Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To make a self-hosted FiveM server reachable from the internet, forward the game endpoint’s configured TCP and UDP ports—usually 30120—from your router to the computer running FXServer, then allow those same protocols through the computer’s firewall. Test from a different internet connection with FiveM’s F8 console. The txAdmin panel normally uses TCP 40120 and is separate from the player connection.
What port does a FiveM server use?
A standard FXServer configuration uses port 30120 for both TCP and UDP. That is a convention, not a guarantee: the values in your own server.cfg determine what players must reach. Cfx.re’s endpoint examples bind both protocols to 0.0.0.0:30120, while the netPort command also controls the primary server port.
| Service | Protocol | Typical port | What it does |
|---|---|---|---|
| FXServer game endpoint | TCP and UDP | 30120 | Player connections and game traffic |
| txAdmin web panel | TCP | 40120 | Administration and monitoring; not the player game connection |
| Custom endpoint | As configured | Not stated | Use the exact values in server.cfg instead of assuming 30120 |
If you change the endpoint, change the router and host-firewall rules to match it. Forwarding only txAdmin’s panel port can give you a working administration page while players still cannot join.
What you need before creating the rule
- Access to the router’s administration page and permission to edit Port Forwarding, NAT, or Virtual Server settings.
- The private LAN address of the computer running FXServer.
- Permission to edit that computer’s host firewall.
- The ability to open
server.cfgand verify the active endpoint. - A second internet connection for testing, such as a friend’s connection or a device using cellular data. A test from the same computer or only from
localhostdoes not verify internet reachability. - The current public IP address assigned to your home connection.
Do not begin by forwarding a random port or the txAdmin port. First establish which endpoint FXServer is actually listening on; every later rule depends on that value.
#1 Best Overall
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐑𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 𝟕 - Designed with the latest Wi-Fi 7 technology, featuring Multi-Link Operation (MLO), Multi-RUs, and 4K-QAM. Achieve optimized performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra.
- 𝟔-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝐰𝐢𝐭𝐡 𝟔.𝟓 𝐆𝐛𝐩𝐬 𝐓𝐨𝐭𝐚𝐥 𝐁𝐚𝐧𝐝𝐰𝐢𝐝𝐭𝐡 - Achieve full speeds of up to 5764 Mbps on the 5GHz band and 688 Mbps on the 2.4 GHz band with 6 streams. Enjoy seamless 4K/8K streaming, AR/VR gaming, and incredibly fast downloads/uploads.
- 𝐖𝐢𝐝𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐒𝐭𝐫𝐨𝐧𝐠 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐨𝐧 - Get up to 2,400 sq. ft. max coverage for up to 90 devices at a time. 6x high performance antennas and Beamforming technology, ensures reliable connections for remote workers, gamers, students, and more.
- 𝐔𝐥𝐭𝐫𝐚-𝐅𝐚𝐬𝐭 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐖𝐢𝐫𝐞𝐝 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 - 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port and 3x 1 Gbps LAN ports offer high-speed data transmissions.³ Integrate with a multi-gig modem for gigplus internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Step 1: Confirm the FXServer endpoint
Inspect server.cfg
Find the endpoint declarations in the configuration used to start the server. A typical setup resembles:
endpoint_add_udp "0.0.0.0:30120"
endpoint_add_tcp "0.0.0.0:30120"The address 0.0.0.0 means FXServer accepts traffic on the machine’s available interfaces; the port number is the value that must be reachable through the router. If your file contains another number, use that number for the corresponding protocol. If TCP and UDP are assigned different values, create a rule for each actual protocol-and-port pair.
Check netPort and the running configuration
The netPort command controls the primary server port. Start FXServer or txAdmin and inspect the generated or existing server.cfg and startup output so that you are forwarding the configuration the running instance really uses, not an old copy in another folder. Stop and restart the server after making a configuration change, then verify the endpoint again.
Step 2: Give the server computer a stable private IP address
A router forwards to a private address such as 192.168.x.x or 10.x.x.x. If that address changes after a reboot or DHCP lease renewal, the forwarding rule will silently point at the wrong device.
Use a DHCP reservation
The most practical approach is a DHCP reservation in the router. In the router’s LAN or DHCP section, select the FXServer computer and reserve its current address for that device. The exact menu name varies by firmware, but the result should be a permanent mapping between the computer’s network adapter and one private IP.
