The famous orange cloud in Cloudflare's free plan does not protect your game server's game port. This is one of the most common misconceptions among game server operators. Many people move their domain to Cloudflare, switch on the orange cloud, and assume they are now immune to DDoS attacks. In reality, when an attacker floods your game port with UDP traffic, Cloudflare is not even in the path. This guide explains what Cloudflare actually does, what it does not do, and what genuinely protects a game server.
The proxy service in Cloudflare's free and widely used plans is an HTTP/HTTPS reverse proxy. It only intercepts and processes web traffic — requests arriving on HTTP ports such as 80 and 443. Game servers almost never use those ports.
MTA:SA receives game traffic on 22003/UDP by default. FiveM uses 30120, Minecraft Bedrock uses 19132/UDP, and Minecraft Java uses 25565/TCP. None of these fall within Cloudflare's proxy scope. When your players connect, their traffic does not pass through Cloudflare — it goes straight to your server's IP address.
When you set a DNS record to "proxied" (orange cloud), that hostname no longer resolves to your server's IP but to a Cloudflare IP address. A visitor's browser reaches Cloudflare first; Cloudflare inspects the request, filters it, serves it from cache, or forwards it to your origin. This architecture is extremely effective for websites.
But the mechanism depends on Cloudflare being able to understand the HTTP protocol. It reads request headers, determines the target hostname from the Host header or the TLS SNI field, and routes accordingly. A UDP game packet contains no such header. There is nothing inside the packet that says "I am destined for this hostname." That is why a conventional HTTP proxy cannot technically carry game traffic.
Most game servers prefer UDP because they need low latency. UDP is connectionless: there is no handshake, and lost packets are not retransmitted. That is excellent for gameplay but a weakness for security, because the source IP address is trivially spoofable. This is precisely why amplification and flood attacks are so common over UDP.
On the MTA:SA side there are three ports worth knowing:
Turkey (Türkçe)
Worldwide (English)
22003/UDP — the main game port players connect to22005/TCP — the HTTP port used for downloading resource files22126/UDP — the ASE query port (game port + 123), which lets server lists see your serverOnly 22005 is HTTP-based and could in theory sit behind a web proxy. Port 22003, the heart of the game, is directly exposed.
This is the most dangerous part, because it creates a false sense of security.
For players to connect, a record such as play.yourdomain.com must return your real IP address. If you put that record behind the orange cloud, players simply cannot connect, because the Cloudflare IP is not listening on your game port. So you are forced to leave it as "DNS only" (grey cloud) — and at that moment your real IP becomes public. A simple nslookup or dig is enough to find it.
Even if your apex domain is proxied, your IP usually leaks elsewhere:
cpanel., ftp., mail. and panel. are often left grey-clouded.In other words, hiding an IP is not a single-toggle job, and in a game server scenario it is often not achievable at all.
Quite the opposite — it is very useful when applied to the right layer. You just have to define its job correctly. Cloudflare genuinely adds value to these parts of your game project:
In short, Cloudflare protects the web face of your game server, not the game port. Making that distinction is the first step toward a sound architecture.
Cloudflare does offer products that can carry non-web traffic. Spectrum is a proxy service that can pass non-HTTP TCP and UDP applications through the Cloudflare network. Magic Transit operates at the network layer (L3), using BGP announcement to place an entire IP range behind Cloudflare.
These products can genuinely protect UDP game traffic. In practice, however, they are not a fit for a typical game server owner. Spectrum's UDP support is limited to higher-tier plans, and Magic Transit requires you to own your own IP range. These are enterprise-scale solutions, and because plan coverage changes over time, you should review Cloudflare's own current documentation before making a decision.
Real protection begins where traffic is filtered before it reaches your server. A volumetric UDP flood aims to saturate your network link; no matter what you configure inside the server, once the pipe is full the game server becomes unreachable. This is why your hosting provider having a DDoS-protected network infrastructure matters more than any software-side measure you can take. Nubitro's game server services and MTA server packages run on DDoS-protected network infrastructure.
Network-level protection is the foundation, but in-server hardening still matters:
You can find the MTA-specific details of these steps in our guide to protecting an MTA:SA server against DDoS attacks.
Even when part of an attack gets through the filter, a strong processor and fast storage keep your server standing. High single-core performance is critical for game servers, because most of them run their main loop on a single core. Our AMD Ryzen 9 9950X based Turkey-location VDS options are configured with DDR5 memory and NVMe M2 SSD storage to meet exactly this need.
MTA:SA: Leave the game record grey-clouded and put your marketing site and UCP behind the orange cloud. Placing the 22005 HTTP port behind a CDN can shorten resource download times.
FiveM: Port 30120 uses both TCP and UDP and cannot sit behind the Cloudflare proxy. Your server list entry already makes your IP visible.
Minecraft: Although Java Edition uses TCP, the orange cloud still does not work because the traffic is not HTTP. An SRV record only handles port redirection; it provides no protection. Bedrock is entirely UDP.
It provides a significant protection layer for web traffic. But that protection only applies to HTTP/HTTPS requests passing through Cloudflare. UDP traffic arriving directly at your game port is outside that scope.
Only for web records that are orange-clouded. Because the record players connect to must return the real IP, your game server's address stays exposed.
Cloudflare Spectrum is the product built for this, but its UDP support is limited to higher-tier plans. Check Cloudflare's own documentation for current coverage.
The lasting fix is to change the IP address and close the leak sources — historical DNS records, MX, subdomains and outbound connections. Changing the IP without doing that usually buys only temporary relief.
No. By the time packets reach your server, your link is already saturated. Filtering has to happen upstream, at the network level.
Technically yes, but it is not advisable. An attack aimed at the web side will also affect your game server. Separate them where you can.
Cloudflare's orange cloud is an HTTP proxy and does not protect the UDP ports game servers rely on. Because your game record necessarily exposes your real IP address, the assumption that "I use Cloudflare, so my IP is hidden" does not hold in most scenarios either. Use Cloudflare for your marketing site, forum, user panel and file distribution — and rely on your hosting provider's network infrastructure to protect the game port. The correct order of defence is: upstream filtering at the network level, then in-server hardening, then sufficient hardware headroom.
If you want to host your game server on DDoS-protected network infrastructure, take a look at our game server packages, or get in touch if you are unsure which setup fits your configuration. Our 24/7 support team can help you plan the right deployment for your project.