Your address is published on purpose
The server list exists so players can find you. Anyone reading it has your IP and port, so keeping the address quiet is not a defence you have.
FiveM DDoS protection
The server list publishes your IP and port on purpose, so attacks on a FiveM server are routine rather than remarkable. Floods big enough to fill the link are absorbed upstream. Everything that reaches your machine is checked against how FiveM actually behaves, before FXServer spends a cycle on it.
- Ports the preset opens
- TCP 30120, UDP 30120
- Protocol validation
- Yes: the Cfx.re game and listing traffic
- One-click preset
- FiveM (GTA RP)
- Upstream capacity
- 17 Tbps, the same on every plan
- What it costs
- Included on every plan
The ports, and who should reach each one. The defaults; open whichever you actually configured.
| Port | What it carries | Exposure | In the preset |
|---|---|---|---|
| UDP 30120 | Game traffic. | Open to players | Yes |
| TCP 30120 | HTTP endpoint, server list registration, and client file downloads. | Open to players | Yes |
| TCP 40120 | txAdmin, the web admin interface. | Restrict to your own addresses | Add it yourself |
A rule is TCP or UDP, never both.
Why FiveM servers get attacked. The server list publishes your address, and the port has to answer players it has never seen.
Attacks are bought, not built
Booter services sell UDP floods by the minute. The people using them on a FiveM server are usually a rival community, someone who was banned, or someone attempting extortion.
A small target, an immediate effect
Nobody needs to take the machine offline. A few seconds of packet loss during an event is enough to make a roleplay server feel bad and empty it.
The port has to answer strangers
A player who has never connected must be able to send the first packet, so 'only let known players in' is not available at the network layer. Telling a player from a flood is the filter's job.
What Prism checks on a FiveM rule. All three gates, in order, and the last one reads the FiveM protocol itself.
Every rule the FiveM preset writes
The last gate is what catches a flood that uses the right port and a plausible packet size.
- UDP 30120Layer 3 Address and packet sanityLayer 4 pps_limit 50000Layer 7 FiveM validator
- TCP 30120Layer 3 Address and packet sanityLayer 4 No ceiling as shippedLayer 7 FiveM validator
FiveM protocol validation
Traffic on the game port has to behave like the Cfx.re game and listing protocol. A flood that matches the port, the protocol and a plausible packet size still fails here.
UDP first-packet challenge
Under load, an unknown source's first packet is dropped. Real clients retransmit and get through; single-shot spoofed floods never do.
Zero-day signature engine
Learns the payload pattern of an attack while it is happening and refuses traffic matching it, without a rule being written first.
Connection and request floods on TCP 30120
Join attempts that never complete, request floods and off-path requests are detected on the HTTP side, before they reach the thread that runs your game.
What FiveM puts on the wire. Same port, but only a real player holds the conversation.
Joining
The client asks the server for a manifest listing every resource file with its hash, then downloads each file over TCP 30120. That is why a restart puts every player through your upload at once.
Being listed
The listing endpoints answer anyone who asks, and each reply carries your icon and resource list, so a small request can return a much larger response. Keeping both small lowers what an attacker gets back.
Playing
Gameplay is ENet over UDP 30120, compressed once the session is established, at a few dozen packets a second per player.
The tell
A real client identifies itself in the first exchange and then keeps a two-way conversation going at a human rate. A booter does neither, whatever its packets look like.
A real player
UDP 30120 Identifies itself in the first exchange, to the server, passes Prism
TCP 30120 Asks for the resource manifest, to the server, passes Prism
TCP 30120 Manifest: every resource file with its hash, then each file, from the server, passes Prism
UDP 30120 ENet gameplay, compressed, a few dozen packets a second, both ways, passes Prism
- Reaches FXServer and joins
A booter
UDP 30120 Sprays spoofed packets, one each
Ends at: UDP first-packet challenge
UDP 30120 What gets through does not speak Cfx.re
Ends at: FiveM protocol validation
TCP 30120 Join attempts that never complete, off-path requests
Ends at: Connection and request checks
- Dropped at the network driver, before FXServer sees it
Step by step on UDP 30120. Four steps each. The booter can copy the port and the packet size; it cannot copy the steps.
StepPlayerBooter
1PlayerSends its first packet to 30120BooterSprays spoofed packets at 30120
2PlayerRetransmits when the challenge drops it under loadBooterNever retransmits, so never passes the challenge
3PlayerSpeaks the Cfx.re protocol from the first exchangeBooterWhat does get through does not speak Cfx.re
4PlayerReaches FXServer and joinsBooterDropped at the network driver, before your server sees it
The FiveM (GTA RP) preset. One click writes the rules, added to yours exactly as if you had written them by hand.
What one click writes
One click writes the TCP 30120 and UDP 30120 rules. Preset rules generally arrive with protocol validation switched on; fit the packet ceiling to your own busy hour.
