Server Security & DDoS Hardening

A public 7 Days to Die server is exposed to two distinct threat surfaces: network-level attacks (port scans, UDP floods, brute-force on admin interfaces) and in-game griefing (offline raids, base destruction, claim bypass). This guide covers both — what to lock down at the firewall, what to harden in serverconfig.xml, and where mods or hosting-provider features matter.

Port Exposure: Open Only What's Needed

The four ports relevant to a 7D2D dedicated server, in order of who should reach them:

PortProtocolPropertyWho needs it
26900UDP (and TCP for some setups)ServerPortAll players. The game traffic port. Forward this and the few above it (the engine uses adjacent ports for game traffic).
8080TCP (HTTP)ControlPanelPortAdmins only. Disabled by default (ControlPanelEnabled=false); leave disabled unless you need it.
8081TCP (telnet)TelnetPortAdmins only. Plaintext protocol — never open to the internet.

Firewall checklist

  • Player ports (UDP 26900 + adjacent): open from anywhere. Players can't connect otherwise.
  • Control panel (8080): bind to 127.0.0.1 or whitelist your admin IP only. If the panel is enabled and exposed, it's an authentication endpoint someone will try to brute-force. Always change ControlPanelPassword from the default CHANGEME.
  • Telnet (8081): bind to 127.0.0.1 only. SSH-tunnel for remote admin work. Set TelnetPassword in serverconfig.xml — TelnetFailedLoginLimit (default 10) and TelnetFailedLoginsBlocktime (default 10 seconds) provide weak rate-limiting; supplement with firewall rules.
  • SSH (22): if you SSH to the box, allow only key-based auth and either bind to a non-standard port or restrict by source IP. Brute-forces on 22 are constant.

Admin Interface Hardening (serverconfig.xml)

All defaults below are taken from our serverconfig.xml reference.

PropertyDefaultHardening recommendation
ControlPanelEnabledfalseLeave false. Only flip to true if you actively use the panel; bind 8080 to localhost in that case.
ControlPanelPasswordCHANGEMEChange to a long random string before exposing the panel. The default is the single most-tried password in opportunistic scans.
TelnetEnabled—Disable if you don't use telnet/scripting. If enabled, keep behind a firewall.
TelnetPassword(empty)Always set a password. An empty password permits passwordless connection from anything reaching the port.
TelnetFailedLoginLimit10Wrong-password attempts before the source IP is blocked.
TelnetFailedLoginsBlocktime10Block duration in seconds. Short — supplement with firewall rules for sustained protection.
HideCommandExecutionLog00=show everything; 1=hide from telnet/panel; 2=also hide from remote game clients; 3=hide everything. Set to 2 or 3 if you don't want admin commands echoed in the in-game log.

In-Game Anti-Grief Settings

The land-claim system is the primary anti-grief lever. The actual property names and their defaults:

PropertyDefaultEffect
LandClaimCount1Maximum keystones per player. Raise to 2–3 for PvE servers where players want a horde base + a stash base; keep at 1 for PvP to discourage spread.
LandClaimSize41Side length (in blocks) of the protected box around a keystone.
LandClaimDeadZone30Minimum block distance between two players' keystones (unless friended). Prevents claim-overlap griefing.
LandClaimExpiryTime7Days a player can be offline before their claim's protection expires.
LandClaimDecayMode00 = slow linear decay, 1 = fast exponential, 2 = none (full protection until full expiry). Set to 2 if your players take vacations from the server.
LandClaimOnlineDurabilityModifier4Block-hardness multiplier inside the claim while the owner is online. Default 4×. 0 means infinite (indestructible). Raise (e.g. 8) for tougher PvP bases; do not raise to absurd values like 40× — players will rage when they can't break through obvious griefing structures.
LandClaimOfflineDurabilityModifier4Same multiplier while the owner is offline. Raise to mitigate offline raids on PvP servers; set to 0 for "offline = invincible base."
LandClaimOfflineDelay0Minutes after logout before the offline modifier kicks in. Set to 5–15 to prevent a player from logging out mid-fight to gain offline protection.
BedrollDeadZoneSize15Box "radius" of the no-zombie-spawn zone around a bedroll. Prevents zombie spawns from invading bedrooms but doesn't stop other players in PvP.

Mod / panel-side anti-grief

  • CSMM (CatalysmsServerManager / 7D2D Server Manager) exposes per-region "no-build" / "no-PvP" zones, kill-event tracking, and admin-action audit logs that vanilla doesn't.
  • Server Tools / Allocs Fixes mods (community-maintained) add region-protection, command throttling, and improved logging hooks. Verify each mod is updated for V2.6 before installing.

DDoS Realities

For game servers, the threats you actually see in the wild are network-level UDP floods, not application-layer attacks. The relevant terms:

  • Volumetric (L3/L4) flood — the attacker sends enough UDP packets to your IP to saturate the host or upstream link. This is what hits port 26900 (the player port) most often. The only effective mitigation is upstream scrubbing: a hosting provider with DDoS protection at the network edge, or a service like Cosmic Guard, OVH Anti-DDoS, Path.net, etc.
  • Reflection/amplification — attackers spoof your IP as the source of queries to public reflection services. Same upstream-scrubbing mitigation applies; nothing in the game config helps.
  • Application-layer (L7) — relevant for the web control panel if exposed. Real but rare for 7D2D specifically because the panel isn't usually internet-facing.

Practical takeaway: if uptime under attack matters, pay for a hosting provider with built-in network DDoS scrubbing. Self-hosted on a residential or basic VPS, you can't out-config a flood.

Hardening Checklist

  1. Change ControlPanelPassword from CHANGEME.
  2. Set a strong TelnetPassword; bind 8081 to 127.0.0.1.
  3. Disable ControlPanelEnabled if you don't actively use it.
  4. Restrict admin ports (8080, 8081, 22) at the firewall — admin IPs only.
  5. Curate serveradmin.xml — no test accounts left at permission level 0.
  6. Tune land-claim modifiers to your community's PvP/PvE intent (4× online/offline are sane defaults).
  7. Pick a hosting provider with network-level DDoS scrubbing if uptime under attack matters.
  8. Run shutdown, never kill -9 — corrupted saves are a security risk too (forced re-rolls).