FiveM reverse proxy: what it really does, and how to set it up on a VPS

"Put a proxy in front of your server" is the most repeated advice on FiveM Discords after an attack. It is sometimes right and often incomplete. A reverse proxy changes what attackers see, not how much traffic they can send. This guide explains what it really protects, when you are better off without one, and how to set one up properly on a VPS.

1. What a reverse proxy does

A reverse proxy is an intermediate machine between the players and your server. Players connect to the proxy address, and the proxy relays traffic to the real server, called the origin server, through a private channel. For players and the public server list, only the proxy address exists.

2. What a proxy really protects

• Your origin server's address, as long as it has never been published. Nobody can directly attack a machine whose address they do not know.
• A server hosted without protection: at home on a fibre connection, or with a host that has no filtering. The proxy, placed with a protected host, takes the hit instead.
• Several servers behind one entrance, which you can move without changing the address given to players.

3. Its limits, which get less attention

• A proxy filters nothing by itself. If it has no network protection, a volumetric attack saturates it and your server becomes unreachable just as before. The proxy itself must sit behind network Anti-DDoS.
• It adds latency: a detour through one more machine. In the same country as the origin, that means a few milliseconds. Badly placed, players will feel it.
• It adds a point of failure. If the proxy goes down, the server is unreachable even when it is perfectly healthy.
• The origin address leaks easily: an old DNS record, a script calling an external API, a screenshot of the console. One leak and the proxy no longer helps.
• It complicates administration: depending on the method, the server may no longer see players' real addresses, which affects IP bans and some anti-cheats.

4. Proxy or directly protected server?

A proxy makes sense if your server runs at home or with a host without Anti-DDoS and you cannot move it, if you want several servers behind one address, and if you are ready to maintain one more machine and tunnel.

A protected server is enough if you can host the game server on a machine filtered upstream, if you want the lowest possible latency, and if you prefer a simple setup with no extra point of failure.

That is the choice we made for our game servers: Anti-DDoS filters traffic on the network before it reaches the machine, so the server has no need to hide. See our FiveM protection page. If your situation matches the first case, read on.

5. The setup

• A proxy VPS with a host that offers network Anti-DDoS, ideally in the same country as the origin. A proxy uses little CPU, so an entry-level NVMe VPS will do.
• A WireGuard tunnel between the proxy and the origin: relayed traffic is encrypted and the origin needs no port open to the Internet.
• Nginx on the proxy, with its stream module, relaying port 30120 in TCP and UDP to the origin through the tunnel.

In the examples, the proxy has the address 10.8.0.1 in the tunnel and the origin server 10.8.0.2.

6. The WireGuard tunnel

Install WireGuard on both machines and generate a key pair on each:

apt update && apt install -y wireguard
cd /etc/wireguard && umask 077
wg genkey | tee private.key | wg pubkey > public.key

On the proxy, /etc/wireguard/wg0.conf:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <proxy private key>
[Peer]
PublicKey = <origin public key>
AllowedIPs = 10.8.0.2/32

On the origin server:

[Interface]
Address = 10.8.0.2/24
PrivateKey = <origin private key>
[Peer]
PublicKey = <proxy public key>
Endpoint = PROXY_PUBLIC_IP:51820
AllowedIPs = 10.8.0.1/32
PersistentKeepalive = 25

The origin starts the connection to the proxy thanks to PersistentKeepalive, so it needs no inbound port, even behind a home router. Start the tunnel on both sides with systemctl enable --now wg-quick@wg0, then check with ping 10.8.0.2 from the proxy.

7. The Nginx relay on the proxy

apt install -y nginx libnginx-mod-stream

Add this at the end of /etc/nginx/nginx.conf, outside the http block:

stream {
    upstream fivem_tcp { server 10.8.0.2:30120; }
    upstream fivem_udp { server 10.8.0.2:30120; }
    server {
        listen 30120;
        proxy_pass fivem_tcp;
    }
    server {
        listen 30120 udp reuseport;
        proxy_pass fivem_udp;
        proxy_timeout 60s;
    }
}

nginx -t && systemctl reload nginx
ufw allow 30120 comment 'FiveM via proxy'
ufw allow 51820/udp comment 'WireGuard'

On the origin server, close port 30120 to the Internet and allow only the tunnel with ufw allow in on wg0 to any port 30120. This is what stops anyone from bypassing the proxy.

8. The origin server's server.cfg

FiveM still has to know it is behind a proxy, so it announces the proxy address in the public list and trusts the relay. The main directives are:

set sv_forceIndirectListing true
set sv_listingHostOverride "play.yourserver.com"
set sv_proxyIPRanges "10.8.0.0/24"
set sv_endpoints "PROXY_PUBLIC_IP:30120"

Point your domain, play.yourserver.com in this example, to the proxy address, never to the origin.

9. Check that nothing leaks

1. Connect in game with connect play.yourserver.com:30120: the server should respond normally.
2. From another connection, try to reach the origin address directly on port 30120: the connection should fail.
3. Look for your origin address in your domain's public DNS history. If it appears, change it, because it is already known.
4. Watch player latency for the first few days. If it has clearly increased, move the proxy closer to the origin.

Startup problems? See common FiveM startup errors.

Frequently asked questions