Protect txAdmin with Cloudflare Access

Cloudflare Access can add an identity-aware gate to a web panel. It is not a replacement for txAdmin staff permissions and does not proxy ordinary FiveM/RedM game TCP/UDP ports.

Recommended topologyCopy Anchor Link

Staff browser -> HTTPS 443 -> Cloudflare Access -> authenticated proxy/tunnel -> txAdmin TCP panel
Players       -> allocated game TCP/UDP endpoints -> FXServer

Do not simply orange-cloud a :40120 DNS hostname and assume Cloudflare will proxy it. Use an Access-protected HTTPS origin or Cloudflare Tunnel, and do not expose an unprotected direct-origin path that bypasses Access.

Configuration checklistCopy Anchor Link

1. Back up host/proxy configuration and ensure the panel works through a private path first.
2. Create a dedicated admin hostname, such as admin.example.com, not your gameplay hostname.
3. Configure Cloudflare Tunnel or a reverse proxy with TLS on a supported HTTPS port (typically 443) to reach txAdmin's internal TCP listener.
4. Add a Cloudflare Access self-hosted application for that hostname. Permit only intended staff identities; require strong login policy and ideally MFA.
5. Restrict direct origin access using a host firewall or private interface so users cannot visit the backend panel port without the Access gate.
6. Configure trusted proxy forwarding correctly and test authentication, CSRF/session and websocket/streaming behavior on the installed txAdmin version.
7. Keep game ports separately mapped and accessible as required by FXServer.
8. Test logged-out, approved and denied staff accounts from an external network. Verify the backend port is inaccessible directly.

Caution: TXHOST_INTERFACE can also affect enforced game endpoint binding. Binding everything to loopback is not necessarily correct for game traffic, especially inside containers. Use host port restrictions, a private network or a tunnel as appropriate.

Verify you did not weaken securityCopy Anchor Link

• Access denies unauthorized visitors before txAdmin's login page.
• txAdmin still requires its own authenticated staff session and scopes permissions.
• Origin requests bypassing Cloudflare are blocked.
• Players connect through the game ports normally.
• No host API token or cookie appears in the proxy logs.
• Revoking a staff member's Access grant and txAdmin permissions removes access at both layers.

For simpler private administration, a trusted VPN can provide a similar network boundary without exposing an admin hostname.

Sources: Cloudflare Access applications, Cloudflare Tunnel, txAdmin environment.