Run a FiveM server on a VPS

What a FiveM server on a VPS needs

A FiveM server on a VPS is one unprivileged Linux user, one artifact build from Cfx.re, one licence key, and one port open on both TCP and UDP. The install takes about ten minutes. The rest of this guide covers the parts that decide whether the server is playable: the speed of a single CPU core, the memory your resources need, and a management panel that should never sit open on a public address.

Three prerequisites are fixed. The server binaries, called artifacts, come from the official Cfx.re build listing. The licence key comes from the Cfx.re portal at portal.cfx.re, the service older guides call keymaster, and the key is tied to the address of the machine that uses it. Every player who connects needs their own legitimate copy of GTA V (Grand Theft Auto V) on Steam, the Rockstar Games Launcher or Epic Games, plus a free Cfx.re account. The client checks game ownership when it starts, so a server built on anything else does not work, and no workaround content of any kind is covered here.

Hosting the server is a different job from playing on the box, which is whether you can run the game itself on a VPS and a separate question with a different answer.

Why single core speed decides how a FiveM server feels

FXServer, the FiveM server binary, runs the game logic on one main thread. Every resource script, every event handler and every state update passes through that single loop. Extra cores help the kernel, the database and the network stack. They do not split the game loop. So a 4 vCPU box on a slow core stutters under load while a 2 vCPU box on a fast core stays smooth.

That inverts the usual VPS shopping habit, where core count is the headline number. Check per core speed before you commit money. Start with the CPU model:

lscpu | grep -E 'Model name|MHz'

Then look up that model's published single thread score. The PassMark single thread rating and the Geekbench single-core score are both public, and both measure one core doing work, which is the number that matters here. After that, measure the box you were actually given:

sudo apt update && sudo apt install -y sysbench
sysbench cpu --cpu-max-prime=20000 --threads=1 run

Read the events per second line. Run the same command on two candidate providers and you can compare them honestly, because the workload is identical and it is confined to one core. A repeatable VPS benchmark run shows how to keep those numbers comparable between boxes.

Then check that the core is really yours:

vmstat 1 5

The last column, st, is steal time: the share of time your virtual CPU was ready to run and the hypervisor made it wait. A steady figure above 1 or 2 means you share a physical core with busy neighbours, and a game loop feels that at once as rubber banding. Steal time from a noisy neighbour covers how to read that column and what to do about it.

Memory scales with the resources you run, not with slots alone. The base server data from Cfx.re runs in a few hundred megabytes. A roleplay framework with forty or fifty resources and a MariaDB database on the same box is a different machine: 4 GB is a sensible floor, and 8 GB is comfortable at 32 to 64 slots. Those are typical figures published by community setups, so treat them as a starting point and watch free -m under real player load.

Create a user and install the dependencies

Run the server as an ordinary user, never as root. There are two reasons. Root is a bad habit on any internet-facing service. And the Linux artifact runs inside a bundled Alpine Linux root filesystem, so files unpacked by root cannot be executed by anyone else, which is the most common reason a fresh install refuses to start.

sudo adduser --disabled-password --gecos "" fivem
sudo apt update
sudo apt install -y git xz-utils curl tcpdump
sudo -iu fivem

Everything below runs as the fivem user. xz-utils is required because the download is a .tar.xz archive, and git is used to clone the base server data.

Download a pinned artifact build

The Linux build lives in the build_proot_linux channel of the Cfx.re artifact server. The listing marks one build as the latest recommended one, and that label moves to a new build every few weeks. Pin the numbered folder instead. Rebuilding your server next month then gives you the same binary you tested this month, and an upgrade becomes a decision you make on purpose.

mkdir -p ~/FXServer/server
cd ~/FXServer/server
curl -fLO https://runtime.fivem.net/artifacts/fivem/build_proot_linux/master/25770-8ddccd4e4dfd6a760ce18651656463f961cc4761/fx.tar.xz
tar xf fx.tar.xz
ls

Build 25770 carried the recommended label when I read the listing in August 2026. Open the same directory in a browser to see the current one, then paste that folder name, which is the build number plus a commit hash, into the URL.

ls should now show run.sh and an alpine directory. That directory is the whole trick: the Linux artifact ships its own small Alpine root filesystem and starts the server inside it using proot, a userspace tool that emulates chroot without root privileges. That is why one download runs on Ubuntu, Debian and Rocky with no distribution specific packages.

