FiveM-MiniMaps
Sign in
ddossecurityproxy11 min read · updated 9/11/2026

Protecting a FiveM server from DDoS attacks

Popular servers get attacked — by rivals, banned players or bored teenagers with a booter. A flood that saturates your connection cannot be fixed on the server itself; it has to be filtered before it reaches you. Your defence is a host that filters, an IP that is hard to find, and nothing unnecessary exposed.

Short answer: Host with a provider that offers game-aware DDoS filtering for UDP, expose only port 30120 (keep txAdmin and the database private), and hide the real IP: set sv_forceIndirectListing true plus sv_listingHostOverride pointing to an HTTPS proxy, and optionally a TCP/UDP stream proxy in front of the game port as described in Cfx.re’s proxy setup guide. During an attack, contact your host with timestamps rather than restarting repeatedly.

FiveM DDoS Protection: Hosting, Hiding Your IP and Proxy Setup

#Start with the host

Ask a host specifically about UDP game traffic: generic “DDoS protection” often only covers web traffic and drops or rate-limits game packets during an attack. Game-focused providers and some large VPS providers run filters tuned for game servers. Hosting options are compared in hosting options.

#Reduce what is exposed

  • Only 30120 TCP/UDP open to the world — see ports and firewall.
  • txAdmin (40120) limited to your IP or a VPN.
  • Database port closed; SSH/RDP limited to known IPs.
  • Websites, bots and panels on a different machine or behind a web proxy, so they do not leak the game IP.

#Hiding the server IP

By default the server list advertises your real IP. Cfx.re’s proxy setup puts an HTTPS “connect” proxy (for example nginx behind Cloudflare) in front of the TCP endpoint and tells the server list to use it:

server.cfg — from the official proxy setup
# do not advertise the real IP
set sv_forceIndirectListing true
# the server list uses this HTTPS host instead
set sv_listingHostOverride "server1.example.com"
# the proxy's IP, allowed to pass X-Real-IP
set sv_proxyIPRanges "100.64.1.1/32"
# where clients send game traffic (the server, or a stream proxy)
set sv_endpoints "100.64.1.2:30120"

Game traffic still goes to the address in sv_endpoints. To hide that too, run a raw TCP/UDP proxy (nginx stream module) on a filtered machine and put its address there. A caching proxy for /files/ can also take resource downloads off the game server.

#During an attack

  1. Note the start time and symptoms (everyone timing out, console still running).
  2. Contact your host with the timestamps; ask them to enable stricter filtering.
  3. Do not keep restarting — it does not stop traffic and annoys players.
  4. Tell your community on Discord; after it ends, review what exposed your IP.

#Application-level floods

Not every attack is bandwidth. Event spam from a cheating client is handled by FXServer’s built-in rate limiters and by validating events in your scripts; connection spam by net_tcpConnLimit (default 16 per IP). See secure server events.

Questions

How do I protect my FiveM server from DDoS?
Use a host with game-aware UDP filtering, expose only the game port, and hide your IP with sv_forceIndirectListing and a proxy.
Can Cloudflare protect my FiveM server?
Cloudflare can front the HTTPS connect endpoint, but its standard proxy does not carry FiveM’s UDP game traffic. You still need filtering for the game port.
How do I hide my FiveM server IP?
Set sv_forceIndirectListing true, point sv_listingHostOverride at an HTTPS proxy, and optionally send game traffic through a stream proxy via sv_endpoints.
Should I restart my server during an attack?
No. It does not stop the traffic; contact your host instead.

Ready to pick a map?

Twelve themes on three base map styles, $8 each, instant download.