support, which matters more than theoretical Tbps for a team without a sysadmin.

Extra IPv4 addresses cost $5 a month each, worth knowing if you plan to rotate an IP after a leak. The server price appears once you configure it, so compare it against month one at OVHcloud and Hetzner.

Kimsufi is OVHcloud's entry line and rides the same anti-DDoS network, included like on every OVHcloud product. The difference is the first line of defense: OVHcloud's docs warn the Edge Network Firewall may be unavailable or limited on Eco servers, Kimsufi included. You filter ports with your OS firewall (iptables or nftables) instead.

Field reports on LowEndTalk describe mitigation that triggers after detection, with a brief connection drop when it turns on. For a blog or a backup box, that's harmless. For a public game server, every trigger disconnects everyone.

Stock is the other limit: the cheapest models often show as unavailable. At $11.10 a month for the KS-B, it's still the cheapest way to get a whole machine behind OVHcloud's network.