citizenfx/fivem-docs

Issue with 'sv_listingHostOverride' and Reverse Proxy URL Resolution

MiguelFGM opened this issue · 1 comments

Following up on the issue: Always Attempting to Connect Using Default Port
Related pull request: Proxy Setup Guide URL Resolution Clarification

Issue:
While using the sv_listingHostOverride for Reverse Proxying setup, FiveM is not properly resolving into the correct URL that it should, I'll provide an example, where this setting is being used as:

  • sv_listingHostOverride "play.domain.com"

Resulting behavior:

  1. connect play.domain.com wrongly attempts to connect to "https://play.domain.com:30120"
  2. connect http://play.domain.com or connect https://play.domain.com correctly attempts to connect to "http://play.domain.com" or "https://play.domain.com"

Concern:
Now let's put logic into action here, when we are setting up a Reverse Proxy, we are trying to make the TCP ports go forward into a Reverse Proxy system such as NGINX or any Content Delivery Network, which can provide us tons of security and flexible ways to develop our firewalls, which prevent issues such as DDoS Attacks.
In these terms, we should be aware that we are dealing with players that are non-related to IT environments (in most cases).
When we set up CloudFlare as Reverse Proxying (Ignoring products such as Argo Tunnels) we know that Cloudflare will proxy_pass those connections to port 80 or 443, leaving the door closed to the possibility of proxying pass into other ports, such as any other reverse proxy, they only proxy_pass into port 80 or 443.
So in this environment why are forcing the default domain connections using the connect command that has a reverse proxy setup on it to resolve into play.domain.com:30120? In these terms we are being forced to set our reverse proxy with NGINX in our own server and not use AnyCast networks of services such as content delivery networks like Cloudflare, ignoring completely DDoS Protection and developing a pseudo-proxy that in the end will do nothing, Reverse Proxy should point to 80 or 443 and NOT 30120 otherwise we would simply use the server IP as in the end, it would be the same.

Sure, we can use "connect http://domain.com" or "connect https://domain.com" but good luck for us making our players who are NOT related to IT understand that they should place https:// or http:// before writing the domain in question.

I'm writing this because we can't properly set a reverse proxy due to the same fact (it's resolving to https://play.domain.com:30120) and our reverse proxy only proxy_passes to port 80 or 443 (as any other reverse proxy solution), we limited to either pay 200€/mo for a dedicated IP where they can allow port 30120, or remove the reverse proxying function and get DDoS Attacks.

I would also like to mention that, when a connection happens by the serverList it will properly resolve into "https://play.domain.com", so, via serverList, it always works as it doesn't add the :30120 at the end of the connection, so I have no clue why the connect command does.

Request:
Clarification and resolution of this issue to enable secure and efficient server operation using standard reverse proxy configurations.

Thank you for your attention to this critical matter.

Wrong github, moved this thread into -> citizenfx/fivem#2280