How to Run FiveM Server for VPS on Ubuntu

Wetin FiveM server for VPS need

FiveM server for VPS na one unprivileged Linux user, one artifact build from Cfx.re, one licence key, and one port wey open for both TCP and UDP. Installation dey take about ten minutes. The rest of this guide go cover the things wey decide whether server fit play well: speed of one CPU core, memory wey your resources need, and management panel wey no suppose ever dey open for public address.

Three prerequisites dey fixed. Server binaries, wey dem dey call artifacts, dey come from official Cfx.re build listing. Licence key dey come from Cfx.re portal for portal.cfx.re, the service wey older guides dey call keymaster, and the key dey tied to address of the machine wey dey use am. Every player wey connect need their own legitimate copy of GTA V (Grand Theft Auto V) for Steam, Rockstar Games Launcher or Epic Games, plus free Cfx.re account. Client dey check game ownership when e start, so server wey build on anything else no go work, and no workaround content of any kind dey covered here.

To host the server na different work from playing on the box. The question of whether you fit run the game itself on a VPS na separate question with different answer.

Wetin make single core speed decide how FiveM server dey feel

FXServer, wey be FiveM server binary, dey run game logic for one main thread. Every resource script, every event handler, and every state update dey pass through that single loop. Extra cores fit help kernel, database, and network stack. Dem no fit split game loop. So, 4 vCPU box with slow core fit stutter when load high, while 2 vCPU box with fast core go remain smooth.

This one turn the usual VPS shopping habit upside down, because people dey focus on core count as the main number. Check speed per core before you pay money. Start with the CPU model:

lscpu | grep -E 'Model name|MHz'

Then find the published single thread score for that model. PassMark single thread rating and Geekbench single-core score dey public. Both of dem measure one core wey dey do work, and na that number matter here. After that, measure the box wey dem actually give you:

sudo apt update && sudo apt install -y sysbench
sysbench cpu --cpu-max-prime=20000 --threads=1 run

Read the events per second line. Run the same command for two providers wey you dey consider, and you fit compare dem properly because the workload na the same and e dey restricted to one core. Repeatable VPS benchmark run show how you fit keep those numbers comparable between boxes.

Then check say the core really belong to your workload:

vmstat 1 5

The last column, st, na steal time: the percentage of time your virtual CPU ready to run but hypervisor make am wait. If the figure dey steady above 1 or 2, e mean say you dey share physical core with busy neighbours. Game loop go feel this immediately as rubber banding. Steal time from noisy neighbour explain how to read that column and wetin you fit do about am.

Memory dey scale with the resources wey you run, no be with slots alone. The base server data from Cfx.re dey use few hundred megabytes. Roleplay framework with forty or fifty resources and MariaDB database for the same box na different machine: 4 GB na sensible minimum, while 8 GB dey comfortable for 32 to 64 slots. Community setups usually publish figures like these, so use dem as starting point and monitor free -m when real players dey load the server.

Create user and install dependencies

Run the server as ordinary user, never as root. Reason dey two. Root no be good habit for any service wey dey face internet. Linux artifact dey run inside bundled Alpine Linux root filesystem, so nobody else fit execute files wey root unpack. Na this be the commonest reason fresh installation no gree start.

sudo adduser --disabled-password --gecos "" fivem
sudo apt update
sudo apt install -y git xz-utils curl tcpdump
sudo -iu fivem

Everything for down here dey run as the fivem user. xz-utils dey required because the download na .tar.xz archive, and git dey used to clone the base server data.

Download one pinned artifact build

The Linux build dey inside the build_proot_linux channel for the Cfx.re artifact server. The Cfx.re server download page dey mark one build as Recommended and a newer one as Latest. Both labels dey move go new builds as releases dey come out. Use the numbered folder instead. If you rebuild your server next month, you go still get the same binary wey you test this month. Upgrade go then be decision wey you make intentionally.

mkdir -p ~/FXServer/server
cd ~/FXServer/server
curl -fLO https://runtime.fivem.net/artifacts/fivem/build_proot_linux/master/35245-6efb47dff473c0e2a12fb50b08d74c0eb24a50d5/fx.tar.xz
tar xf fx.tar.xz
ls

Build 35245 get Recommended label when I check the Cfx.re server download page on 9 October 2026. Open the page, choose Linux, and copy the folder name from the current fx.tar.xz link into the URL. The folder name na the build number plus a commit hash. The old artifacts directory listing wey many guides still link to now dey redirect go the same page.

