What Happens When Your FiveM Server Is Attacked

A FiveM server has two doors: the game port that players connect to and the txAdmin web port you use to manage it. VibeSHIELD protects both without you having to turn anything on. This article explains what happens when your FiveM server is hit by a DDoS attack, where you can see it and what to do.

1What VibeSHIELD Does for Your FiveM Server

• A FiveM filter sits on the game port 30120, for both TCP and UDP. It validates the FiveM and Cfx handshake and the packets that follow, so traffic that does not look like a real FiveM client is dropped.
• A txAdmin proxy filter sits on the txAdmin web port, 40120 by default, so a flood aimed at the web interface does not reach it.
• The filtering happens at the VibeSHIELD point of presence nearest to the source of the traffic. Only clean traffic continues to your server.
• Mitigation starts by itself. You do not have to report the attack or enable anything.

2What Players Notice

• In most attacks, nothing. Players keep driving around and the server keeps running.
• During a very large attack a few seconds of higher ping or packet loss can occur while the filtering ramps up.
• If players cannot connect at all, the attack is usually not the reason. A crashed resource, an out-of-memory server or a wrong port are more likely. Check the console in the game panel first.

3Where to See the Attack

• Log in to the website dashboard and open your FiveM server.
• Click the DDoS protection tab. Note that this tab is in the website dashboard at vibegames.com, not in the game panel at game.vibegames.com.
• Status reads Active. Attack status reads Not under attack or Under attack.
• The Attack history table shows every attack of the last 30 days with an ID, the peak size in Mbps or Gbps, and the start and stop time.
• Expand a row to see a traffic chart over time, the source countries and networks (ASN), source and destination ports, protocol, TTL and packet sizes.

4The Email You Receive

• When an attack targets your server's port, the email address on your account receives a message with the subject DDoS attack detected on your server <ip>.
• The message tells you VibeSHIELD is filtering the traffic and that no action is needed.
• Several FiveM servers share one IP address on a node, each with its own port. The attack is attributed to your server because your port was hit.

5What to Do

• Nothing is required for the attack itself.
• Do not share your server IP in response to threats, and never pay anyone who claims they will stop an attack.
• Do not change the game port or the txAdmin port. It does not help against attacks and is not needed.
• Do not ask for a move to another location. Every VibeGAMES location is behind VibeSHIELD.
• If players report problems while the attack is listed, open a ticket and mention the attack ID from the history table.

Good to Know

• txAdmin is covered too. The web port has its own filter, so you can keep managing the server during an attack.
• Read more. The general article on how VibeSHIELD protects your game server covers the network itself.