On this page
Map the complete connection path
Server discovery, connection information, resource downloads and gameplay can use different paths. Record the addresses, ports and transports actually configured rather than deriving the entire policy from a default port. List administration and supporting services separately; they do not need the same public access as player endpoints.
Test both cached and new clients
Compare a fresh client installation with one that already has the server resources. This helps distinguish download failures from gameplay transport problems. Observe the relay, firewall and FXServer together. An HTTP reverse proxy handles the HTTP exchanges it terminates; it does not automatically carry every game exchange. Validate UDP separately against the Cfx.re proxy documentation.
Restrict direct origin access carefully
Where players must use a relay, establish which source addresses reach the backend through that relay. Allow required operational paths and verify return routing before closing other access. Keep an independent management route. Repeat the same connection test after each protection change; getinfo and cURL symptoms then call for targeted investigation.
