Security guide

FiveM DDoS Protection Explained (and Its Limits)

FiveM DDoS protection works in layers. Software on your server (a firewall, closed admin ports, rate limits and good FiveM settings) reduces exposure and stops small floods, hiding the server IP behind a relay makes it harder to target, and only a host or network that filters traffic upstream can absorb a large volumetric attack. No setup is absolute, so plan for all three layers.

By FiveMRides. Last updated: November 2026.

Affiliate disclosure. Some links are affiliate links: if you buy through them we may earn a commission at no extra cost to you. Contabo is our hosting partner and our first pick; we say so openly.

What is a DDoS attack on a FiveM server?

A distributed denial of service (DDoS) attack sends more traffic or requests than your server or network can handle, so real players cannot connect or get lag and disconnects. FiveM servers are targeted for several reasons, from rival communities to people testing a public IP. It is useful to separate the kinds of attack, because each one is stopped in a different place.

What software on your server can and cannot do

What it can do

• Reduce what is exposed. Only the game port needs to be open to everyone. SSH, txAdmin (default port 40120) and any web panel should be restricted by firewall to your own IP, or reached through an SSH tunnel.
• Rate limit new connections. A firewall can limit how fast one address opens new TCP connections to port 30120, which stops simple connection floods from small sources.
• Use FiveM’s own limits. The server has token-bucket rate limiters for handshakes, HTTP endpoints and network events, documented on the server commands page. The defaults are chosen by Cfx.re, so change them only when you have a reason and a test.
• Keep the real IP private. sv_forceIndirectListing stops the server list from advertising the server’s real IP, sv_endpointPrivacy hides player IPs from public reports, and a relay hides the server address from players.
• Run OneSync and good scripts. A server that is already near its CPU limit falls over under small attacks that a healthy one shrugs off.

What it cannot do

If an attacker sends more traffic than your connection can carry, the packets are already saturating your link before the firewall on your machine sees them. A host-level filter in front of you, or a relay on a network that filters traffic, is the only layer that can help with that. Marketing numbers such as terabits do not tell you whether UDP game traffic on a custom port is filtered well, so ask specific questions.

Host-level filtering: what to ask your host

• Is mitigation always on, or does it start after detection, and how long does that take?
• Does it cover UDP game traffic on custom ports such as 30120, not only web traffic?
• Is it included in the plan or an add-on?
• Can I see attack logs, and can I tune or whitelist?
• Does the host null-route the IP during a large attack, and for how long?

Strong automatic filters can sometimes block real players, a point raised in community discussions, so test with players rather than trusting a feature list. Contabo, our hosting partner, lists always-on DDoS protection included with its VPS plans; OVHcloud advertises game-oriented mitigation; Vultr, DigitalOcean, Hetzner and others have their own network protection of different scope. Our best VPS for FiveM guide lists what to check per host.

The relay (proxy) approach

A relay is a second small server that receives player traffic and forwards it to your real game server. Players only learn the relay’s address. The official FiveM proxy guide describes an nginx stream block that forwards TCP and UDP on port 30120 to the backend. It goes directly in nginx.conf or a conf.d file, not in a sites-enabled file.

What a relay gives you

• The game server’s IP is not shown to players, so an attacker cannot simply target it.
• You can place the relay on a network that filters game traffic, while the game server sits on a cheaper plan.
• If the relay IP is attacked, you can replace it without moving the game server.

Honest limits

• A relay is not a filter by itself. It only absorbs a large flood if the network it sits on filters game traffic.
• It adds one network hop, so keep the relay close to the game server.
• The real IP can leak through old DNS records, a direct connection, other services on the same machine, or an old server list entry. If the IP has leaked, ask your host for a new one and then firewall the game port so that only the relay can reach it.
• Follow the official guide for the server settings it uses: sv_forceIndirectListing, sv_listingHostOverride, sv_proxyIPRanges (only your relay’s address, since addresses in that list also skip the rate limiter) and sv_endpoints.

# Illustration only, see the official FiveM proxy guide for the full version
# /etc/nginx/nginx.conf (top level, outside the http block)
stream {
    upstream backend { server 203.0.113.10:30120; }
    server { listen 30120;           proxy_pass backend; }
    server { listen 30120 udp reuseport; proxy_pass backend; }
}

The FiveMRides panel Protection addon

The FiveMRides Server Panel includes a Protection addon with three tools. It closes admin ports to the public so txAdmin and the panel are not exposed, it limits new TCP connections to port 30120, and it helps you set up your own relay on a separate VPS with a guided wizard. Firewall changes made from the wizard undo themselves after 90 seconds unless you confirm them, so you cannot lock yourself out by accident.

It reduces exposure and soaks up small floods. It cannot stop a large volumetric attack. For that, put the relay on a network that filters game traffic. See the panel page for details.

FiveM DDoS protection checklist

1. Choose a host and location with game-aware mitigation, and ask the questions above.
2. Keep SSH key-only, and restrict SSH, txAdmin (40120) and panel ports to your own IP or a tunnel.
3. Open only 30120 TCP and UDP to everyone.
4. Rate limit new TCP connections to 30120 in the firewall.
5. Do not publish your real IP: set sv_forceIndirectListing when you use a relay, and keep the relay as the only public address.
6. Set sv_endpointPrivacy true so player addresses are hidden from public reports.
7. Run OneSync and fix heavy scripts, so the server survives small bursts.
8. Keep the system and FiveM artifacts updated.
9. Take backups and keep one copy offsite, in case you need to move quickly.
10. Write down who to contact at your host and how to request a new IP.

Questions about FiveM DDoS protection

Can software alone protect a FiveM server from DDoS?

Software helps with small floods and abuse, and it reduces exposure, but it cannot stop an attack that saturates your network link. Large attacks must be filtered upstream by the host or by a relay on a filtered network.

Does a relay hide my FiveM server’s IP?

It hides the address from players, if you also prevent leaks through DNS, the server listing and other services. It is not a filter by itself; its network decides how much it can absorb.

Which ports does a FiveM server need open?

Port 30120 on TCP and UDP for players. SSH, txAdmin (40120 by default) and any web panel should be limited to your own IP or reached through a tunnel.

Is the FiveM server rate limiter enough?

The built-in rate limiters protect the server’s own endpoints and events, but they do not replace network filtering for volumetric floods.

What does the FiveMRides Protection addon do?

It closes admin ports, limits new TCP connections to port 30120 and guides you through setting up your own relay. It does not stop large volumetric attacks.

Which host has the best DDoS protection for FiveM?

It depends on your region and the attacks you face. OVHcloud advertises game-oriented mitigation, and others have their own protection; test with real players and ask the host the questions in this guide.

What should I do during an attack?

Contact your host first, check whether mitigation is active, and ask for a new IP if the old one is null-routed. Keep the game port firewalled to the relay if you use one.

Related guides