If players cannot connect to your FiveM server, the root cause is almost always the same: port 30120 is not open for both TCP and UDP traffic. This guide walks you through every layer — from server.cfg endpoint directives to your router’s port forwarding table — so you can get your server publicly reachable in one pass.
Why FiveM Uses Port 30120
FiveM’s underlying engine, FXServer, uses a single port (30120 by default) for all external traffic. The TCP side handles resource downloads and server-browser communication; the UDP side carries live game data and player connections. Both protocols must be open on the same port number for the server to function correctly. If either one is blocked, players will either fail to connect entirely or experience resource-download failures mid-join.
Step 1 — Configure endpoint_add_tcp and endpoint_add_udp in server.cfg
Open your server.cfg file. The two endpoint directives tell FXServer which network interface and port to bind. The official default, taken directly from the Cfx.re documentation, is:
endpoint_add_udp "0.0.0.0:30120"
endpoint_add_tcp "0.0.0.0:30120"A few important notes about these two lines:
- Order matters. The Cfx.re proxy documentation explicitly states that
endpoint_add_udpmust appear aboveendpoint_add_tcpin the file. If you use the default port (30120 for both), the order makes no practical difference for most setups — but if you ever change the TCP port for a proxy configuration, the UDP line must come first or the port change will not take effect. - 0.0.0.0 = all interfaces. Only replace this with a specific IP address if your machine has multiple network adapters and you want to restrict which one FXServer listens on. For a typical single-NIC VPS or home server, leave it as
0.0.0.0. - Changing the port. If port 30120 is already in use, increment both lines to the same alternate port (for example, 30121). Whatever port you set here is the port you must open everywhere else in this guide.
Save the file and restart FXServer before continuing.
Step 2 — Open Port 30120 in the OS Firewall
Even with correct endpoint lines, the OS firewall can silently drop packets before they reach FXServer.
Windows (PowerShell — run as Administrator)
netsh advfirewall firewall add rule name="FXServer TCP 30120" dir=in action=allow protocol=TCP localport=30120
netsh advfirewall firewall add rule name="FXServer UDP 30120" dir=in action=allow protocol=UDP localport=30120You can also add the rules through Windows Defender Firewall with Advanced Security — create two new Inbound Rules (one for TCP, one for UDP), set the local port to 30120, and allow the connection. Repeat for Outbound Rules if your policy blocks outbound traffic by default.
Linux (ufw)
ufw allow 30120/tcp
ufw allow 30120/udp
ufw reloadIf you use iptables directly or a cloud provider’s security group, add equivalent inbound rules for port 30120 TCP and UDP.
Step 3 — Forward Port 30120 on Your Router (Home Servers Only)
If your FiveM server runs on a machine inside a home network (behind a consumer router), you must tell the router to forward incoming traffic on port 30120 to the server machine’s local IP address. VPS and dedicated servers skip this step — they have a public IP directly assigned to the network interface.
- Log in to your router admin panel (commonly at
192.168.1.1or192.168.0.1— check the label on the router). - Navigate to the port-forwarding section (sometimes called “Virtual Servers”, “NAT”, or “Applications and Gaming”).
- Create a new rule with: external port 30120, internal port 30120, protocol Both (TCP + UDP), and the local IP address of the server machine.
- Save and reboot the router if prompted.
Assign a static local IP. If your server machine gets its local IP via DHCP, the IP can change and break the forwarding rule. Either set a static IP in the machine’s network settings, or configure a DHCP reservation in the router so the server machine always gets the same address.
Router UIs differ significantly between manufacturers. Search for “[your router model] port forwarding” if you cannot find the setting.
Step 4 — Verify the Port Is Reachable
The fastest test is to open a browser on a device outside your network (a phone on mobile data works) and visit:
http://YOUR_PUBLIC_IP:30120/info.jsonIf the page returns a JSON object with your server’s name and build info, the port is open and FXServer is reachable. If it times out or returns nothing, the port is still blocked somewhere in the chain. You can also use canyouseeme.org to test port 30120 from an external vantage point.
Quick Reference: Port Summary
| Port | Protocol | Purpose | Required? |
|---|---|---|---|
| 30120 | TCP | Resource downloads, server browser listing, client handshake | Yes |
| 30120 | UDP | Live game data, player movement, voice (non-pma-voice) | Yes |
| 40120 | TCP | txAdmin web panel (local access only by default) | No — keep closed externally |
The txAdmin panel port (40120 by default) should not be publicly exposed. Access it over an SSH tunnel or a VPN instead.
Common Reasons Players Still Cannot Connect
- Missing sv_licenseKey. FXServer will not start correctly without a valid
sv_licenseKeyinserver.cfg. An unlicensed server appears offline to external players even if the port is open. - New server not yet listed. The Cfx.re server browser can take up to 8 minutes to index a newly started server. Use direct connect (
connect IP:30120in the F8 console) to test before assuming a listing problem. - NAT hairpin issue. You cannot connect to your own server using your public IP from inside the same network on many routers. Test from an external device, not the host machine or another device on the same LAN.
- DDoS protection whitelist. If your server is behind a DDoS mitigation service, the Cfx.re polling IPs must be whitelisted. The full current list is maintained at
https://static.cfx.re/ips.txt. - Hosting provider firewall. VPS hosts (and some dedicated server providers) have an additional firewall layer in their control panel, separate from the OS firewall. Check your provider’s network/firewall settings and open 30120 TCP + UDP there as well.
If you want to skip all of this — router config, OS firewall, license management — consider running your server through a managed FiveM server panel where ports and networking are pre-configured. You can also check the FiveM server docs for step-by-step panel guides covering everything from first launch to txAdmin setup.
For related FiveM server management topics, see the FiveM resource loading errors troubleshooting guide and the FiveM server backup guide.
Frequently Asked Questions
Do I need to open a different port for txAdmin?
txAdmin defaults to port 40120 for its web panel. You do not need to open this port publicly — doing so would expose your admin interface to the internet. Access txAdmin over an SSH tunnel (forward remote port 40120 to a local port) or through your hosting provider’s built-in panel access. Only port 30120 TCP and UDP needs to be publicly reachable for players to connect.
Can I change FiveM from port 30120 to a different port?
Yes. Edit both endpoint_add_tcp and endpoint_add_udp in server.cfg to use the new port number, then open that port in your firewall and router forwarding rules instead of 30120. If you are on a managed hosting panel, you will also need to allocate the new port in the panel’s Network settings before restarting the server. Players connect by specifying the port explicitly: connect IP:newPort.
My server shows in the browser but players get “connection timed out” — what’s wrong?
A server visible in the browser but unreachable on direct connect almost always means UDP 30120 is blocked while TCP 30120 is open. The server browser polling uses TCP (HTTP requests to /info.json), so it sees the server — but the actual game connection uses UDP, which is still being dropped. Double-check that your firewall rule and router forwarding rule both specify UDP (or “Both”) for port 30120, not TCP only.
Ready to play?
Run your own FiveM server with XGamingServer
Spin up an always-on FiveM server your friends can join in minutes — no port-forwarding, no tech headaches.