Pinned build still get limited lifespan. Cfx.re dey support one Recommended artifact until six weeks after the next one for the line. The policy also talk say server artifacts wey no get support and wey older than three months no go fit join from the server browser. Outdated build go continue to run, but players no go fit join am from the browser again. So put upgrades for calendar instead of pinning forever.

ls suppose now show run.sh and one alpine directory. That directory na the main trick. The Linux artifact ships with im own small Alpine root filesystem and starts the server inside am with proot. proot na userspace tool wey dey emulate chroot without root privileges. Na why one download fit run for Ubuntu, Debian, and Rocky without distribution-specific packages.

Now clone the base server data. E hold the default resources wey your server.cfg dey start:

git clone https://github.com/citizenfx/cfx-server-data.git ~/FXServer/server-data

Get server key and write server.cfg

Sign in for portal.cfx.re with your Cfx.re account and create server key. The portal go ask for the IP address of the machine wey go use am, and the key go bind to that address. If you move go new VPS, edit the key for the portal; no create another one. The edit go apply immediately, but FXServer go only validate am again when e restart.

Write ~/FXServer/server-data/server.cfg:

endpoint_add_tcp "0.0.0.0:30120"
endpoint_add_udp "0.0.0.0:30120"

ensure mapmanager
ensure chat
ensure spawnmanager
ensure sessionmanager
ensure basic-gamemode
ensure hardcap

sv_hostname "My FiveM server"
sv_maxclients 48
set onesync on
sv_scriptHookAllowed false

sv_licenseKey ChangeMe

add_ace group.admin command allow
add_principal identifier.fivem:1 group.admin

sv_maxclients fit accept value from 1 to 2048. Value of 32 or more need make onesync set to on or legacy, and value wey pass 64 need on. OneSync na the server state awareness mode, and na wetin allow server pass the small slot count wey the base game get. If you set 128 slots while OneSync dey off, e no go give you 128 slots; e go give you config wey the server reject.

sv_licenseKey dey take the key without quotes and without trailing space. FXServer dey split that line for whitespace, so one extra character fit break validation and make the server refuse to start.

rcon_password no dey inside that file intentionally. RCON (remote console) go only switch on when you set the variable, and e go then listen on the same UDP port wey the game dey use. RCON password for public port na remote command channel into your server. Leave am unset unless you get specific need, and make am long and random if you use am.

sv_scriptHookAllowed remain false. Official documentation mark am as not recommended, because allowing Script Hook V clients fit expose the server to client-side abuse.

add_principal identifier.fivem:1 dey give admin rights to Cfx.re account ID 1. Replace 1 with your own numeric ID. Otherwise, you don give admin rights to another person account and you no give yourself any.

Start am once by hand:

cd ~/FXServer/server-data
bash ~/FXServer/server/run.sh +exec server.cfg

From another SSH session, ask the server about itself:

curl -s http://127.0.0.1:30120/info.json | head -c 200

JSON wey name your server variables and resources means FXServer don bind and e dey answer. Connection refused means e never bind the port, so check the console output instead of guessing.

Server wey no get key go print this and stop:

This server does not have a license key specified. Please set the sv_licenseKey console variable to a key from https://keymaster.fivem.net/.

The message still mention the old keymaster address. That address go lead to the same Cfx.re portal. If the key dey set and the server still refuse to run, the usual cause na say the IP registered with the key no longer match this machine.

FiveM server need open which ports?

Port 30120, for TCP (transmission control protocol) and UDP (user datagram protocol). FiveM dey use one port number for two protocols, and e need both. If you open only TCP, the symptom go confuse you: http://your.ip:30120/info.json go answer for browser, so the server go look healthy, while game client go remain for Failed to get info from server and never join, because the client query and game traffic dey use UDP.

sudo ufw allow OpenSSH
sudo ufw allow 30120/tcp
sudo ufw allow 30120/udp
sudo ufw enable
sudo ufw status verbose

Keep second SSH session open while you enable any firewall. The ufw basics for a VPS explain the default deny policy wey make the rules above enough by themselves.