Use a static private address when appropriate
You can instead configure a static address on the host, provided it is outside the range the router dynamically assigns and uses the correct gateway and DNS settings. Avoid assigning an address that another device may receive. After applying either method, confirm the host still has the reserved address before creating the forwarding rule.
Rank #2
- Beyond-fast WiFi 7 (802.11be) with new 320MHz channels in the 6 GHz band and 4096-QAM significantly increases network capacity and throughput, with speeds of up to 30 Gbps
- Multi-link Operation links to multiple bands at the same time to ensure stable internet connections and efficient data transfers
- Cutting-edge external dual-feeding antennas boost coverage by providing high efficiency and significantly enhanced signal strength
- Maximized wired connectivity and flexibility with dual 10G ports and quad 2.5G ports
- Triple-Level Game Acceleration - The GT-BE98 Pro boosts your PC gaming traffic every step of the way, from your PC gaming port all the way to the game server.
Step 3: Create TCP and UDP forwarding rules
- Sign in to the router that directly connects your network to the internet.
- Open the page labeled Port Forwarding, NAT, or Virtual Server.
- Add a rule for the FXServer computer’s reserved private IP address.
- Set the external and internal port to the configured game port. With the standard configuration, that is 30120.
- Select TCP for one rule and UDP for a second rule. If the firmware supports a combined TCP/UDP entry, one combined rule is acceptable.
- Save or apply the changes, then confirm that both protocol entries remain present.
Do not forward TCP only. FiveM’s game endpoint uses both protocols, and opening one without the other can result in a failed or incomplete connection. Likewise, do not send the rule to the router’s own address, a Wi-Fi extender, or a different computer: the destination must be the machine running FXServer.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →When the router has separate external and internal fields
Keep the external and internal numbers identical unless you have a deliberate reason to translate ports. If you do translate them, players must connect using the external number, while FXServer continues listening on the internal number. Using identical values reduces mistakes during testing.
Step 4: Allow the game endpoint through the host firewall
Router forwarding gets packets to the LAN; the operating system can still discard them. Create inbound firewall permissions for the same game port and for both TCP and UDP on the FXServer computer. If your firewall asks which application or executable is allowed, select the FXServer process; if it asks for a port, specify the configured endpoint number.
- Permit inbound TCP on the game port.
- Permit inbound UDP on the game port.
- Apply the rules to the network profile the host is actually using.
- Keep the permission limited to the required port rather than disabling the entire firewall.
txAdmin’s default TCP 40120 is an administration interface, not a substitute for the game rule. Keep that panel limited to your private network or another intentionally protected access path instead of exposing it unnecessarily to the public internet.
Step 5: Start FXServer and verify what is listening
Launch FXServer through your normal txAdmin or server startup process. Check the active configuration and startup output for the endpoint lines and port. A running panel proves only that the panel process is available; it does not prove that the game’s TCP and UDP endpoint can be reached through the router.
Recommended Free Tools
If you edited the wrong configuration file, changed a port while another instance is running, or started the server with a different profile, the router may be correctly forwarding a port on which nothing is listening. Resolve that mismatch before changing NAT rules.
Rank #3
- Please update the firmware upon initial setup of the router, as it greatly enhances the device's performance and ensures a superior user experience.*** 【WiFi 6 Standard with ultra-low latency】Wi-Fi 6 speeds up to 6 Gbps to let you enjoy smoother 4K streaming, gaming, video calls and more, DDR4 1GB / eMMC 8GB
- 【High Speed Gaming Router】Dominate with uninterrupted performance with the ultimate MT6000 gaming internet router, equipped with 8-stream Wi-Fi 6 technology, the Flint 2 delivers blazing speeds, ensuring a stable and high-speed connection during intense multiplayer battles.
- 【Rapid OpenVPN & Wireguard speed】Wireguard VPN and OpenVPN speeds up to 900Mbps and 880Mbps respectively, giving you complete control over your gaming, streaming and working bandwidth. Actual speed may differ depending on internet service provider, network environment, VPN server location, VPN service provider, etc.
- 【AdGuard Home Supported】Enabling the use of a DNS server for blocking unwanted tracking and offers a convenient web interface for filtering selected digital advertisements. Users can take full control of their online experience and enjoy a clutter-free browsing environment with ease.
