FiveM

aurologic flowProxy FiveM Application filter protects against DDoS attacks targeting the popular FiveM game-server. From a protocol view, FiveM uses a mix of tcp http/tls protocols. aurologic has developed a application filter, handling connection multiplexing as well as XDP supported application offloading, done through IPC between flowproxy-app-fivem and the front eBPF/XDP stack.

How it works

The flowProxy based flowproxy-app-fivem filter is activated by API or customer area. It hijacks all ingress tcp connections on port 30120, being forwarded through flowProxy nodes. Using connection multiplexing, tcp connections being handled by different application logic within the connection listener.

Whenever a bot or valid player connects, it's connection is being forwarded onto flowproxy-app-fivem, inspected on XDP level, forwarded to the handling micro-service and either discarded or forwarded towards the origin server, running the protected FiveM server.

Prerequesites

Customers are required to configure their FiveM game-server. Otherwise, with the rising amount of players, the game-server will rate-limit flowproxy-app-fivem, causing real clients not longer being able to connect - or already connected ones, to get disconnected.

The following should be in your fivem server configuration:

set sv_proxyIPRanges "160.20.144.8/29 185.117.1.140/28 185.150.27.112/27"

Afterwards restart your FiveM game-server.