FiveM Protection Setup

PlaySafe FiveM protection works in proxy mode. Your FiveM server stays where it is, at any host. Players connect to a PlaySafe address, PlaySafe filters the traffic at its location in France, and only clean traffic reaches your server.

This guide takes you from choosing a plan to a protected server with direct access closed. It takes about 15 minutes plus one server restart.

Before you start you need:

• A FiveM server that is running and reachable on a public IPv4 address
• Access to its server.cfg and to the firewall in front of it (your host’s panel, Windows Firewall or ufw)
• A PlaySafe account with a verified email address

1. Choose a plan or start the free trial

Every plan includes the same protection. Plans differ in the clean traffic included each month and in the support you get:

The player numbers are only a recommendation. PlaySafe never counts or limits players. If you go over the clean traffic of your plan, nothing is cut and nothing extra is charged: you get a notice suggesting the next plan.

The 3-day free trial

You can try the protection for 3 days before paying:

1. Request the trial from the panel. You pick a plan and fill in the same server details as a paid deploy (step 2 below).
2. The request opens a support ticket. A member of the PlaySafe team reviews it there.
3. Once approved, the protection is deployed and the ticket gets a reply with your connect address and the steps to finish the setup.
4. After 3 days the trial is switched off. Each account can use the trial once.

If you buy a plan during the trial, the paid protection replaces the trial right away and keeps the same connect address, so you do not change anything in server.cfg or in your firewall.

2. Deploy the protection

1. In the sidebar, open Security > Game protection > Deploy new.
2. Choose FiveM, then click the plan you want.
3. Fill in the Your FiveM server card:

4. Open Advanced only if you need it:
   • HTTP port: the port of your server’s HTTP endpoint, if it is not the game port.
   • cfx.re join link: your cfx.re/join/... link, so the panel can confirm when the server moved to PlaySafe.
5. Check the Location: traffic is filtered in France, wherever your server is hosted.
6. Click Go to checkout and pay the order.

After the payment the protection is deployed automatically. It shows up under Security > Game protection and becomes Active when it is ready.

3. Allow PlaySafe in your server’s firewall

Open the protection (Security > Game protection > your protection). On the Overview tab, the Installation Guide walks you through the same five steps as the rest of this guide. Its step 1, Allow PlaySafe in your server firewall, shows the PlaySafe IP your server receives traffic from.

In the firewall in front of your FiveM server, allow that IP on the game port (TCP and UDP) and on the HTTP port if you use one. Leave everything else as it is for now: players still reach the server directly until step 6.

4. Update server.cfg

1. In the Installation Guide, step 2 Update your FiveM server.cfg, click the copy button. The block is hidden on screen because it contains your server IP; the eye icon shows it after a warning.
2. Open your server.cfg and paste the block.
3. Remove any sv_endpoints line you already had. With PlaySafe in front, the server must not announce its own address.
4. Keep your endpoint_add_tcp and endpoint_add_udp lines: the server still listens on its game port, and PlaySafe forwards players to it.
5. Restart the FiveM server once, fully (not just a resource restart).

What the block does:

Paste the block exactly as the panel shows it, comments included: it is generated for your protection, key included. Keep that key private and do not change it without telling PlaySafe, because the cache is purged whenever it changes. You can also save it as a separate file and load it from server.cfg with exec. Its last lines list the ports your server must keep listening on; if you ever change them, open a ticket so PlaySafe updates the protection.

5. Give players the new address

The Player connect address box on the Overview tab and step 3 of the Installation Guide, Give players the new address, show the address. Players join with this command:

connect https://your_address-svr.playsafe.dev/

Type it exactly like that in the F8 console, with https:// and the slash at the end. Without https:// the game connects to the server on its own and skips the protection.

Replace the old IP everywhere you shared it: Discord announcements, your website and server list pages. Ask players to remove the old entry from their favourites.

6. Close direct access

This is step 4 of the Installation Guide, Close your server to everyone else. Once players are connecting through the new address, close the door behind them. In the firewall in front of your FiveM server, allow the game port and the HTTP port only from the PlaySafe IP of step 3, and block them for everyone else.

From then on an attacker who knows your old IP cannot reach the game port directly.

txAdmin is not relayed by PlaySafe. It stays on your own server: reach it at your server’s IP and keep its port (40120 by default) open only to your own admin IPs.

Moving a server players already know

If your server was already open before you added PlaySafe, the FiveM client of every player who joined it before remembers its old direct address and tries that address first. Once you close direct access (step 6), those players can get this error when they connect:

Error: Obtaining configuration... CURL error code 28

New players are not affected. Error 28 is a general timeout, so if it also happens to players who never joined your server before, open a ticket.

What you do as the server owner

1. Before closing direct access, announce the change with the new address (connect https://your_address-svr.playsafe.dev/) or your cfx.re/join link, and close it only after most players have reconnected once.

2. Renew your server’s license key so cached entries stop pointing at the old address:

   1. Sign in to Keymaster with the account that owns the server.
   2. Create a new server key for your server.
   3. Put it in sv_licenseKey in your server.cfg, replacing the old one.
   4. Restart the server once.

   Your server gets a new cfx.re/join link, and old links stop working. Share the new one on Discord and your website.

What affected players can do

Any of these fixes it for a player:

• Connect once with connect https://your_address-svr.playsafe.dev/ in the F8 console.
• Connect once with your new cfx.re/join link.
• Close FiveM, delete %AppData%\CitizenFX\data\server-history and open FiveM again.

After connecting once through the new address, the player’s FiveM remembers it and the error does not come back.

How to check it worked

• A player who had the error connects without it.
• https://your_address-svr.playsafe.dev/info.json opens in a browser.
• The server list shows your server again, which can take 5 to 30 minutes after the restart.

After the setup

Rules

The Rules tab shows the rules PlaySafe manages for you: the FiveM Filter, and the txAdmin port 40120 and Remote Desktop port 3389 closed by default. They are locked. To give your team access to txAdmin or Remote Desktop, follow step 5 of the Installation Guide, Access for your team, or open a ticket from Tickets.

Attacks and reports

Every attack on your protection appears in Security > Attacks, with its traffic, the vectors and the origins. When it ends you can download a PDF report, and you can get a message by email or Discord when an attack starts and ends.

Troubleshooting

If you are stuck, open a ticket from Tickets with your connect address.

Next steps