Securing Your FiveM Server with Cloudflare Tunnel
If you operate a FiveM server, safeguarding it from potential threats is of utmost importance. One effective way to achieve this is by implementing a zero-trust security model, where server access is only allowed through a secure channel. I am sharing this with other communities as we all need to come together againts the attackers in helping mitigate downtime.
Note: This guide assumes you are familiar with operating a FiveM server and have both a Cloudflare account and access to Cloudflare ZTNA (Zero Trust Network Access). If you do not know what you are doing, you will face challenges. Do your research and always configure this in a development environment first.
What is Cloudflared Tunnel?
Cloudflared Tunnel establishes a secure, encrypted connection between your server and Cloudflare’s network. By utilizing this tunnel, you can access your server securely from anywhere without exposing it directly to the internet. Cloudflared Tunnel is a part of the Cloudflare Workers family, leveraging the same robust security and privacy features.
Setting Up Cloudflared Tunnel
To set up Cloudflared Tunnel, you will require a Cloudflare account and access to the server you wish to secure. Follow these steps:
-
Install Cloudflared on your server. Instructions for installing Cloudflared can be found on the ZTNA Dashboard or here.
-
Create a new Tunnel in the Cloudflare ZTNA dashboard.
-
Give the Tunnel a descriptive name and select the server you want to secure.
Integrating with FiveM
To integrate your FiveM server with Cloudflared Tunnel, we will use a reverse proxy. Follow these steps:
-
Create a route for your FiveM server using the HTTP protocol in the Cloudflare ZTNA dashboard. The route should resolve to:
http://localhost:30120or what ever port you use for your server. -
Tip: Sometimes adjustments are necessary in the Cloudflared tunnel settings to ensure SSL works with the
cre.fxserver listing ping/API. It’s recommended to change the proxy type tosocks5. -
Set up a reverse proxy for your FiveM server. The reverse proxy should listen on port 443 and forward requests to the connecting endpoint specified in the route.
// prevents the server list from advertising your server using its actual IP
set sv_forceIndirectListing true
// makes the server list backend request `https://server1.example.com/` instead of the default
set sv_listingHostOverride "server1.example.com"
// a space-separated list of IPv4 networks in CIDR notation to allow 'X-Real-IP'
// from, as well as bypass the rate limiter. The below IP Spaces are Cloudlfare addresses.
set sv_proxyIPRanges "173.245.48.0/20, 103.21.244.0/22, 103.22.200.0/22, 103.31.4.0/22, 141.101.64.0/18, 108.162.192.0/18, 190.93.240.0/20, 188.114.96.0/20, 197.234.240.0/22, 198.41.128.0/17, 162.158.0.0/15, 104.16.0.0/13, 104.24.0.0/14, 172.64.0.0/13, 131.0.72.0/22"
// the actual endpoint your server is hosted on, or one
// or multiple server endpoint proxies, as noted below
set sv_endpoints "100.64.1.2:30120"
// Some guides also mention `sv_listingIpOverride.` This value is only needed
// if the server list backend can't guess the IP to query itself and is not provided to any front-end connection.
// This is usually the case for systems with multiple IPs or if the server is firewalled off for all hosts except
// a server proxy.
- Ensure your reverse proxy is configured to use SSL encryption. You can obtain an SSL certificate from Cloudflare or a trusted certificate authority.
Testing Your Connection
It’s essential to test your connection after setting up the Cloudflared Tunnel. Keep in mind that some regions might experience slightly higher ping due to Cloudflared Tunnel being primarily designed for secure exposure of websites and networks, rather than low-latency game servers.
Conclusion
By leveraging Cloudflared Tunnel, you can establish a secure and encrypted connection between your FiveM server and Cloudflare’s network. This significantly enhances your server’s protection against potential threats, offering you peace of mind. If you encounter any questions or need assistance in setting up Cloudflared Tunnel, do not hesitate to reach out to the Cloudflare support team for help.
