Your city runs fine all week, then on a Friday night, with 40 people mid-scene, everyone times out at once. A week later it happens again, the evening after a ban. If you are searching for FiveM server DDoS protection, you have met the pattern: roleplay servers get attacked more than most, and the attacks follow the drama.
This post covers why RP servers get hit, what the 100 Gbps of always-on Layer 3/4 filtering included with every Noded VPS removes, the FiveM work that stays yours (ports, txAdmin, IP hiding, rate limits, secrets), Linux sizing for 32 to 64 slots, and when a paid tier pays off. It all applies to RedM, which runs on the same FXServer.
Why roleplay servers get DDoSed
- Rival servers. In Cloudflare's DDoS threat report for Q2 2025, 63% of attacked customers who could name their attacker pointed to a competitor, a pattern Cloudflare saw especially in gaming, the fourth most-attacked industry that quarter.
- Banned players and ex-staff. Communities ban people and staff fall out; the same survey lists disgruntled users among named attackers.
- Booters. DDoS-for-hire "stresser" sites sell attacks to anyone. Europol's Operation PowerOFF keeps seizing them; new ones keep appearing.
- Your address is easy to find. The server list advertises it by default, and every player who joins is handed the game endpoint.
Assume your IP is known and the attacker will return.
FiveM server DDoS protection: what is filtered, what reaches you
Every Noded KVM VPS includes 100 Gbps of always-on DDoS protection at Layers 3 and 4, at no extra cost, with nothing to enable. Attack traffic is filtered upstream, before it reaches your server's port, and clean traffic keeps flowing. For FiveM that covers UDP floods at 30120/udp, DNS and NTP amplification, and SYN floods against any TCP port.
What still reaches you:
- Requests that look legitimate. A flood of
info.jsonorplayers.jsonrequests on 30120/tcp is Layer 7, filtered only on the 10 Tbps tier. Below it, FXServer's rate limits and, for big floods, a reverse proxy or CDN in front of the HTTP side handle it. - Anything that is not a flood. Cheaters triggering server events, a backdoored resource, a guessed txAdmin password.
- Repeated very large attacks. Above 100 Gbps, the first five such attacks in a month are still mitigated at no charge. From the sixth, the attacked IP is null-routed until the attack stops or the server moves to a higher tier.
The filtering is not FiveM-aware, and the firewall below runs on your VPS. Our DDoS-protected game server hosting overview covers other games.
Paid tiers are per server, chosen as the DDoS Protection option when you configure the VPS: 500 Gbps for €156.45 a month, 1 Tbps for €523.95, up to 10 Tbps with Layer 7 for €4,723.95, plus VAT where it applies. One makes sense when you see, or expect, more than five attacks above 100 Gbps a month, or when a null-routed evening costs you more than the tier. It will not fix exploitable events, backdoored resources or a leaked admin password.
Ports, firewall and txAdmin security
FXServer listens on 30120 for TCP and UDP by default (endpoint_add_tcp and endpoint_add_udp in server.cfg). txAdmin, part of FXServer since early 2020, serves its web panel on TCP 40120, the default in txAdmin's environment docs.
| Port | Used by | Open to |
|---|---|---|
| 30120/tcp | HTTP: info, connect, downloads | Everyone |
| 30120/udp | Game traffic | Everyone |
| 40120/tcp | txAdmin web panel | Nobody: SSH tunnel or fixed staff IPs |
| 3306/tcp | MySQL or MariaDB | Nobody: bind to localhost |
| 22/tcp | SSH | You, with keys |
txAdmin restarts the server, runs console commands, edits server.cfg and bans players. Keep that login off an address attackers already know:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw limit 22/tcp
sudo ufw allow 30120/tcp
sudo ufw allow 30120/udp
sudo ufw enable
# on your PC, then open http://localhost:40120
ssh -L 40120:127.0.0.1:40120 [email protected]If staff need the panel without SSH, allow 40120 only from fixed addresses (ufw allow from 198.51.100.7 to any port 40120 proto tcp). Do not set TXHOST_INTERFACE=127.0.0.1: it also sets the interface FXServer binds to. Leave rcon_password unset, which disables RCON. Our server hardening checklist covers SSH keys and the base system.
