Can you put a FiveM server behind Cloudflare?

Cloudflare is the first thing many server owners think of when they want to hide their IP or stop attacks. For a FiveM server the answer is: partly. Cloudflare can handle the web side of FiveM, but not the game connection itself on its normal plans.

What the orange cloud does

When you turn on the proxy for a DNS record, Cloudflare only forwards web traffic: HTTP and HTTPS on a fixed list of ports such as 80, 443, 8080 and 8443. FiveM players connect to your server on port 30120, over both TCP and UDP. That port is not on the list, and UDP is not web traffic at all.

So if you point play.example.com at your server with the orange cloud on, players cannot connect through it. Forwarding other TCP and UDP ports needs Cloudflare Spectrum, and for custom applications like a game server, Spectrum requires an Enterprise plan.

What you can put behind Cloudflare

• Resource downloads. These are plain HTTP requests, and with fileserver_add you can send them to any URL, including a CDN on Cloudflare's network. For most servers this is the largest share of traffic.
• Your website, store and other web pages.
• The HTTP part of the connection, with some work. The Cfx.re proxy setup guide shows how to run it through nginx behind Cloudflare. The game traffic itself still goes over UDP.

Does it hide your IP?

Not on its own. Game traffic goes over UDP, so players connect either to your server directly or to a UDP proxy you run in front of it. What Cloudflare can do is keep your IP out of the parts that run over HTTP. The proxy guide covers sv_forceIndirectListing and sv_listingHostOverride for the server list, and with fileserver_add pointing at a CDN, players download from the CDN instead of from your server.

And attacks?

Most attacks on game servers target the game port. Protection for that has to come from your host or from a provider that filters game traffic. Moving downloads to a CDN still helps in two ways.

• Your server no longer spends its bandwidth on downloads, so there is more room when traffic spikes.
• The file endpoint, which is easy to load with large downloads, no longer has to be open to everyone. On FXServer build 10543 and later, sv_httpFileServerProxyOnly limits nearly all downloads from it to the ranges you set in sv_proxyIPRanges.

Using Cloudflare for downloads with FiveMCDN

FiveMCDN runs on Cloudflare's network. You add two lines to your server.cfg, and resource downloads come from the Cloudflare location nearest each player. You do not need to change DNS or have a Cloudflare account. The docs also show the optional lines that lock your file endpoint to Cloudflare's ranges.