How to protect a FiveM server from DDoS attacks

Popular roleplay servers attract attacks, often from rivals or banned players. A DDoS attack floods your server's connection until real players time out. A firewall on the server alone cannot stop it, but you can make your server much harder to take down.

By the Nodewave team · Updated 1 November 2026

What an attack looks like

• Players time out or drop at the same moment
• The server disappears from the FiveM server list
• Ping jumps for everyone while the server's CPU looks normal
• Your host reports a spike in traffic to your IP

1. Filter traffic before it reaches your server

A large attack fills your network link before your server can drop anything, so filtering has to happen upstream, in the network. Choose hosting with DDoS protection on every IP, ideally with filtering that understands FiveM traffic, so real players still get through during an attack.

2. Keep your real IP hidden

Attackers need an address to hit. If your server's real IP shows up in the server list or a Discord message, they can attack it directly. A protected address in front of your server keeps the real one out of sight. In server.cfg, FiveM can list a different address from the one it listens on:

set sv_forceIndirectListing true
set sv_listingHostOverride "your-protected-ip:port"
set sv_endpoints "your-protected-ip:port"

Your protection provider gives you the exact values. Keep your endpoint_add_tcp and endpoint_add_udp lines so the server still listens.

3. Close the back door

Hiding the IP only helps if the real address stops answering. Set your firewall to accept the game port only from your protection provider's addresses, so attacks sent straight to the old IP are dropped.

4. Lock down txAdmin and other panels

txAdmin's web panel, on port 40120 by default, and your database port should not be open to the whole internet. Allow them only from your own IP, or reach them through a VPN or an SSH tunnel.

5. Keep real player IPs

Behind a proxy, the server sees the proxy's address unless you tell it to trust it. Set sv_proxyIPRanges to your provider's gateway address, and ban players by license or Discord identifier rather than by IP.

During an attack

1. Don't restart again and again. It rarely helps and it frustrates players.
2. Note the time and what players see, and send it to your host.
3. Check that your real IP is not answering directly.
4. Keep your community updated on Discord.

How Nodewave helps

Every Nodewave server IP sits behind Gcore DDoS filtering at no extra cost. If your server is hosted somewhere else, NodeShield puts a protected Singapore address in front of it, with Gcore's FiveM filter and the server.cfg lines ready in your dashboard.