L4. If you are hosting an L2 server, simply use the #19 rule to block all ipv4 and allow only the LS/GS ports open on TCP only. Only allow SSH connection on your home subnet like 10.11.0.0/16, or /32 on a single static ip or VPN. So you only have, let's say, those 2 ports open (3rd port SSH only for you) and you don't need to overwhelm your linux with rules (only TCP rules, since that's all you need). The #19 rule will block any other protocol.
You can start by solving a bug at ovh's firewall. One rule to drop connection if it's not SYN and the other one to block invalid packets. You can use the PREROUTING/mangle table/etc to save resources.
Overall, your rules can only get better in time and don't add a rule from the internet for the sake of adding it "just in case".
You could use SYNPROXY with some performance drops in return.
It needs to be carefully implemented not to drop active connections unexpectedly. This should help the most for all SYN attacks.
Tweak the kernel to support more connections and end connections faster.
Most important. Be ready to capture traffic like Wireshark does. So while you are under DDoS, try to run the linux command to capture traffic so you can analyze it and know for sure the attack type/trick used. This helps you the most to create the needed rules in iptables or whatever you are using on your linux. OR you can even send the capture to OVH to adjust the firewall on their side based on your needs.
You need someone to understand how TCP works/TCP flags, basically Layer 7 stuff to be able to read the capture for you if you are not familiar.
You can also buy multiple proxies, protected or not - even better if so, limit the incoming connections so it rather freezes than forwarding DDoS to your main server. AND block from the main server any connections except those new ones thru the proxy IPs. Allow established conns. They may get you 1 or 2 of them down, but not all and your players/main server won't even be affected. I did something similar a long time ago, I forgot most of the details.
You can also have a plan B on ovh's firewall. If you are under DDoS and wanna stop the lag in-game. / Connections to reach your server. Simply add a rule on top to allow established connections and block all ipv4 connections after. So you won't accept any new connections, but players in game won't experience any lag at all, other players won't be able to log in either during that time, until you revert it.
I recommend you all reading and learning about the following:
Linux kernel the network part
Iptables in general
Iptables procession (like the flowchart)
Network in general, most important Layer 7/TCP.
Packet capturing with Wireshark.
You can't be the owner of a server and not know how to handle this nowadays.
People, don't pm me about this, I'm not helping strangers, dosen't matter how much you pay for.
There are, of course, many ways and tricks you can use. I just shared above the most straight- forward ones.
from my Phone.