- 【Mass device connectivity】Experience enhanced online connectivity with our higher storage capacity, catering to over a hundred devices and fulfilling the requirements of DIY users seeking to install additional plugins. Enjoy stable and reliable connections, ensuring seamless performance and accommodating a wide range of digital needs.
Step 6: Test from outside your LAN
Obtain the connection’s current public IP address from the router’s WAN/status page or another trusted method. Then use a computer on a different internet connection:
- Open FiveM.
- Press F8 to open the client console.
- Run
connect PUBLIC_IP:30120, replacingPUBLIC_IPwith your current public address and replacing 30120 if your server uses another external port. - Observe whether FiveM reaches the server and lets you join.
A successful localhost connection, or a connection using the host’s private LAN address, proves only that FXServer is bound locally. It does not test the router, public address, upstream NAT, or internet-facing firewall path. Direct connection is the first meaningful test; server-list visibility is a separate issue.
Why local players can join while friends cannot
Local binding is not internet forwarding
When the server computer or another device on the same LAN connects locally, traffic may never leave the network. That path bypasses the public interface and often bypasses the router’s inbound NAT rule. The result can look healthy even though an outside client has no route to the endpoint.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe rule may target yesterday’s private IP
If the host received a new DHCP address, the router still forwards to the old one. A reservation or static address prevents this recurring failure. Compare the destination shown in the forwarding rule with the address currently assigned to the FXServer computer.
One protocol may be missing
FiveM needs the configured TCP and UDP endpoint. A TCP-only rule, UDP-only rule, or host-firewall exception for only one protocol can produce timeouts or connections that never complete. Check both the router and operating-system rules.
Troubleshooting a failed direct connection
Timeout or no response
- Confirm the public IP is current; a changed WAN address makes an otherwise correct command point to the wrong location.
- Confirm the router rule points to the host’s current private IP.
- Verify that both TCP and UDP rules exist for the configured endpoint.
- Check the host firewall for matching inbound permissions.
- Make sure FXServer is running and listening on that port.
- Check whether a second router or gateway sits between the host network and the internet.
Cfx.re’s server-issues guidance summarizes this symptom directly: when a direct connection fails, incorrect port forwarding or a firewall blocking connections is likely.
Rank #4
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Connection refused
A refusal generally indicates that the destination was reached but no service accepted the requested endpoint, or that the configured port is wrong. Recheck the endpoint declarations, netPort, the startup profile, and whether another application or another FXServer instance is using the expected port.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe txAdmin page works, but players still cannot join
This is not contradictory. txAdmin normally uses TCP 40120, while the player endpoint normally uses TCP and UDP 30120. Test the game port directly and maintain separate firewall and forwarding rules. Do not infer game connectivity from a reachable panel.
Direct connection works, but the server is absent from the list
Listing and direct connectivity are different symptoms. First preserve the working direct-connect path. Then inspect server configuration and listing-related settings. Cfx.re warns that NAT or gateway behavior that masks UDP source ports can prevent a server from appearing in the list even when the server process itself is running.
The server worked until the modem or router was replaced
Recreate the reservation and forwarding rules on the new equipment. A new gateway may use a different private subnet, may have its own firewall, or may place the old router behind another NAT layer. The rule must exist on the device that owns the public WAN address, or inbound traffic will stop at the upstream device.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Double NAT, CGNAT, and gateway restrictions
Double NAT in the home
Double NAT occurs when an ISP gateway and a separate personal router both perform address translation. Forwarding on only the inner router is insufficient because the outer gateway still has no rule for the traffic. Identify which device displays the public WAN address. If it is the ISP gateway, forward the game endpoint there as well, or place the downstream router in the gateway’s supported passthrough or bridge arrangement.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Carrier-grade NAT
Some internet connections do not provide the customer with a directly reachable public IPv4 address. With CGNAT, the address shown by your router may be shared or may differ from the address visible on the internet. Inbound port forwarding can then be impossible because the upstream carrier controls the translation. Ask the ISP whether inbound connections are supported and whether a public address or an appropriate service option is available.
Best Value
- WiFi 7 Gaming Router - WiFi 7 (802.11be) dual-band gaming router boosts speeds up to 6500 Mbps, with 4096-QAM increasing a single frequency band's transmission speed by 1.2 times.