Most providers still get network firewall outside the guest, and na panel dey control am instead of shell. ufw rule no prove anything about that layer. When TCP dey answer from outside but players still no fit connect, monitor the wire while person dey try connect:

sudo tcpdump -ni any udp port 30120

If packets dey arrive, e mean say outer firewall dey okay and the problem dey inside the server. If everywhere quiet, something in front of the box dey drop the packets, so check the provider panel next.

Manage server with txAdmin without exposing am

txAdmin dey inside the artifact wey you don already download. Start run.sh without +exec argument and e go open web panel for TCP port 40120, then e go print panel URL and short-lived PIN for console. You go use that PIN once to link your Cfx.re account. After that, you go log in with the admin account wey e create.

txAdmin no get default password, so the risk no be password wey you forget to change. The risk na wetin the panel be: remote console. E fit restart server, edit server.cfg, deploy server data, and run commands as your server user. If you leave 40120 reachable from internet, login page for all these functions go dey public address. Scanners fit find open panel ports within hours. No open 40120 for firewall. Reach am through SSH tunnel from your own machine:

ssh -N -L 40120:127.0.0.1:40120 fivem@YOUR_SERVER_IP

Then open http://127.0.0.1:40120 for your browser. The panel traffic go pass inside SSH connection, and the port go remain closed to everybody else.

One trap dey wey you suppose know before you try another way to fix this. txAdmin dey read TXHOST_INTERFACE (default 0.0.0.0) to decide the interface wey e go bind to, and the documentation talk clearly say the same value go apply to FXServer. If you set am to 127.0.0.1 to hide the panel, you go also bind the game server to loopback. That one mean say no player fit reach the server at all. Close the panel port with firewall, no be with that variable. To move the panel to another port, set TXHOST_TXA_PORT. E accepts any value except 30120. The older +set txAdminPort convar dey appear for many guides. txAdmin own documentation mark am as deprecated and talk say e go stop working for future release.

Server make e remain on after you log out

bash run.sh dey die together with your SSH session. tmux dey okay while you dey test: run tmux new -s fivem, start the server, press Ctrl-b then d to detach, and use tmux attach -t fivem to come back. tmux session no dey survive reboot, so anything wey matter to you suppose dey inside systemd unit.

Write /etc/systemd/system/fivem.service:

[Unit]
Description=FiveM FXServer
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=fivem
Environment=HOME=/home/fivem
WorkingDirectory=/home/fivem/FXServer/server-data
ExecStart=/bin/bash /home/fivem/FXServer/server/run.sh +exec server.cfg
Restart=on-failure
RestartSec=10

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now fivem
systemctl status fivem
journalctl -u fivem -f

enable --now dey do two things: e start the service immediately, and e bring the service back after reboot. Server wey you start by hand go disappear after the next kernel update. journalctl -u fivem -f na your console now, because systemd service no get terminal wey you fit type for. If you manage the server through txAdmin instead, remove +exec server.cfg from ExecStart and point WorkingDirectory to /home/fivem/FXServer/server, because txAdmin dey start the game server by itself and keep its data folder beside run.sh.

Wetin to back up, and where e dey

The artifacts no worth backing up, because you fit download the pinned build again within one minute. Four things na only your own.

• ~/FXServer/server-data/resources: every resource wey you install, buy, or write.
• server.cfg, anywhere wey e dey: the complete server configuration, including your admin principals.
• ~/FXServer/server/txData: txAdmin configuration, admin list, and logs. With the Linux artifact, this folder dey created beside run.sh.
• The MariaDB or MySQL database, if your framework dey use one. Characters, money, vehicles, and inventories dey there and nowhere else. So, if you back up resource without database dump, you go restore empty world.

mkdir -p ~/backups
mysqldump -u fivem -p --single-transaction fivem_db > ~/backups/fivem-$(date +%F).sql

Dump wey dey for the same disk with the server no be backup, because na the disk fit fail. Push am comot from the box on a schedule. Na wetin restic backups from a VPS dey do.

