FiveM: Set Up a Reverse Proxy

Learn how to improve the security and reliability of your FiveM game server with a reverse proxy—for better DDoS protection and performance → Find out more

10 November 20266 min read0 Views0 helpful

Introduction

A reverse proxy server acts as an intermediary between end users (your players) and your FiveM game server. This is especially useful for servers that frequently experience DDoS attacks, as it provides an additional layer of security and greater reliability by reducing the visibility of the main host and providing additional protective measures.

In this guide, we'll show you how to set up a reverse proxy for your FiveM game server. There are two types of reverse proxies in this scenario: the Connect Proxy, which is used for the Connect endpoint, and the Server Proxy, which is used for the server endpoint, where raw TCP/UDP proxying takes place. Both can be set up independently.

Prerequisites

To set up a reverse proxy, you'll need a Linux server (e.g., a VPS) to host your proxy server. In this example, we're using Ubuntu as the Linux distribution, but the installation steps are very similar for most Linux distributions.

Tip

Recommended VPS specs We strongly recommend choosing higher network speeds if you want to set up a Server Proxy, especially if your server has many players. Your VPS will stream raw TCP/UDP directly between the client (player) and the FiveM game server. Otherwise, a server with basic specifications and minimal upgrades is more than enough. :)

We also recommend setting up the proxy with a domain that you own. To do this, create an A record for the domain you want to use (e.g., zapdocs.example.com) and point it to the IP address of your Linux VPS. This is the address players will use to connect—but technically, you can also use your proxy server's IP address directly if you prefer.

Accessing the VPS

Once your Linux VPS is ready, you'll need to connect to it. Follow our Getting Started with SSH guide to learn how.

Installing Nginx

You'll use Nginx to host the reverse proxy, as it's a high-performance and popular open-source web server.

Once you've accessed your VPS, install Nginx with the following command:

Code

sudo apt install nginx

After installation, you'll need to adjust your firewall to make the service accessible from the internet. For this guide, we're using the UFW firewall, because Nginx registers itself as an app, making it easy to adjust the settings. For more information about the UFW firewall, see our Linux Security Tips guide.

Info

If you're using other firewalls (e.g., Iptables), make sure to grant Nginx the necessary access, especially on ports 80 and 443, which Nginx uses.

You can view the Nginx profiles with sudo ufw app list. In this case, select Nginx Full, which allows HTTP access for testing and HTTPS access for production.

Code

sudo ufw allow 'Nginx Full'

Now that Nginx is running, try accessing the site in your browser to make sure everything is working. If the test page appears, you can continue with the guide.

Code

http://[deine_serverip]

Connect Proxy

A Connect Proxy is used to proxy the Connect endpoint of your FiveM game server. This means your proxy server receives the connection requests and forwards them to your main FiveM game server. The main advantage is that your FiveM host's real IP address remains hidden in the server list and is therefore less visible.

Nginx setup

First, create an entry in the Nginx directory for the host you chose when setting up the domain. In this example, we'll use zapdocs.example.com again.

Create the server block for your domain with the following command, replacing [your_domain] with your own domain:

Code

sudo nano /etc/nginx/sites-available/[your-domain]

Now copy the following template into the editor and adjust the values to match your configuration.

Code

upstream backend {
    # FiveM Server IP-Adresse
    server [your_fivem_serverip]:30120;
}

proxy_cache_path /srv/cache levels=1:2 keys_zone=assets:48m max_size=20g inactive=2h;

server {
    listen 80;
    listen [::]:80;

    server_name [your_domain]; # Zum Beispiel: zapdocs.example.com

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        # Erforderlich, um Auth-Header korrekt weiterzuleiten
        proxy_pass_request_headers on;
        # Verhindert, dass Verbindungen sofort geschlossen werden
        proxy_http_version 1.1;
        proxy_pass http://backend;
    }

    # Zusätzlicher Block für einen Caching Proxy
    location /files/ {
        proxy_pass http://backend$request_uri;
        add_header X-Cache-Status $upstream_cache_status;
        proxy_cache_lock on;
        proxy_cache assets;
        proxy_cache_valid 1y;
        proxy_cache_key $request_uri$is_args$args;
        proxy_cache_revalidate on;
        proxy_cache_min_uses 1;
    }
}

Once you've adjusted all the values, save the file and exit nano with CTRL + X, confirm with Y, and press ENTER.

Now enable the server block by creating a symlink to the active directory:

Code

sudo ln -s /etc/nginx/sites-available/[your_filename] /etc/nginx/sites-enabled/[your_filename]

To make sure there are no syntax errors, you can run sudo nginx -t. If everything is successful, reload Nginx for the changes to take effect:

Code

systemctl reload nginx.service

Now test whether you can access your domain in a browser. If everything works, the page should load the content you specified as the targetServer parameter. If you run into any issues, we recommend checking the logs with journalctl -f -u nginx.service to find errors.

FiveM configuration

After setting up the proxy, you'll need to adjust some values in your FiveM game server's server.cfg.

Add the following lines and replace the values as needed:

Code

# Verhindert, dass die Serverliste deinen Server mit der echten IP bewirbt
set sv_forceIndirectListing true

# Lässt die Serverliste deine Domain anfragen statt der Standard-IP (z.B. zapdocs.example.com)
set sv_listingHostOverride "[your_domain]"

# Liste von IPv4-Netzen in CIDR-Notation, die 'X-Real-IP' erlauben und den Rate Limiter umgehen
set sv_proxyIPRanges "[your_proxy_serverip]/32"

# Der eigentliche Endpunkt, auf dem dein Server läuft, oder ein oder mehrere Server Proxy Endpunkte
set sv_endpoints "[your_fivem_serverip]:30120"

Save the file and restart the server. On the next startup, your domain should resolve to your FiveM game server and be available for connections.