- Game Tough with Stability & Low Latency - Multi-link operation (MLO) link up to multi-band at the same time to ensure the stable internet connection and increase the efficiency.
- Quad 2.5G Port - Traffic via 2.5G ports has top priority, supported by 1* WAN and 3* LAN port configurations to maximize wired internet connectivity.
- One Router. All Game Types - TUF Gaming BE6500 provides gamers with different features for different game types, including a one-tap mobile game packet prioritization, a dedicated Gaming Port that ensures your device remains at the front of the queue for optimal performance, and Open NAT that simplifies multiplayer setups with easy port forwarding in just 3 steps.
- Comprehensive Security System - Support the latest ASUS security system, give you a wonderful protection from any network threaten.
UDP source-port masking
Cfx.re specifically notes that a NAT or gateway that masks UDP source ports can keep a server from appearing in the server list. This is a listing problem, not proof that the game endpoint is misconfigured. Use the F8 direct-connect test to separate endpoint reachability from discovery.
Custom ports: what changes and what does not
Changing the endpoint is supported, but every layer must agree. Read the TCP and UDP declarations and the primary netPort value, then use those exact values in the router rules, firewall permissions, and the F8 connect command. Tell players the public port they should use if it differs from 30120.
Do not assume that changing txAdmin’s panel port changes the game endpoint. They are separate services. Likewise, forwarding 40120 does not make a custom game port reachable.
Security and maintenance considerations
- Expose only the game endpoint required for players. Avoid publishing the administration panel unless you have a deliberate, protected access design.
- Use a reserved or static private address so a future DHCP change does not redirect traffic to another device.
- Keep the host firewall enabled and create narrow inbound rules for the required protocols and port.
- Review the router’s forwarding table after firmware changes, hardware replacement, or network redesign.
- When you change
server.cfg, treat the endpoint as changed until you verify the running server and update both router and firewall settings.
Port forwarding makes a service reachable; it does not secure the service by itself. The router, operating system, FXServer installation, and txAdmin account each remain part of the security boundary.
Self-hosting versus managed hosting
If you cannot change the router, your ISP uses CGNAT, or maintaining inbound firewall rules is unacceptable, managed FiveM hosting is an alternative deployment path. The trade-off is not simply convenience; it changes who controls the network and who carries operational responsibility.
For a managed FiveM deployment, Godlike.Host provides game-server hosting with its own game panel; its FiveM page includes a free server card that must be extended every 3 hours and has limited panel features and one location. It is not on Cfx.re’s list of authorized FiveM hosts (fivem.net, 10 Oct 2026).
| Decision factor | Self-hosting at home | Managed hosting |
|---|---|---|
| Router and firewall control | You configure the NAT and host firewall. | The provider supplies the internet-facing network configuration. |
| Inbound connectivity | Depends on your public address, gateway, ISP policy, and CGNAT status. | Usually part of the service, subject to the provider’s terms. |
| Recurring cost | Uses your existing connection and hardware, with any ISP or electricity costs you already incur. | Normally adds a recurring hosting charge. |
| Setup complexity | You handle endpoint configuration, forwarding, firewall, and troubleshooting. | Initial deployment is simpler, but you follow the provider’s controls. |
| Port changes | You can change the endpoint and update your own rules. | Changes depend on the provider’s available controls. |
| Security updates and maintenance | You are responsible for the server host, operating system, router, and administrative panel. | Responsibility is divided between you and the provider; read its maintenance and access terms. |
The official Cfx.re setup documentation lists game-server hosting providers as an available deployment route. Choose this path when the network prerequisites for home hosting cannot be met, rather than repeatedly changing rules on a gateway that cannot accept inbound traffic.
Quick Recap
Final verification checklist
server.cfgshows the endpoint you intend to publish.- The FXServer machine has a reserved or static private LAN address.
- The router forwards the game port to that address for both TCP and UDP.
- The host firewall allows inbound TCP and UDP on the same game port.
- FXServer is running with the configuration you inspected.
- You tested
connect PUBLIC_IP:PORTfrom outside the LAN. - You treated txAdmin’s panel port as separate from the game endpoint.
- If direct connection works but listing does not, you investigated listing configuration and NAT/gateway behavior separately.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