Now clone the base server data, which holds the default resources your server.cfg starts:

git clone https://github.com/citizenfx/cfx-server-data.git ~/FXServer/server-data

Get a licence key and write server.cfg

Sign in at portal.cfx.re with your Cfx.re account and create a server key. The portal asks for the IP address of the machine that will use it, and the key is bound to that address. Moving to a new VPS means editing the key in the portal, not creating a second one. The edit applies straight away, but FXServer only revalidates when it restarts.

Write ~/FXServer/server-data/server.cfg:

endpoint_add_tcp "0.0.0.0:30120"
endpoint_add_udp "0.0.0.0:30120"

ensure mapmanager
ensure chat
ensure spawnmanager
ensure sessionmanager
ensure basic-gamemode
ensure hardcap

sv_hostname "My FiveM server"
sv_maxclients 48
set onesync on
sv_scriptHookAllowed false

sv_licenseKey ChangeMe

add_ace group.admin command allow
add_principal identifier.fivem:1 group.admin

sv_maxclients accepts a value from 1 to 2048. A value of 32 or more needs onesync set to on or legacy, and a value above 64 needs on. OneSync is the server's state awareness mode, and it is what lets a server go past the base game's small slot count. Setting 128 slots with OneSync off does not give you 128 slots, it gives you a config the server rejects.

sv_licenseKey takes the key with no quotes and no trailing space. FXServer splits that line on whitespace, so one stray character breaks validation and the server refuses to start.

rcon_password is missing from that file on purpose. RCON (remote console) is only switched on when the variable is set, and it then listens on the same UDP port as the game. An RCON password on a public port is a remote command channel into your server. Leave it unset unless you have a specific need, and make it long and random if you do.

sv_scriptHookAllowed stays false. The official documentation marks it as not recommended, because allowing Script Hook V clients opens the server to client side abuse.

add_principal identifier.fivem:1 grants admin rights to Cfx.re account ID 1. Replace the 1 with your own numeric ID, or you have granted admin to somebody else's account and none to yourself.

Start it once by hand:

cd ~/FXServer/server-data
bash ~/FXServer/server/run.sh +exec server.cfg

From a second SSH session, ask the server about itself:

curl -s http://127.0.0.1:30120/info.json | head -c 200

JSON naming your server variables and resources means FXServer is bound and answering. Connection refused means it never bound the port, so read the console output instead of guessing.

A server with no key prints this and stops:

This server does not have a license key specified. Please set the sv_licenseKey console variable to a key from https://keymaster.fivem.net/.

The message still names the old keymaster address. That address leads to the same Cfx.re portal. If the key is set and the server still refuses to run, the usual cause is that the IP registered against the key no longer matches this machine.

Which ports does a FiveM server need open?

Port 30120, on TCP (transmission control protocol) and UDP (user datagram protocol). FiveM uses one port number for two protocols and it needs both of them. Open only TCP and the symptom is confusing: http://your.ip:30120/info.json answers in a browser, so the server looks healthy, while the game client sits on Failed to get info from server and never joins, because the client's own query and its game traffic run over UDP.

sudo ufw allow OpenSSH
sudo ufw allow 30120/tcp
sudo ufw allow 30120/udp
sudo ufw enable
sudo ufw status verbose

Keep a second SSH session open while you enable any firewall. The ufw basics for a VPS explains the default deny policy that makes the rules above enough on their own.

