FiveM game traffic runs over both TCP and UDP port 30120. Because UDP is stateless, game servers are frequent targets of UDP reflection, amplification, and handshake exhaustion attacks. Here is our battle-tested Linux firewall blueprint.
1. Port Architecture Overview
- Port 30120 UDP: Real-time game entity synchronization, movement, voice (Mumble).
- Port 30120 TCP: HTTP file downloads, initial client handshakes, resource streaming.
- Port 40120 TCP: txAdmin management interface (strictly restrict access to trusted admin IPs!).
- Port 3306 TCP: MariaDB/MySQL (MUST NEVER be exposed to the public internet).
2. Production UFW (Uncomplicated Firewall) Rules
# Default deny all incoming traffic
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow SSH on custom port or standard 22
sudo ufw allow 22/tcp
# Allow FiveM game server ports
sudo ufw allow 30120/tcp
sudo ufw allow 30120/udp
# Restrict txAdmin access ONLY to your home/office IP
sudo ufw allow from YOUR_HOME_IP to any port 40120 proto tcp
# Enable the firewall
sudo ufw enable
