# Protecting a FiveM server from DDoS attacks

> Defend a FiveM server against DDoS: a host with game-aware filtering, keeping txAdmin private, hiding the server IP and responding to an attack.

Source: https://fam-tools.com/guides/fivem-ddos-protection · FAM Tools · published 2026-09-11 · updated 2026-09-11 · about 11 min

**Short answer.** Host with a provider that offers game-aware DDoS filtering for UDP, expose only port 30120 (keep txAdmin and the database private), and hide the real IP: `set sv_forceIndirectListing true` plus `sv_listingHostOverride` pointing to an HTTPS proxy, and optionally a TCP/UDP stream proxy in front of the game port as described in Cfx.re’s proxy setup guide. During an attack, contact your host with timestamps rather than restarting repeatedly.

## Key points

- Filtering must happen upstream — pick the host for it.
- Only 30120 public; txAdmin restricted; 3306 closed.
- `sv_forceIndirectListing true` stops advertising the real IP.
- A connect proxy + stream proxy can hide the origin completely.
- Web DNS proxies like Cloudflare do not carry FiveM’s UDP game traffic on their free plan.

Popular servers get attacked — by rivals, banned players or bored teenagers with a booter. A flood that saturates your connection cannot be fixed on the server itself; it has to be filtered before it reaches you. Your defence is a host that filters, an IP that is hard to find, and nothing unnecessary exposed.

## Start with the host

Ask a host specifically about UDP game traffic: generic “DDoS protection” often only covers web traffic and drops or rate-limits game packets during an attack. Game-focused providers and some large VPS providers run filters tuned for game servers. Hosting options are compared in [hosting options](https://fam-tools.com/guides/fivem-server-hosting-options).

## Reduce what is exposed

- Only 30120 TCP/UDP open to the world — see [ports and firewall](https://fam-tools.com/guides/fivem-server-ports-firewall).
- txAdmin (40120) limited to your IP or a VPN.
- Database port closed; SSH/RDP limited to known IPs.
- Websites, bots and panels on a different machine or behind a web proxy, so they do not leak the game IP.

## Hiding the server IP

By default the server list advertises your real IP. Cfx.re’s proxy setup puts an HTTPS “connect” proxy (for example nginx behind Cloudflare) in front of the TCP endpoint and tells the server list to use it:

*server.cfg — from the official proxy setup*

```cfg
# do not advertise the real IP
set sv_forceIndirectListing true
# the server list uses this HTTPS host instead
set sv_listingHostOverride "server1.example.com"
# the proxy's IP, allowed to pass X-Real-IP
set sv_proxyIPRanges "100.64.1.1/32"
# where clients send game traffic (the server, or a stream proxy)
set sv_endpoints "100.64.1.2:30120"
```

Game traffic still goes to the address in `sv_endpoints`. To hide that too, run a raw TCP/UDP proxy (nginx `stream` module) on a filtered machine and put its address there. A caching proxy for `/files/` can also take resource downloads off the game server.

> **Connecting through a proxy** — With a connect proxy, players use the server list or `connect "https://server1.example.com/"`; a bare domain in the `connect` command is not looked up as a URL.

## During an attack

1. Note the start time and symptoms (everyone timing out, console still running).
2. Contact your host with the timestamps; ask them to enable stricter filtering.
3. Do not keep restarting — it does not stop traffic and annoys players.
4. Tell your community on Discord; after it ends, review what exposed your IP.

## Application-level floods

Not every attack is bandwidth. Event spam from a cheating client is handled by FXServer’s built-in rate limiters and by validating events in your scripts; connection spam by `net_tcpConnLimit` (default 16 per IP). See [secure server events](https://pityus.net/guides/fivem-secure-server-events).

## Questions

### How do I protect my FiveM server from DDoS?

Use a host with game-aware UDP filtering, expose only the game port, and hide your IP with `sv_forceIndirectListing` and a proxy.

### Can Cloudflare protect my FiveM server?

Cloudflare can front the HTTPS connect endpoint, but its standard proxy does not carry FiveM’s UDP game traffic. You still need filtering for the game port.

### How do I hide my FiveM server IP?

Set `sv_forceIndirectListing true`, point `sv_listingHostOverride` at an HTTPS proxy, and optionally send game traffic through a stream proxy via `sv_endpoints`.

### Should I restart my server during an attack?

No. It does not stop the traffic; contact your host instead.

## Related

- https://fam-tools.com/guides/fivem-server-ports-firewall
- https://fam-tools.com/guides/fivem-server-hosting-options
- https://fam-tools.com/guides/fivem-linux-server-setup
- https://fam-tools.com/guides/txadmin-admins-permissions