Most providers also run a network firewall outside the guest, controlled from the panel rather than from the shell. A ufw rule proves nothing about that layer. When TCP answers from outside and players still cannot connect, watch the wire while somebody tries:

sudo tcpdump -ni any udp port 30120

Packets arriving means the outer firewall is fine and the fault is inside the server. Silence means something in front of the box is dropping them, so check the provider panel next.

Manage the server with txAdmin without exposing it

txAdmin ships inside the artifact you already downloaded. Start run.sh with no +exec argument and it brings up a web panel on TCP port 40120, then prints the panel URL and a short lived PIN to the console. You use that PIN once to link your Cfx.re account, and from then on you log in with the admin account it creates.

txAdmin has no default password, so the risk is not a credential you forgot to change. The risk is what the panel is: a remote console. It restarts the server, edits server.cfg, deploys server data and runs commands as your server user. Leaving 40120 reachable from the internet puts a login page for all of that on a public address, and scanners find open panel ports within hours. Do not open 40120 in the firewall. Reach it through an SSH tunnel from your own machine:

ssh -N -L 40120:127.0.0.1:40120 fivem@YOUR_SERVER_IP

Then open http://127.0.0.1:40120 in your browser. The panel traffic rides inside the SSH connection, and the port stays closed to everybody else.

One trap is worth knowing before you try to fix this a different way. txAdmin reads TXHOST_INTERFACE (default 0.0.0.0) to decide which interface to bind to, and the documentation is explicit that the same value is forced onto FXServer. Set it to 127.0.0.1 to hide the panel and you also bind the game server to loopback, so no player can reach the server at all. Close the panel port with the firewall, not with that variable. To move the panel to another port, set TXHOST_TXA_PORT, which accepts anything except 30120. The older +set txAdminPort convar appears in many guides; txAdmin's own documentation marks it deprecated and says it will stop working in a future release.

Keep the server running after you log out

bash run.sh dies with your SSH session. tmux is fine while you are testing: run tmux new -s fivem, start the server, press Ctrl-b then d to detach, and use tmux attach -t fivem to come back. A tmux session does not survive a reboot, so anything you care about belongs in a systemd unit.

Write /etc/systemd/system/fivem.service:

[Unit]
Description=FiveM FXServer
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=fivem
Environment=HOME=/home/fivem
WorkingDirectory=/home/fivem/FXServer/server-data
ExecStart=/bin/bash /home/fivem/FXServer/server/run.sh +exec server.cfg
Restart=on-failure
RestartSec=10

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now fivem
systemctl status fivem
journalctl -u fivem -f

enable --now does two jobs: it starts the service immediately, and it brings the service back after a reboot. A hand-started server is gone after the next kernel update. journalctl -u fivem -f is your console now, because a systemd service has no terminal you can type into. If you manage the server through txAdmin instead, remove +exec server.cfg from ExecStart and point WorkingDirectory at /home/fivem/FXServer/server, because txAdmin starts the game server itself and keeps its data folder next to run.sh.

What to back up, and where it lives

The artifacts are not worth backing up, since you can download the pinned build again in a minute. Four things are yours alone.

• ~/FXServer/server-data/resources: every resource you installed, bought or wrote.
• server.cfg, wherever it lives: the whole server configuration, including your admin principals.
• ~/FXServer/server/txData: txAdmin's configuration, admin list and logs. With the Linux artifact this folder is created next to run.sh.
• The MariaDB or MySQL database, if your framework uses one. Characters, money, vehicles and inventories live there and nowhere else, so a resource backup without a database dump restores an empty world.

mkdir -p ~/backups
mysqldump -u fivem -p --single-transaction fivem_db > ~/backups/fivem-$(date +%F).sql

A dump sitting on the same disk as the server is not a backup, because the disk is the thing that fails. Push it off the box on a schedule, which is what restic backups from a VPS is for.

