Is your FiveM server IP exposed? CFX Finder

Every public FiveM server announces itself to the cfx.re listing, and the listing hands what it learns to anyone who asks: hostname, player names, resources, build — and the connect endpoint, the address a player’s client dials to join. This page reads that record from cfx.re’s public API with nothing but a join code, so the result is exactly what a stranger sees.

By default that endpoint is the IP and port of the machine running FXServer (30120 unless you changed it). Unless that address belongs to a filtering proxy or sits behind your host’s mitigation, taking the server offline needs nothing more: a rival, a banned player or anyone who can rent a booter types your join code, copies the address and floods it. No exploit is involved — it is the same lookup as this one. A new IP buys a clean slate, not protection: without indirect listing, the next startup publishes it just like the old one.

sv_forceIndirectListing true stops the listing from advertising the server with its real IP address. sv_proxyIPRanges names the proxy networks allowed to pass an X-Real-IP header, so FXServer sees each player’s address rather than the proxy’s. Those ranges also bypass its rate limiter: list your proxy’s exact CIDRs, never 0.0.0.0/0.

Neither of them filters a packet. Hiding the address moves the target to the proxy, which then has to absorb the flood and tell real players from fake connections — the job of a FiveM anti-DDoS — while the origin firewall accepts the proxy’s ranges and nothing else. The full server.cfg block, and the seven ways an origin IP still leaks, are in How to hide your FiveM server IP.