You can test whether everything is working by visiting https://[your_domain]/info.json. If the file loads, your Connect Proxy is working.

Server Proxy

A Server Proxy is used to proxy the server endpoint of your FiveM game server—in other words, for raw TCP/UDP proxying and streaming.

Nginx setup

For this, you'll use the stream module in Nginx. Open nginx.conf with nano:

Code

sudo nano /etc/nginx/nginx.conf

Now add the following block in the root scope and adjust the values:

Code

stream {
    upstream backend {
        server [your_fivem_serverip]:30120;
    }
    
    server {
		listen 30120;
		proxy_pass backend;
	}

	server {
		listen 30120 udp reuseport;
		proxy_pass backend;
	}
}

Save the file and exit nano with CTRL + X, confirm with Y, and press ENTER.

Check the syntax with sudo nginx -t. If everything looks good, reload Nginx to activate the configuration:

Code

systemctl reload nginx.service

Now try connecting to your game server using the proxy domain. If everything works, you should be able to connect to the server you specified as targetServer. If you run into any issues, check the logs with journalctl -f -u nginx.service.

FiveM configuration

Once the proxy is running, you'll need to adjust one setting in server.cfg.

Tip

If you already set the set sv_endpoints parameter while setting up the Connect Proxy, you can skip this step.

Add the following line and replace the value:

Code

# Der eigentliche Endpunkt, auf dem dein Server läuft, oder ein oder mehrere Server Proxy Endpunkte
set sv_endpoints "[your_fivem_serverip]:30120"

Save the file and restart the server. On the next startup, raw TCP/UDP endpoints will be streamed through your reverse proxy.

You can verify this by checking the players' IP addresses—they should all show your proxy server's IP address with randomly assigned ports.

SSL certificate

Once your FiveM reverse proxy is running, we strongly recommend installing an SSL certificate for your domains so that data is securely transmitted over HTTPS.

See our Certbot Installation guide, which explains the entire process for requesting and automatically renewing SSL certificates for your domain(s).

Conclusion

Congratulations! You've successfully set up a reverse proxy for your FiveM game server and can now benefit from greater security, reliability, and better performance. Our support team is available every day if you have any questions or run into any issues—don't hesitate to contact us! 🙂

FAQ

Frequently asked questions

The Connect Proxy (for the Connect endpoint) and the Server Proxy (for the server endpoint and raw TCP/UDP proxying). Both can be set up independently.

It's useful for servers that frequently experience DDoS attacks. It reduces the visibility of the main host and provides additional protection.

Higher network speeds are recommended, especially for servers with many players, since raw TCP/UDP is streamed directly between the client and game server. For less demanding setups, basic specs are sufficient.

Feedback

Was this article helpful?

Your feedback helps us prioritize and improve content.

0 of 0 Users found this article helpful.

Personal support

Need more help than the guide provides?

Our ZAP support team knows your product — briefly describe your issue and we'll help you personally.

upstream backend { # FiveM Server IP-Adresse server [your_fivem_serverip]:30120; } proxy_cache_path /srv/cache levels=1:2 keys_zone=assets:48m max_size=20g inactive=2h; server { listen 80; listen [::]:80; server_name [your_domain]; # Zum Beispiel: zapdocs.example.com location / { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; # Erforderlich, um Auth-Header korrekt weiterzuleiten proxy_pass_request_headers on; # Verhindert, dass Verbindungen sofort geschlossen werden proxy_http_version 1.1; proxy_pass http://backend; } # Zusätzlicher Block für einen Caching Proxy location /files/ { proxy_pass http://backend$request_uri; add_header X-Cache-Status $upstream_cache_status; proxy_cache_lock on; proxy_cache assets; proxy_cache_valid 1y; proxy_cache_key $request_uri$is_args$args; proxy_cache_revalidate on; proxy_cache_min_uses 1; } }

# Verhindert, dass die Serverliste deinen Server mit der echten IP bewirbt set sv_forceIndirectListing true # Lässt die Serverliste deine Domain anfragen statt der Standard-IP (z.B. zapdocs.example.com) set sv_listingHostOverride "[your_domain]" # Liste von IPv4-Netzen in CIDR-Notation, die 'X-Real-IP' erlauben und den Rate Limiter umgehen set sv_proxyIPRanges "[your_proxy_serverip]/32" # Der eigentliche Endpunkt, auf dem dein Server läuft, oder ein oder mehrere Server Proxy Endpunkte set sv_endpoints "[your_fivem_serverip]:30120"

Which 🍪 cookies would you like to allow?

FiveM: Set Up a Reverse Proxy

Introduction

Prerequisites

Accessing the VPS

Installing Nginx

Connect Proxy

Nginx setup

FiveM configuration

Server Proxy

Nginx setup

FiveM configuration

SSL certificate

Conclusion

Frequently asked questions

FiveM

Prerequisites

Accessing the VPS

Installing Nginx

Connect Proxy

Nginx setup

FiveM configuration

Server Proxy

Nginx setup

FiveM configuration

SSL certificate

Conclusion

Game Server

Servers & Hosting

ZAPX

Resources

ZAP-Hosting