How to hide a FiveM server IP with a proxy setup
The Cfx.re proxy setup guide describes two separate proxies, and the difference matters. A connect proxy is an HTTPS reverse proxy (nginx in the guide, optionally behind Cloudflare) in front of FXServer's TCP side, plus:
set sv_forceIndirectListing true
set sv_listingHostOverride "play.example.com"
set sv_proxyIPRanges "198.51.100.20/32"sv_forceIndirectListing stops the server list advertising your real IP and needs sv_listingHostOverride set, or FXServer logs an error. sv_proxyIPRanges names the proxies allowed to pass each player's address in X-Real-IP.
The catch: after the HTTP handshake, the client asks for the server's endpoints and connects to them directly, over TCP and UDP. A connect proxy hides your IP from the server list, not from anyone who joins. Hiding it from players also takes a server proxy: a raw TCP and UDP relay on 30120 (nginx's stream module) on a separate VPS. Point sv_endpoints at it, firewall the game server to accept 30120 only from the proxy, and set sv_listingIpOverride, which the guide says such setups usually need. Cfx.re polls listed servers from the addresses in static.cfx.re/ips.txt; whichever box it polls must accept them.
The costs: two machines, and a protection tier covers only the server it is ordered with, so the proxy, now your public address, is the one that needs it. Game traffic arrives from the proxy's address, so test how IP bans and your anticheat cope. A leaked address stays leaked: if you will need this, build it before launch.
And sv_endpointPrivacy never hid your server's IP. It hid players' addresses, and current FXServer builds have removed it, since player IPs are no longer published on any HTTP endpoint.
Rate limits, events, the database and the licence key
FXServer rate-limits per IP with token buckets, per the server commands page:
| Limiter | Per second | Burst |
|---|---|---|
http_info, http_players, http_dynamic | 4 | 10 |
handshake | 4 | 10 |
netEvent (client events) | 50 | 200 |
Tune them with set rateLimiter_<name>_rate and _burst; net_tcpConnLimit caps concurrent TCP connections per IP, 16 by default. sv_requestParanoia, off by default, fights HTTP floods relayed through open proxies: level 1 blocks requests carrying a Via header, level 2 also browser requests, level 3 also closes the socket.
One trap: addresses in sv_proxyIPRanges, by default loopback and private ranges, skip these limits. If nginx fronts FXServer, as in the guide's local TLS proxy, rate-limit in nginx (behind Cloudflare, restore visitor addresses with the realip module first):
# http {} block
limit_req_zone $binary_remote_addr zone=fxhttp:10m rate=5r/s;
# inside location / of the FiveM server block
limit_req zone=fxhttp burst=20 nodelay;Events. The Cfx.re guide Secure Your Events warns that cheats can trigger events in any context. Validate money, items, position and permissions server-side in every handler, and leave sv_scriptHookAllowed at its default of false.
Database. ESX, QBCore and Qbox store characters in MySQL or MariaDB, usually through oxmysql, whose docs recommend MariaDB. Set bind-address = 127.0.0.1 under [mysqld] (many packages already do), check with ss -tlnp | grep 3306, and give FiveM its own database user, not root.
Secrets. Keep them in a separate file:
# server.cfg
exec secrets.cfg
add_convar_permission oxmysql read mysql_connection_string
# secrets.cfg: chmod 600, never in Git
sv_licenseKey "cfxk_..."
set mysql_connection_string "mysql://fivem:LONG-RANDOM@localhost:3306/fivem"Use set, never sets or setr, for secrets: sets publishes the value in info.json and setr replicates it to every client. Every resource can read every convar by default; add_convar_permission, accepted only at startup, limits the connection string to oxmysql. Keep the licence key from the Cfx.re Portal out of screenshots, shared repos and Discord; if it leaks, create a new one.
Running FXServer on Linux: sizing for 32, 48 and 64 slots
Noded VPS in Europe run Linux or FreeBSD (Windows Server VPS are sold only in Ashburn, US). That works: Cfx.re publishes Linux artifacts and txAdmin ships inside FXServer there too. Its Linux guide does call the build "only provided as a courtesy port", saying issues are likelier to be fixed on Windows, so trial new artifacts on a copy first. On Debian or Ubuntu:
sudo apt install -y xz-utils tmux
sudo useradd -m -s /bin/bash fivem && sudo -iu fivem
mkdir -p ~/server && cd ~/server
wget "PASTE-RECOMMENDED-LINUX-BUILD-URL" && tar xf fx.tar.xz
tmux new -s fx 'bash run.sh'Started without +exec, FXServer launches txAdmin and prints a setup URL; open it through the SSH tunnel. For RedM, add set gamename rdr3 to server.cfg.
