The Price, Up Front
This post is honest about one thing from the start: fiveshield has no free tier. Billing is calculated on your daily peak concurrent player count, with a floor of $2.25 CAD per day while a server is enabled — that floor covers any daily peak up to 50 players. Above 50, each block of players is billed at its own tier rate, between $0.030 and $0.047 per player per day. No subscription, no contract, no bandwidth surcharge. The full breakdown is on the pricing section.
That said, if you landed here searching for free FiveM DDoS protection, you have a real question and it deserves a real answer. Part of the protection work is free, can be done tonight, and plenty of server owners have never done it. Another part structurally cannot be. This post draws the line between the two.
What You Can Do Tonight, for Nothing
Three lines in server.cfg. They cost nothing, they are documented by FiveM, and they close the attack vector used most often against FiveM servers.
set sv_requestParanoia 3
set sv_forceIndirectListing true
set sv_listingHostOverride "your-proxy-domain.example.com"
sv_requestParanoia is an integer from 0 to 3, defaulting to 0, designed to counter proxy-based HTTP floods. At level 1 it blocks any IPs sending requests containing a Via header; at level 2 it adds Upgrade-Insecure-Requests; at level 3 it also closes the socket the requests were submitted on. On /info.json, /dynamic.json and /players.json, a rejected request gets a 403 whose body is literally Nope..
Why it matters: those three endpoints answer without authentication, and every request costs your server more than it costs the caller. It is the cheapest attack to mount against a FiveM server, and it is free to close. The full detail is in our post on FiveM Layer 7 attacks.
sv_forceIndirectListing is a boolean (false by default) that stops your server being advertised in the listing with its real IP address. It only makes sense if your players connect through something other than the origin IP — a proxy, a hostname. Without it, your address is published to anyone who asks.
A word on sv_endpointPrivacy, which appears in every shared block: it covered player IP addresses in the server's public HTTP reports, never the server's own. On current FXServer builds it has been removed because the protection became unconditional, and the server prints a startup message asking you to take it out of your configuration. Same note for sv_useDirectListing, absent from the official documentation: do not build anything on it.
Once those lines are in place, restart and verify the result rather than the config: the CFX Finder shows the connection address Cfx.re actually publishes for your server.
Your Host's Firewall
The second free layer, and this one depends on where you are hosted.
If your machine is an OVHcloud Bare Metal Game dedicated server, you have access to Game DDoS Protection, which goes beyond generic network filtering: it is an application-layer engine with a profile per game family — and FiveM is one of the available profiles, alongside Rust, Minecraft, Counter-Strike 2, Ark and Valheim. You enable it from the Control Panel under Network → Public IP Addresses, via the IP's menu and "Configure the GAME firewall"; you add rules by protocol and port range, and you can apply a "Default Deny" policy. Rules become active within minutes.
The limits worth knowing: it is exclusive to Game-range dedicated servers (OVHcloud says it might be unavailable or limited on the Eco product line), and the FiveM profile itself only exists on the recent GAME-1 and GAME-2 generations (2024 and later). Each IP address is configured separately, and the number of rules per IP is capped. If you are on a VPS, on shared FiveM hosting, or with another provider, this lever is simply not open to you — and that describes most community servers.
Separately, OVH's Edge Network Firewall lets you lock machine access down by source IP. Our install guide gives the exact rule table, priority by priority, including the classic trap: an "Allow" rule with an empty source-IP field allows all IPv4 traffic and cancels the firewall entirely.
Locking the Origin Down with nftables
The third free layer, available anywhere you have Linux root access. The idea: accept game traffic only from your proxy's ranges, and nothing else.
# Dedicated table: leaves your existing rules untouched
nft add table inet fivem
nft add chain inet fivem input '{ type filter hook input priority 0; policy accept; }'
# Replace 203.0.113.0/24 with your proxy's exact CIDRs
nft add rule inet fivem input udp dport 30120 ip saddr != { 203.0.113.0/24 } drop
nft add rule inet fivem input tcp dport 30120 ip saddr != { 203.0.113.0/24 } drop
# Make the rules survive a reboot
nft list ruleset > /etc/nftables.conf
systemctl enable --now nftables
Adjust 30120 if your server listens on another port, and do not forget txAdmin's port if you want to close that too.
The honest limit of this approach: the kernel can only drop a packet after receiving it. Your rules protect the FXServer process, not your network link. Against a volumetric flood that saturates the machine's upstream bandwidth, the firewall does exactly its job and the server still goes down, because legitimate packets can no longer get through. That is the structural reason mitigation has to happen upstream, on a link sized to absorb it.
