Enhancing Game Server Security with WireGuard VPN: Connecting Two Servers

Introduction

In today’s world of online gaming, maintaining server uptime and securing sensitive player data is essential. Game servers are frequent targets of cyberattacks, particularly Distributed Denial of Service (DDoS) attacks. Ensuring the security and efficiency of these servers while offering smooth gameplay is a challenge many administrators face. This blog discusses the use of WireGuard VPN to connect a game server hosted in Singapore with a VPN server located in Mumbai to enhance security and mitigate risks. We’ll explore how traffic is routed, the security benefits, and potential solutions to make your game server more resilient.

Server Setup Overview

In this setup, a game server is hosted in Singapore and directly accessible via its public IP. To secure communication and potentially mitigate DDoS attacks, the game server is connected to a Mumbai server through WireGuard VPN.

Key Configuration:

• Singapore Server Public IP: 203.123.45.67
• Mumbai Server Public IP: 182.98.76.54
• WireGuard Private IPs: The servers communicate using internal VPN IPs, with the Singapore server using 10.10.88.10 and the Mumbai server using 10.10.88.20.

How Traffic is Routed

1. Player Connection:
   • Players connect to the game server using the Singapore server’s public IP (203.123.45.67).
   • The game server is responsible for handling player requests directly via the public internet.
2. Server-to-Server Communication:
   • The Singapore and Mumbai servers communicate via the WireGuard VPN using their private IPs (10.10.88.10 and 10.10.88.20).
   • Any data exchanged between the servers, such as logs, backups, or monitoring, is encrypted and transferred securely via this VPN tunnel.

Pros of This Setup

1. Enhanced Security

By establishing a VPN connection between the Singapore and Mumbai servers, you are creating a secure, encrypted communication tunnel. This helps in ensuring that sensitive server-to-server traffic (like administrative controls, database access, or backups) remains protected from external threats, reducing the attack surface.

2. DDoS Mitigation via VPN Routing

If configured properly, the Mumbai server can act as a proxy to route traffic to the Singapore server. This means that if a DDoS attack targets your Singapore server, the Mumbai server can filter or block suspicious traffic before it overwhelms the game server. If the Mumbai server has DDoS protection or additional firewall controls, it can mitigate the risk before the traffic even reaches Singapore.

3. Simplified Traffic Monitoring and Access Control

Having a WireGuard VPN between the servers allows the Mumbai server to monitor incoming connections to the Singapore server. This makes it easier to track traffic, detect abnormal behavior, and respond to potential threats quickly. In addition, you can restrict server access by limiting which IP addresses are allowed to communicate with the Singapore server through the VPN, tightening security.

Cons of This Setup

1. Public IP Exposure

Despite the VPN connection, the Singapore server is still directly exposed to the public internet through its public IP address. This makes it vulnerable to DDoS attacks and other network-based threats. While VPN routing helps with server-to-server security, public access to the game server remains a weak point.

2. Increased Latency

Introducing a VPN between the Singapore and Mumbai servers can increase latency for server-to-server communication. For game servers, minimizing latency is crucial for ensuring smooth gameplay. The extra routing layer may slow down some operations, especially if the Mumbai server is used as an intermediary for players’ traffic.

3. VPN Overhead

Maintaining a VPN introduces additional complexity and resource overhead. The WireGuard VPN, while lightweight, still consumes CPU and bandwidth. If traffic between the servers becomes heavy, the VPN could become a bottleneck.

Solutions for Optimization

1. Route All Player Traffic Through the VPN

To secure the entire connection, you can route all player traffic through the VPN. In this scenario, players connect to the Mumbai server, which proxies their connections to the Singapore server. This approach reduces direct exposure of the Singapore server’s public IP and makes the Mumbai server the first point of contact.

Steps:

• Set up Mumbai VPN as the primary point of connection for players.
• Forward game traffic from Mumbai to Singapore via the VPN.
• Apply DDoS protection on the Mumbai server to mitigate attacks before traffic reaches the game server.

2. Use Firewall Rules to Limit Public Access

You can restrict access to specific ports on the Singapore server (such as the FiveM game port or txAdmin port) by applying strict firewall rules. These rules should ensure that only trusted IPs (like the Mumbai server or your own) can access critical services.

Steps:

• On the Singapore server, block all unnecessary public ports.
• Allow game traffic and administrative access (e.g., txAdmin) only via VPN or trusted IPs.
• Use iptables or a cloud-based firewall to limit public traffic.

3. Implement Intrusion Detection and DDoS Prevention

To further enhance security, deploy an Intrusion Detection System (IDS) on the Mumbai or Singapore server to detect suspicious activity. Additionally, ensure that DDoS prevention measures, such as rate limiting, are in place on both servers to avoid excessive traffic from overwhelming the infrastructure.

Conclusion

By connecting your Singapore game server to a Mumbai server using WireGuard VPN, you can significantly enhance security and improve control over traffic. However, the direct exposure of the Singapore server remains a point of vulnerability. By carefully balancing public access and VPN routing, along with firewall rules and DDoS protection, you can achieve a more secure and resilient game server environment.

While this setup introduces some overhead and complexity, the trade-off is a safer server infrastructure that offers better protection from cyber threats, especially DDoS attacks. Consider fine-tuning your VPN routing strategy to ensure both performance and security are maintained at optimal levels.