FiveM server under DDoS attack: what to do right now

No single symptom proves it: a stalled script, a firewall rule and a flood can all end with every player timing out. These three checks use evidence from outside the game.

1. Did traffic into the machine rise?

This is the check that matters, and it comes from your host or the machine, not from FiveM. Your host panel’s inbound graph is the quickest: compare it with a quiet day. A join wave after a restart tends to show up as outbound traffic (downloads), a flood as inbound.

On the machine, ten seconds of counters is enough. Look at received packets and kilobytes per second on the public interface.

sar -n DEV 1 10

Get-Counter -Counter '\Network Interface(*)\Packets Received/sec' -Continuous

2. Is the process stalling, or still answering?

Read the FXServer console. server thread hitch warning lines mean a thread ran late. The usual reports are scripts, large net events and a weak CPU; on their own they are not evidence of an attack.

A txAdmin that says "online" proves less than it seems. Its health check is a request the machine makes to its own FXServer (as of txAdmin 8.1.1), so it can stay green while nobody outside can connect.

3. Is it everyone, or a few players?

Everyone at once, with a quiet console, points outside the machine. A few players on the same ISP point at their own route. Ask two or three affected players for the "Timeout info" line in the error dialog: comparing its game, recv and send values helps tell a stalled game from packets that stopped arriving.

These are the situations most often confused with an attack. Each guide says what would change its verdict.

• Console: "server thread hitch warning"

  A thread ran late: scripts, net events or CPU first.

  Server thread hitch warnings

• Players: "Failed to get info from server (tried 3 times)"

  The UDP reply never came back. UDP forwarding and firewalls come before a flood.

  Failed to get info from server

• Many players at once: "Client -> server connection timed out"

  A stall long enough to time everyone out, on the server or on the path.

  Everyone times out at once

• Your host emails that traffic was rerouted through its anti-DDoS infrastructure

  An attack your host has detected.

  Traffic spike or host notice

• A threat, or your server’s IP showing up somewhere public

  Not an attack yet. The question is whether your real IP is published.

  Leaked IP or DDoS threat

• All FiveM server problems, diagnosed

Hosts typically deal with a large attack in one of two ways, and which one you got changes what happens next. Scrubbing reroutes the traffic through filtering equipment, and the clean part still reaches you. A null route drops all traffic to the IP: TransIP’s documentation says a nullrouted address is not reachable from the outside. Providers differ. Your host’s support can tell you which one you are in.

On OVHcloud, the Network Security Dashboard (Network, then Network Security Dashboard, in the control panel) lists detected attacks in its scrubbing centre log: detection time, end time, destination IP and attack vectors. Source addresses are not shown because they are usually spoofed, so banning them from your panel achieves nothing.

The message to send

Hello,

Since [start time and timezone], the game server on [IP], UDP and TCP port [port], has been unreachable for most players. The machine is up and the process is running, but players time out.

Could you tell me:
1. Is this IP currently being scrubbed (traffic rerouted through your anti-DDoS infrastructure) or null-routed?
2. What attack type and volume do you see, and since when?
3. Is there anything I should change on my side, and how will I know when traffic is back to normal?

I have attached a screenshot of the inbound traffic graph. Please keep the logs for this IP: I may need them.

Thank you.

Save this before anything restarts

• A screenshot of your host’s inbound and outbound traffic graphs, with the time range visible.
• Any email or notice from your host, with its timestamp.
• The FXServer console and the txAdmin log around the start time.
• The "Timeout info" line from two or three affected players.
• The start time, in your timezone and in UTC.

What it can do

• Filter traffic before it reaches your server: players connect to the proxy, and your machine only sees what the proxy forwards.
• Replace the address you publish. The server listing shows a FiveShield hostname instead of the machine’s IP.
• Be set up in about five minutes, without moving the server or changing DNS.

What it cannot do

• End an attack aimed at an address the attacker already has, while that address still accepts traffic. That is why the next section has a step for the IP.
• Fix a stalled script, a looping net event or a weak CPU. If the checks above found no traffic spike, a proxy is not your fix.
• Guarantee protection against every attack type. Our Refund Policy says that no service can.

• Read the Refund Policy

Nothing has to be migrated, which is why this is possible mid-attack. The order is what makes it work.

1. Set up the proxy. Create your server in the dashboard, paste the block it gives you at the very top of server.cfg, and restart. This is the one restart worth doing.
2. Replace the IP if the attacker has it. A proxy cannot protect an address attackers already know, so ask your host for a new IP for the machine. On OVHcloud, the Edge Network Firewall described in the install guide can make a new IP unnecessary once its rules are correct, but an Allow rule with an empty source IP cancels the whole firewall, so read the guide’s warning. If the attack continues against the old address, ask your host for a new IP.
3. Update the address in Settings. Enter the new IP in your server’s Settings in the dashboard, and tell nobody else: not your Discord, not a screenshot, not a ticket other people can read.
4. Close the origin. Only the proxy and your own IP should be able to reach the machine; the OVH Edge Firewall section of the install guide has the rules.
5. Check what you publish. Run the CFX Finder on your join code: it should show a FiveShield hostname, not an IP and port.

• The install guide, step by step
• Check your join code with the CFX Finder

Say what you know, and keep every address out of it.

Do not name anyone: your host has to confirm an attack first, and even then the source addresses are usually spoofed.

The attacker found the address somewhere. Until you know where, the next attack lands in the same place.

• Run the CFX Finder on your join code. A raw IP and port in the listing means the address is public.
• Check your domain’s DNS records, old ones included. Any that point at the machine running FXServer give the address away, and so does a website on that machine.
• Look for hard-coded addresses in your resources, and for the endpoint in Discord webhooks and log channels.
• Put txAdmin behind the same protection, or restrict its port (40120 by default) to your own IPs.
• Lock the origin so only the proxy and your own IP can reach it.

Already protected and still being hit?

Test whether the origin still answers. From another network, a request to your origin IP on the game port should get nothing back. If it does answer, the proxy is being bypassed and the leaks above are where to look. If it does not, tell us on Discord when it started.

• Every way a FiveM server’s IP leaks, in detail