What each free measure actually covers:
| Free measure | HTTP flood | Connection flood | Volumetric flood | Hides your IP |
|---|---|---|---|---|
sv_requestParanoia 3 | Yes | No | No | No |
sv_forceIndirectListing | No | No | No | Yes, in the listing |
| OVH Game firewall | Not documented by OVHcloud | Not documented by OVHcloud | Yes, generic | No |
| nftables on the origin | No | No | No | No |
Free Tiers on the Market, and Their Ceiling
Genuinely free FiveM anti-DDoS offers do exist. They follow three models, and each has a limit worth understanding before you build on it. These are the models, not the providers.
The capped free tier. A complete service, but bounded: one server, a low concurrent player limit, sometimes a single proxy location. That is honest and often enough for a test server or a launch with a handful of players. The ceiling arrives at the exact moment your server starts working — which is the moment someone has a reason to attack it.
Included with hosting. Protection bundled into a hosting plan at no extra cost. The thing to check: what is bundled is almost always generic network filtering at the infrastructure level, not filtering that understands FiveM's protocol. It absorbs volume; it does not tell a real player from a fake connection. And it ties you to that host.
The time-limited trial. Three days, seven days, a month. Useful for measuring whether a service holds up, useless as a protection plan: attacks do not arrive during the trial window.
Then there are the free Lua resources promising DDoS protection. They cannot work, and not for code-quality reasons: a resource runs inside FXServer, so the connection has been accepted, the request read and the runtime invoked before it can react. Every cost the attack was trying to impose has already been paid. What they can usefully do — logging, enforcing a join policy — is not mitigation.
Where Free Stops
There is a sharp boundary, and it is not at the volume line. It is at the cfx.re connection flood.
A player joining your server walks through a handshake: the join request, identity verification through Cfx.re, the deferral phase, and then the transition to the game stream. A connection attack runs that sequence in a loop and never finishes it. The packets are well-formed, they come from distinct addresses, and they look byte for byte like players trying to get in — because that is what they are, minus the intent.
None of the free measures above is documented to have any purchase on this. sv_requestParanoia inspects HTTP headers on three endpoints, and the connection flood does not go through them. nftables decides on addresses, ports and rates, and there is nothing anomalous to see. The Game firewall does have a FiveM profile, but OVHcloud's documentation does not say which parts of the cfx.re join sequence that profile validates. Deciding takes a FiveM anti-DDoS that filters at L7, meaning one that genuinely implements the cfx.re handshake and tracks per-session state.
The second wall is pure volumetrics: once a flood saturates your machine's upstream link, no local rule can help. That needs capacity upstream, and capacity is never free for whoever provides it.
What Protection That Holds Actually Costs
Back to the numbers from the top, now that they have context. Billing follows your daily peak, with a floor of $2.25 CAD per day while the server is enabled — that floor covers any peak up to 50 players, and per-player tier rates only start above it. A server running a 30-player peak therefore stays at the floor. Disable the server from the dashboard and billing stops.
The dashboard starts with $10 CAD of balance: credited free on your first server during the trial promotion, otherwise deposited by you and immediately available to pay for usage. That is not a free tier — it is starting balance that covers the first few days, and it should be described that way.
What that price covers and the free measures do not: upstream volume absorption on infrastructure sized for it, L4 filtering in XDP, cfx.re handshake validation at L7, a CDN cache in front of resource downloads, txAdmin panel protection, and permanent origin masking. That is what complete FiveM anti-DDoS protection has to cover, and the complete guide to stopping DDoS attacks explains why those layers are not interchangeable.
Do the free measures first. They are good, they are documented, and they stay useful behind a proxy. Pay when your server is worth attacking — you will know, it always happens at the same moment. When that moment comes, start with how to choose a FiveM anti-DDoS.
FAQ
Is there a genuinely free, unlimited FiveM anti-DDoS?
No, and it comes down to real cost: absorbing a flood takes bandwidth and hardware that somebody pays for. The free offers that exist are capped by player count, limited in time, or delivered as generic filtering bundled with hosting.
Which free measure gives the best return?
set sv_requestParanoia 3. One line, no notable side effect except that you can no longer open /players.json in a browser, and it closes the cheapest attack vector to mount against a FiveM server.
Is my VPS firewall enough?
It protects the process, not the link. nftables rules stop FXServer from processing unwanted traffic, but the packets still arrive on your network card and consume bandwidth. Against a volumetric flood, the server goes down despite perfect rules.
Is the $10 CAD balance a free tier?
No. It is starting balance: credited during the trial promotion on a first server, otherwise deposited by you. It covers the first few days at the $2.25 CAD/day floor, after which normal daily billing takes over.
Can I combine the free measures with a paid service?
Yes, and that is the right setup. sv_requestParanoia, indirect listing and the nftables origin lockdown all work behind the proxy and close the paths the proxy does not see — in particular a direct hit on the origin IP by someone who has found it.