Windows Server blocks inbound traffic by default. That is why a fresh FiveM install on a Windows VPS starts cleanly, prints no errors, and still refuses every single connection. Two ports fix it.
This guide covers the one-command method, the Windows Defender Firewall wizard step by step, and how to prove the ports are actually open afterwards instead of guessing.
If you run a FiveM server with us, the ports are already open and there is nothing to do here. This guide is for a self-managed Windows VPS. You can compare the two approaches on our FiveM server hosting and VPS hosting pages.
Which ports does a FiveM server need?
| Port | Protocol | What it carries |
|---|---|---|
| 30120 | TCP | Server browser endpoints (/info.json, /dynamic.json) and resource downloads to joining players |
| 30120 | UDP | Live game traffic and the heartbeat that registers your server with the Cfx master list |
| 40120 | TCP | The txAdmin web panel |
The important detail: 30120 needs both TCP and UDP. Those are two separate firewall rules, not one. A TCP-only rule is the most common mistake here, and it produces a confusing symptom: http://your-ip:30120/info.json loads fine in a browser, so the server looks reachable, but nobody can actually play and the server never appears in the browser.
Port 40120 only needs to be open if you want to reach txAdmin from your own PC. If you always manage the server from inside the VPS over Remote Desktop, leave 40120 closed. That is one less admin panel exposed to the internet.
Open the FiveM ports with one command
This is the fastest method and the one to use if you are comfortable in a terminal. Right-click Start, choose Windows PowerShell (Admin) or Terminal (Admin), and paste:
New-NetFirewallRule -DisplayName "FiveM 30120 TCP" -Direction Inbound -Protocol TCP -LocalPort 30120 -Action Allow
New-NetFirewallRule -DisplayName "FiveM 30120 UDP" -Direction Inbound -Protocol UDP -LocalPort 30120 -Action Allow
New-NetFirewallRule -DisplayName "txAdmin 40120 TCP" -Direction Inbound -Protocol TCP -LocalPort 40120 -Action Allow
If you prefer Command Prompt, the netsh equivalent does exactly the same thing:
netsh advfirewall firewall add rule name="FiveM 30120 TCP" dir=in action=allow protocol=TCP localport=30120
netsh advfirewall firewall add rule name="FiveM 30120 UDP" dir=in action=allow protocol=UDP localport=30120
netsh advfirewall firewall add rule name="txAdmin 40120 TCP" dir=in action=allow protocol=TCP localport=40120
Check that the rules landed:
Get-NetFirewallRule -DisplayName "FiveM*", "txAdmin*" | Format-Table DisplayName, Enabled, Direction, Action
You should see three rules, all True, Inbound, Allow. No restart is needed, the rules apply immediately.
Open the ports with the Windows Defender Firewall wizard
Use this if you would rather see what you are doing. You repeat these steps twice for port 30120 (once for TCP, once for UDP) and optionally a third time for 40120.
1. Press Win + R, type wf.msc and press Enter. This opens Windows Defender Firewall with Advanced Security.
2. Select Inbound Rules in the left column, then New Rule on the right.
3. Choose Port and click Next.
4. Choose TCP, select Specific local ports, and enter 30120.
5. Choose Allow the connection.
6. Leave Domain, Private and Public all ticked. A VPS network adapter is usually classed as Public, so unticking it is a common way to create a rule that looks correct and does nothing.
7. Give it a name you will recognise later, for example FiveM 30120 TCP, then click Finish.
8. Repeat steps 2 to 7, this time choosing UDP at step 4. This second rule is not optional.
Check the ports are really open
Do this from outside the VPS. Testing from inside proves nothing, because traffic that never leaves the machine never meets the firewall. Use your home PC, or your phone on mobile data.
With the FiveM server running, open this in a browser and replace the IP with your own:
http://203.0.113.10:30120/info.json
A wall of JSON means TCP 30120 is open and the server is answering. A timeout means it is not.
That page only proves the TCP half. To confirm the whole thing end to end, have someone connect, or use our FiveM server status checker, which queries the server the same way the server browser does.
If you changed the port in server.cfg
The firewall rules and server.cfg have to agree. FiveM binds the port from these two lines:
endpoint_add_tcp "0.0.0.0:30120"
endpoint_add_udp "0.0.0.0:30120"
If you move the server to, say, 30125, both lines change and both firewall rules change with them. Keep the TCP and UDP endpoint on the same number unless you have a specific reason not to.
The txAdmin port is set separately, in the txAdmin settings, not in server.cfg.
Common mistakes
- Only opening TCP. The most frequent one. UDP carries the actual gameplay and the master list heartbeat.
- Creating an outbound rule. Windows allows outbound traffic by default. Inbound is what you need.
- Unticking Public on the profile step. A VPS adapter normally sits on the Public profile.
- Testing from inside the VPS. Loopback traffic never touches the firewall, so it always looks like it works.
- A second firewall. If you installed a third-party antivirus with its own firewall, it keeps its own rule list and your Windows Defender Firewall rules do not apply to it.
- Assuming a VPS needs port forwarding. It does not. A VPS has its own public IP, so the OS firewall is the only thing in the way. Port forwarding only applies when you host from a home connection behind a router.
Frequently asked questions
Do I need to open port 30110 as well? No. FiveM uses 30120 for both TCP and UDP by default. 30110 turns up in old guides and is not needed.
Is it safe to leave 40120 open? It is the txAdmin login page, so opening it puts that panel on the internet. Use a strong password and enable two-factor authentication in txAdmin, or leave the port closed and manage the panel over Remote Desktop instead.
Can I disable Windows Firewall instead? You can, and you should not. Turning it off exposes RDP, SMB and every other listening service on the VPS. Creating three rules takes less time than recovering a compromised server.
My ports are open and the server still is not in the list. That is a different problem with its own causes. See FiveM Server Not Showing in the Server List.
Do I have to do this on a DoomHosting FiveM server? No. The ports are configured for you at setup. This only applies to a self-managed VPS.