Failure modes and the strings you will see

Loader get permission denied. Server go comot immediately with line like this:

run.sh: line 8: /home/fivem/FXServer/server/alpine/opt/cfx-server/ld-musl-x86_64.so.1: Permission denied

Dis one happen because archive extract with sudo, so everything wey dey under alpine/ belong to root and fivem user no fit execute loader wey dey inside am. Fix the ownership with sudo chown -R fivem:fivem /home/fivem/FXServer, or delete the folder and extract am again as fivem.

tar no gree open the download. tar (child): xz: Cannot exec: No such file or directory mean say xz-utils package no dey installed, so tar no fit decompress .tar.xz archive. Install am and extract again. Download wey finish too quickly normally na HTML error page wey save as fx.tar.xz, and tar dey report am as corrupt archive.

Server dey run but nobody fit join. Check the ports first, for dis order: ufw rule for both TCP and UDP on 30120, then provider own network firewall, then licence key registered IP. curl against info.json from outside the box go separate network problem from server problem with one command.

Tick time dey climb as players dey enter. txAdmin performance panel dey show server tick time. When e rise as player count dey increase while overall CPU use look low, one resource dey saturate the main thread. Remember the arithmetic: for 4 vCPU box, one fully loaded core go show roughly 25 percent total CPU for top, and e fit look idle even though e no be. Stop resources one by one and monitor the tick time to find the one wey dey cost you.

Sizing dis against other game servers

A FiveM server wey players fit play need one fast CPU core plus enough memory for the resource list wey you really dey run. Slot count dey come from those two things, and no amount of vCPUs fit fix slow core. Choosing VPS for game servers dey explain dis trade-off for mixed fleet, and running Minecraft server for VPS get the same structure underneath: one main tick loop, so speed per core still dey decide the limit there too.

FAQ

How much CPU and RAM FiveM server need?

One fast core dey matter pass several slow ones, because FXServer dey run game logic for one main thread. Compare published single thread score of the CPU model, then confirm am for the server with sysbench cpu --threads=1 run and check say vmstat dey show near zero steal time. For memory, base Cfx.re server data dey use few hundred megabytes, while roleplay framework with forty or fifty resources plus local database dey comfortable with 8 GB and cramped below 4 GB. These figures na normal community figures, so monitor free -m during peak instead of trusting dem.

Players need to own GTA V before dem fit join my FiveM server?

Yes. Every player wey dey connect need legitimate, licensed copy of GTA V for Steam, Rockstar Games Launcher or Epic Games, plus free Cfx.re account. FiveM client dey check game ownership before e go connect. No supported way dey around this, and running server wey tries bypass am dey outside wetin Cfx.re allows.

Which ports FiveM server need open?

Port 30120 for TCP and UDP, both. HTTP endpoints like info.json and resource downloads dey use TCP, while client's game traffic dey use UDP. If you open only TCP, you fit get confusing case where server answers browser but players see Failed to get info from server. txAdmin need TCP 40120, and you suppose keep that port closed to internet.

E safe to leave txAdmin reachable for port 40120?

No. txAdmin na remote console wey fit restart server, edit configuration and run commands, so exposed panel na exposed control plane for the whole game server. No default password dey, but public login page dey invite credential attacks wey you no fit see. Keep 40120 closed for firewall and reach the panel through SSH tunnel with ssh -N -L 40120:127.0.0.1:40120 user@server, then browse go http://127.0.0.1:40120. No bind txAdmin to 127.0.0.1 with TXHOST_INTERFACE, because that setting still forces game server go loopback and no player go fit connect.

I suppose pin artifact build or always use the latest recommended one?

Pin the numbered build folder. Recommended label dey move go new build regularly, so script wey fetch recommended build fit give you different binary for every rebuild, and server wey work yesterday fit break during redeploy for reasons wey no relate to your changes. Record build number and commit hash wey you test, upgrade deliberately, and keep previous folder for disk so you fit switch back by editing one path for your systemd unit. But no let pin become stale: Cfx.re policy dey make unsupported artifacts wey old pass three months unjoinable from server browser, so upgrade within support window.