[GUIDE] Configure a Cloudflare Proxy For Your FiveM Server

FiveM Server Development Server Tutorials
, , , ,
22

Has anyone tried this with not already having 30120 port forwarded as well? I have noticed that this config ends up revealing my ip address still.

23

What about layer 7 protection and securing all other ports?

Like OVH/Windows firewall only allowing ipv4 traffic via specific IPs should lock the server down to the point of being untouchable yes?

25

Hey,
Can we have the real ip of the players instead of 127.0.0.1

26

Hi! @ItsAndromeda ! How you doin? I am just confused on how should I do with Integrating with FiveM. Can you please enlighten me and teach me how to setup this? I’ve been trying to understand it for about 8 hours already it seems i got no luck on understanding it. Thanks!

27

I am not really understanding what you meant about this one.

3. Set up a reverse proxy for your FiveM server. The reverse proxy should listen on port 443 and forward requests to the connecting endpoint specified in the route.

28

Hey man! I’m trying to set this up with Cloudflare DNS Proxy rather than the tunnel, but I’m getting the following error:

Couldn’t resolve URL <code>.

Do you have any idea what might cause this? I’d imagine the setup for the proxy wouldn’t be too different to the tunnel setup. The proxy IP ranges are the same as well.

My server is reachable through a Traefik reverse proxy listening on port 443, and the domain is proxied through Cloudflare. I can retrieve the info.json files and everything from the domain as well as the users.cfx.re proxy as well as connect using the domain as long as I put https:// in front of it, but connecting with the code doesn’t seem to work.

Any help would be appreciated!

1 Like
29

When I do this, while fivem starts it’s connection through the cloudflare tunnel, the actual connection bypasses cloudflare and goes straight to your reverse proxy or server (depending on what sv_endpoints is set to). It’s fairly trivial to then attack your proxy/server directly since it’s IP is exposed with a simple netstat query, because I still need to keep port 30120 open on my endpoint’s firewall.

If you don’t set sv_endpoints, then it tries to connect to port 30120 on the initial IP it was given (the cloudflare’s network edge), which would be fine but Cloudflare doesn’t support nonstandard HTTP(S) ports without cloudflare also installed on client machines.

30

So how did you solve this? I also found that my IP is just simply exposed in a simple netstat query…

31

I haven’t figured out how to send actual gameplay through a cloudflare tunnel without running cloudflare on the client. You can protect TX admin though since it’s a web app. Cloudflare’s tunnel works great for that.

But I don’t think this guide should be advertising gameplay data flows through cloudflare unless they make it very clear how to set it up without extra client software.

33

Does anyone have a template for nginx, anything I could use to set this up?

34

This issue has a straightforward solution, primarily stemming from the domain configuration. Specifically, the problem lies within a configuration feature known as “Bot Fight Mode” This setting triggers a “Managed Challenge” action upon requests, often resulting in the blocking of requests and displaying the “Server list query” error. To address this, there are two potential solutions:

  1. Disable Bot Fight Mode (Not Recommended): This option involves turning off the Bot Fight Mode feature entirely. However, this may leave the system vulnerable to certain threats and is not the recommended course of action.

  2. Create a New Security Rule to Exclude Fivem-Related IPs (Recommended): A more advisable solution is to establish a new security rule specifically designed to bypass IPs associated with Fivem. This approach maintains the integrity of the Bot Fight Mode while allowing legitimate Fivem-related requests to proceed without hindrance.

35

Hey, could you elaborate on “IPs associated with Fivem” for me? From the phrasing of your response, I am thinking that you are not referring to individual client IPs, but a set of known IPs by FiveM. If that’s the case, can you provide a list that we should add to bypass?

37

FiveM uses OVH services, search about OVH IP ranges. :grinning:

38

Thank you a lot :saluting_face:

39

Which service do we need to buy from cloudflare to provide a proxy to the FiveM server? Thanks!

40

you must disable bot fight mode. Get started with Bot Fight Mode ¡ Cloudflare bot solutions docs

image
image832×285 17 KB

41

Cloudflare ZTNA baybee. It’s on the description (unless I missed something about hte question)

42

I had the same issue, did you ever figure it out?

43

Nope, sadly not.