Putting FiveM behind a proxy

FiveM Server Development Server Discussion
1

So, I’ve been a system admin for a server for a while now and we’ve recently had a few DDoS attacks.

To combat this, I thought of having a few smaller servers to act as gateways to the FiveM server. This all works fine, I can get the “players.json” file and everything fine but, when I try and connect to the server with the client it fails (tries three times then gives up).

So, I was wondering if there’s something I need to do extra to get this to work. Currently I have the setup:
Proxy Server 1 -> FiveM Server (TCP 30120) - With Nginx
Proxy Server 1 -> FiveM Server (UDP 30120) - With a python script

When looking at the NGINX logs for the TCP connections, It looks like it’s working (it’s sending a POST request to /client):

image
image756×51 5.13 KB

and the python script shows that the UDP packets are being sent through:

image
image538×685 24.2 KB

2

Move to Dedicated Game Server at OVH and DDoS wont hit you.

3

I’m already with OVH and I feel like they can’t do any protection for FiveM with it being so heavy on the badwidth. So, they can’t distinguish the real traffic from the fake traffic.

2 Likes
4

Do you use OVH Game Dedicated Server? They protect better than normal servers

5

Yeah but there’s no need for a dedibox for FiveM, it’s super overkill.

3 Likes
6

Yea, no. That’s way too much power for a simple FiveM server. I don’t want to do that at all.

Still looking for solutions if anyone has an idea.

3 Likes
7

Hello,

With this simple Nginx config, all pass.
Ressources downloaded correctly, but when it’s time to connect, it’s impossible…

stream {
    server {
        listen 30120;
        proxy_pass ServerIP:30120;
    }

    server {
        listen 30120 udp;
        proxy_pass ServerIP:30120;
    }
}

image

I think it’s when you initialize the socket that it does not work.
The idea is good because it would make it possible to define complex filtering rules.

If official developers have answers to our questions, it would be cool, even if in the idea, it weighs down the process.

:kissing_smiling_eyes:

8

Using nginx might be a good way to cache the files and improve the download speeds but is not the best way to foward all the traffic.

1 Like
9

I’m using nginx stream module aswell to proxy my servers and its working just right, however the backend (fivem) server authenticates to nucleus it does send its real IP to the fivem server list.

When people put up the server in their favorites they connect directly to the backend server and can grab its IP in netstat.

I’m trying to find a way to circumvent that whilst still showing in server listing with the proxied IP instead.

10

Yeah I think we need better support for reverse proxy so we can protect our backend servers… still getting alot ddos attacks…

2 Likes
12

I am getting exactly the same problem. Did you find a solution?

13

Hi, no solution was found at the moment.

14

Hi mate, did you find some solution? We are recieveing good amount of DDOS many days in row and its really not helping… We have OVH

1 Like
15

It is very disappointing seeing how little the community cares about such situations where more or less most server owners are going through.

Answers like get OVH and “learn to code” are so wrong.

3 Likes
16

Thats not truth, im on ovh game server, and ddos still timeouts my players, since there are fivem bypass.

17

You need nginx version 1.17+ to use the UDP solution.
On my side, I manage to set up all the proxies, but my cfx link doesn’t work anymore, and the players can’t join from the server list (HTTP error 502).

If you need help to configure, I can help you.

18

Have you set up sv_listingHostOverride correctly?

19

Hi, yes.
There is the end of my server.cfg file :

# License key for your server (https://keymaster.fivem.net)
sv_licensekey "w8kzm9m5htbgxxxxxok2sqk52"
endpoint_add_tcp "0.0.0.0:40037"
endpoint_add_udp "0.0.0.0:40037"
set sv_forceIndirectListing true
set sv_listingHostOverride "xxxx.xxxxx.xyz:40037"
set sv_listingIpOverride "fxxxx.xxxxx.xyz:40037"
set sv_proxyIPRanges "194.9.172.xxx/32 194.9.172.xxx/32 45.145.167.xxx/32 194.9.172.xxx/32 194.9.172.xxx/32"
fileserver_add ".*" "http://xxxx.xxxxx.xyz:40037/files"

When connecting from the list or CFX, I get the 502 error, which I don’t get when connecting from the domain name. The strange thing is that my server appears in the list, but I can’t join it :confused:

20

Host override can’t specify a port, it has to be on 443.

1 Like
21

Ok.
Do I need an SSL certificate or is just listening on port 443 enough?

EDIT : Just fowarded the 443 port, but have this error…
How can I have a debug of the request or something to help me to find the mistake ?

Failed handshake to server mathias2pique-b6xxx6d.users.cfx.re - HTTP 502
1 Like