Cfx.re publishes no RAM or CPU figures. On its forum, the community answer is 4–6 GB for a single FXServer, and about 16 GB for a heavy RP city with addon vehicles and clothing plus the database on the same box. Above 48 slots you need Cfx.re's Element Club Argentum or higher; Argentum allows 64.
| Server | Shape | RAM / vCPU / network | Bucharest | Warsaw or Amsterdam | Sofia or Ashburn |
|---|---|---|---|---|---|
| 32 slots, light resource list | VPS III | 8 GB / 2 / 180 Mbps | €10 | €14 | €16 |
| 48 slots, framework city with MariaDB | VPS IV | 16 GB / 4 / 220 Mbps | €16 | €24 | €26 |
| 64 slots, heavy city | VPS V | 24 GB / 6 / 260 Mbps | €30 | €42 | €44 |
Prices are monthly; Ashburn is US East. CPU matters as much as RAM: txAdmin charts FXServer's main thread, svMain, which runs 20 ticks a second, 50 ms per tick. Extra vCPUs help MariaDB and the other threads, not svMain, and our guest CPU reports as Broadwell-IBRS, an older Intel generation with modest single-thread speed. If svMain runs long with players online, profile your scripts first; a city that needs a faster core belongs on a dedicated server.
The network figure is a burst ceiling on a shared 1 Gbps node uplink, not reserved bandwidth; traffic is unmetered. Floods are filtered upstream, so the ceiling is for players. Resource downloads, heaviest when everyone rejoins after an update, can move to another box with the guide's caching setup (fileserver_add, adhesive_cdnKey).
What this is not
It is not managed FiveM hosting. Managed game hosting at Noded is coming soon and cannot be ordered yet, so you run FXServer, txAdmin and MariaDB yourself: you update artifacts, patch resources and, with no snapshots or backups on our VPS, dump the database elsewhere. Layer 7 filtering exists only on the 10 Tbps tier. From the sixth attack above 100 Gbps in a month, the attacked IP is null-routed until the attack stops or the server moves up a tier. There is no Windows on our European VPS (Windows Server VPS are sold only in Ashburn, US), and no filter stops a cheater or a bad script.
How Noded Can Help
For a 48-slot city, take a VPS IV (16 GB RAM, 4 vCPU, 220 Mbps) from the VPS hosting page: €16 a month in Bucharest, €24 in Warsaw or Amsterdam, €26 in Sofia or Ashburn, with unmetered traffic and 100 Gbps of always-on Layer 3/4 protection included. Test your resources by the hour first at €0.0222 an hour; hourly needs €5 of credit and bills until the VPS is destroyed. If attacks above 100 Gbps become routine, add a paid tier from €156.45 a month per server, listed on the DDoS protection page. For a higher tier on an existing server, or advice on location, contact us.
FAQ
Does FiveM have built-in DDoS protection?
Partly. FXServer rate-limits HTTP requests, handshakes and network events per IP, and sv_requestParanoia can block proxy-based HTTP floods. None of that stops a volumetric flood that fills the server's link; that must be filtered upstream by the host, which Noded includes at up to 100 Gbps on every VPS.
How do I hide my FiveM server IP?
Set sv_forceIndirectListing to true and sv_listingHostOverride to a hostname served by a connect proxy, and the server list stops showing your IP. Joining players still receive the game endpoint, so hiding it from them needs a raw TCP and UDP proxy on another machine, set as sv_endpoints, with the game server accepting only that proxy.
What ports does a FiveM server need open?
Only 30120, on both TCP and UDP, by default: TCP for HTTP, connections and resource downloads, UDP for game traffic. txAdmin's web panel uses TCP 40120 and should not be open to the internet; reach it through an SSH tunnel. Keep MariaDB on 3306 bound to localhost.
Is it safe to open txAdmin port 40120?
Not to the whole internet. txAdmin can restart the server, run console commands and ban players, so its login is worth attacking. Close 40120 in the firewall and use it over an SSH port forward, or allow a few fixed staff addresses. Do not rebind it with TXHOST_INTERFACE, which also moves FXServer.
Does the same advice apply to a RedM server?
Yes. RedM runs on the same FXServer with gamename set to rdr3, so the ports, txAdmin, proxy convars, rate limiters and database advice are identical. On Noded, a RedM server on a VPS gets the same 100 Gbps of included Layer 3 and 4 protection as a FiveM server.