Failure modes and the strings you will see

Permission denied on the loader. The server exits immediately with a line like this:

run.sh: line 8: /home/fivem/FXServer/server/alpine/opt/cfx-server/ld-musl-x86_64.so.1: Permission denied

This happens because the archive was extracted with sudo, so everything under alpine/ belongs to root and the fivem user cannot execute the loader inside it. Fix the ownership with sudo chown -R fivem:fivem /home/fivem/FXServer, or delete the folder and extract it again as fivem.

tar refuses to open the download. tar (child): xz: Cannot exec: No such file or directory means the xz-utils package is missing, so tar cannot decompress a .tar.xz archive. Install it and extract again. A download that finishes far too quickly is usually an HTML error page saved as fx.tar.xz, and tar reports that as a corrupt archive.

The server runs and nobody can join. Check the ports first, in this order: the ufw rule for both TCP and UDP on 30120, then the provider's own network firewall, then the licence key's registered IP. curl against info.json from outside the box separates a network problem from a server problem in one command.

Tick time climbs as players arrive. txAdmin's performance panel shows the server tick time. When it rises with player count while overall CPU use looks low, one resource is saturating the main thread. Remember the arithmetic: on a 4 vCPU box, a single fully loaded core reads as roughly 25 percent total CPU in top, which looks idle and is not. Stop resources one at a time and watch the tick time to find which one costs you.

Sizing this against other game servers

A playable FiveM server is a fast single core plus enough memory for the resource list you actually run. Slot count follows from those two, and no amount of vCPUs fixes a slow core. Picking a VPS for game servers works through that trade for a mixed fleet, and running a Minecraft server on a VPS has the same shape underneath: one main tick loop, so per core speed decides the ceiling there too.

FAQ

How much CPU and RAM does a FiveM server need?

One fast core matters more than several slow ones, because FXServer runs its game logic on a single main thread. Compare the published single thread score of the CPU model, then confirm on the box with sysbench cpu --threads=1 run and check that vmstat shows near zero steal time. For memory, the base Cfx.re server data runs in a few hundred megabytes, while a roleplay framework with forty or fifty resources plus a local database is comfortable at 8 GB and cramped below 4 GB. Those are typical community figures, so watch free -m at peak instead of trusting them.

Do players need to own GTA V to join my FiveM server?

Yes. Every connecting player needs a legitimate, licensed copy of GTA V on Steam, the Rockstar Games Launcher or Epic Games, plus a free Cfx.re account. The FiveM client checks game ownership before it will connect. There is no supported way around that, and running a server that tries to work around it is outside what Cfx.re allows.

Which ports does a FiveM server need open?

Port 30120 on TCP and on UDP, both. The HTTP endpoints such as info.json and resource downloads use TCP, and the client's game traffic uses UDP. Opening only TCP produces the confusing case where the server answers a browser but players see Failed to get info from server. txAdmin needs TCP 40120, and that port should stay closed to the internet.

Is it safe to leave txAdmin reachable on port 40120?

No. txAdmin is a remote console that restarts the server, edits the configuration and runs commands, so an exposed panel is an exposed control plane for the whole game server. There is no default password, but a public login page invites credential attacks you cannot see. Leave 40120 closed in the firewall and reach the panel through an SSH tunnel with ssh -N -L 40120:127.0.0.1:40120 user@server, then browse to http://127.0.0.1:40120. Do not bind txAdmin to 127.0.0.1 with TXHOST_INTERFACE, because that setting also forces the game server onto loopback and no player will be able to connect.

Should I pin an artifact build or always take the latest recommended?

Pin the numbered build folder. The recommended label moves to a new build regularly, so a script that fetches the recommended build can hand you a different binary on every rebuild, and a server that worked yesterday can break on a redeploy for reasons unrelated to your changes. Record the build number and commit hash you tested, upgrade on purpose, and keep the previous folder on disk so you can switch back by editing one path in your systemd unit.