Applying a preset adds its rules, it never replaces yours, and applying it twice adds a second copy. A server holds 15 inbound rules, so check the table afterwards.
| Protocol | Port | Policy | Status |
|---|---|---|---|
| UDP | 30120 | 50K pps | Enabled |
| TCP | 30120 | No extra limits | Enabled |
Quick setup: apply a preset for a common workload
FiveM (GTA RP)2 rulesApplied
Players download from the edge, not your server
FiveM customers can have resource downloads served from cdn.clouduxe.com instead of your TCP 30120. Players joining after a restart pull assets from the CDN, and your server keeps its bandwidth and CPU for the game.
Included on Clouduxe servers
About the Asset CDNBackdoor sinkhole
A hosts file of known FiveM backdoor callback domains, from the Firewall tab. Applied on your machine, it sends those lookups nowhere. It matches names rather than hardcoded addresses, and covers the hosts known today.
Read the guideKeep /info.json small
Every /info.json response carries your icon and your resource list, and you pay for each one. A 96x96 icon and no unused resources lower what each request costs you, and what an attacker gets back for sending it.
Read the guideWhat no network filter can see
A leaked script with a backdoor, a guessed RCON password, or txAdmin exposed with a weak one all arrive inside traffic your server is meant to answer. Prism judges packets, so those are yours to close, and the FiveM protection guide walks through each.
Read the guideWhich plan for a FiveM server. Bigger plans add cores, memory and disk, not clock speed.
FiveM's main game thread handles the tick for every resource, so single-core clock speed decides how many players and scripts a server carries before it hitches. Memory and disk scale with the resources you install, not with player count.
Deploy in
MicroCore VDS
Up to 32 players. Room for a framework such as ESX or QBCore with its MySQL or MariaDB database on the same machine. Its cores are never shared, so the main game thread keeps its tick while the database and streaming run beside it.
- Dedicated cores
- 2
- Memory
- 8 GB
- NVMe
- 100 GB
- Traffic
- 8 TB
FusionCore VDS
Up to 64 players. The main game thread decides how many players and scripts a server carries, and here it runs on a core that is never shared. The memory and disk are for the resource set: custom vehicles, clothing and map assets add up to a much larger footprint.
- Dedicated cores
- 4
- Memory
- 16 GB
- NVMe
- 200 GB
- Traffic
- 10 TB
How to size it
Size against the resource set you intend to run: custom vehicles, clothing and map assets can be tens of gigabytes of streamed files.
- Processor on every plan
- AMD EPYC 4584PX, up to 5.7 GHz
- Memory and disk
- DDR5 and NVMe
- Port
- 1 Gbit/s
- DDoS protection
- Included, always on
- Billing
- Monthly, prices exclude GST
Guides for running it. Step by step, in the help center, written against the same panel you will use.
What every FiveM server on Clouduxe starts with.
- Boost clock, the same on every plan
- 5.7GHz
- Written by the FiveM preset in one click
- 2rules
- Upstream mitigation, every plan
- 17Tbps
- Port on every plan
- 1Gbit/s
- Server uptime in the SLA, attacks excluded
- 99.99%
- Mumbai, Singapore and Limburg
- 3regions
FiveM protection questions
Does FiveM DDoS protection cost extra?
No. It is part of every VPS, VDS and bare metal server. The upstream network and Clouduxe Prism protect every plan the same way.
Which ports does a FiveM server need open?
Two rules, both on 30120: UDP for game traffic, and TCP for the server list endpoints and resource downloads. Keep txAdmin on 40120 and your database on 3306 off the public internet.
Can a flood that looks like real players be stopped?
That is what protocol validation is for. A flood can match the protocol, port and packet size of real traffic, but it cannot hold the conversation a real FiveM client has with your server, so it is dropped on the host.
Will players be kicked during an attack?
Players who have already connected have earned trust with the filter and are not thrown away when pressure rises. If a real player is dropped, Address lookup on the Attacks tab names the check that did it.
Can my resources be served from a CDN?
Yes. On a Clouduxe server the Asset CDN is included: turn it on from your server in the panel. Downloads come from cdn.clouduxe.com rather than your server's TCP 30120, which keeps joins quick after a restart and keeps your server's resources for the game. Servers hosted elsewhere can use it too, for a flat monthly price.
Does DDoS protection stop backdoored scripts?
No packet filter can, because the resource runs inside your server. The panel gives you a sinkhole list of known backdoor callback domains to apply on the machine, and the FiveM guide covers what to check before installing a resource.
Which region should a FiveM server use?
The one closest to your players: Mumbai for India, Singapore for Southeast Asia, Limburg for Europe. Protection is identical in all three.
Run FiveM where the filter speaks its protocol.
The same 17 Tbps upstream and the same filter on every plan, in every region, enabled from the first boot.