I am going to make a game server which involves port forwarding, I also heard that people can DDoS attack. When they DDoS attack, what is it that they attack, the internet or the computer? Also, what is a DDoS attack anyway? How can I protect against them?
closed as too broad by forest, Xiong Chiamiov, Steffen Ullrich, Xander, schroeder♦ Mar 10 '18 at 19:57
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
In normal TCP communications, your server* is quietly listening on the network, expecting packets with the SYN flag set. These SYN packets come from clients initiating a request to open a new socket connection. The server makes note of the open connection request, saves the source IP address of the sender (which is contained inside the packet), and sends a response containing both the SYN and ACK flags set back to the source IP address. When the client receives the SYN/ACK packet, it responds with an ACK packet. When your server receives the ACK, the socket is fully connected and the applications can start sending data to each other.
A Distributed Denial of Service (DDoS) attack is a network-based attack, where dozens or thousands of hacked computers are running malware that sends thousands or millions requests every second to the open port on your network. A SYN Flood attack is where the malware sends only SYN packets. The hacked computers write a random address in each packet as the source IP address. Your server doesn't know they're not valid addresses, so it just tries to reply to them.
But the attacking computers are running malicious code. They never get the response (which your server politely sent to the random source address), and they never send the ACK packet your server is waiting for. This leaves the partially open socket just laying around in your server's memory, waiting for the request to complete. Your server has only a finite capacity as to how many partially open sockets it can keep around; and only a finite amount of time to respond to them. It cannot handle a queue of a million half-open sockets.
But since your server trusts that all socket requests are coming from legitimate users, it tries its best to respond to them all, because that's what it's supposed to do. It quickly fills up under the flood of traffic. If you're lucky, it sends RST packets back to everyone trying to connect once the queue is full, politely denying them service. If you're unlucky, your network card or server chokes on the overload and crashes. Either way, your legitimate users are caught in the flood, and can't get to your server, either -- thus they are "denied service" (hence the name).
Unfortunately, there is very little that you as a server owner can do about a DDoS attack. The packets all come from random addresses, and don't contain the actual IP address of the computer that sent them, so there's no easy way to follow them back to the attackers. With enough money, you can hire a company to help keep your site up through various hosting and network tricks. And there are network appliances that make an attempt to identify and exclude SYN flood packets. But even they have their limits, as Brian Krebs found out a few weeks ago.
* I wrote server to keep the description simple, but this attack will flood any network device that is listening on that port. If you're using a typical home router and port forwarding to your server, the router's more limited memory will be flooded, and the router will likely crash before your server does.