Before you start
List services, protocols, addresses, ports, origin location and return routes. Establish who manages each device and who can authorise address announcements. Keep existing configurations and arrange maintenance with recovery access before changing a tunnel or route.
Reverse proxies relay a particular protocol
A proxy receives exchanges and relays them to a downstream service. HTTP reverse proxies handle web requests, while TCP or UDP relays serve other needs. Settings, connection state and limits depend on the protocol and implementation. An HTTP proxy does not automatically carry every game’s traffic.
For FiveM, separate connection endpoints, files and gameplay. Check advertised addresses and services that stay direct. Establish whether client addresses are preserved, what information reaches the origin and which trust rules match your version.
GRE carries traffic through a tunnel
GRE encapsulates packets between endpoints. It can carry already filtered traffic to remote infrastructure, but encapsulation does not filter the traffic itself. GRE alone also provides neither the encryption nor authentication of a secure VPN.
Check that equipment and networks permit GRE. In IPv4 it uses an IP protocol number, rather than simply a TCP or UDP port to open. Encapsulation adds headers: adapt and test the effective MTU, routes and return path. A connection working with small packets may still fail with larger packets.
BGP announces routes with authorisation
BGP exchanges routing information between autonomous systems. Protection architectures can use it to direct traffic through mitigation networks and towards the intended destination. It replaces neither filtering nor application security.
You need a routing agreement, authorised resources and the provider’s prerequisites. Announcing third-party prefixes requires real authorisation. Accepted prefix sizes, filters and validation processes vary between operators. A VPS address does not automatically grant the right or ability to announce a prefix on the internet.
Document outbound and return paths
Draw the client-to-application path and the response path. Record address changes, connection termination and components keeping state. An inconsistent return route can cause failure even when inbound routing appears correct.
Identify bypass paths too: old addresses, secondary DNS, files, voice or administration tools. Before restricting an origin, verify legitimate sources and required services. Remote protection does not remove the need to control direct exposure of the destination.
Validate using small coordinated tests
Test the actual protocol with a normal connection, then files and essential functions. Inspect logs, routes and fragmentation or timeout errors when present. A working website does not validate a game tunnel; an active tunnel does not prove an application is listening.
Change one component at a time with a rollback configuration available. Coordinate and limit any test load. Changing DNS, proxy, tunnel and firewall simultaneously makes it difficult to identify why a test fails.
Choose according to resources you control
For an HTTP application, assess a proxy and origin restrictions first. For TCP or UDP games, establish a compatible relay or tunnel. For infrastructure with authorised prefixes and networking expertise, assess documented BGP routing.
Compare responsibilities, actual availability, traffic limits and pricing for the chosen scope. Combining mechanisms can help, but each layer adds settings and monitoring requirements. Keep a simple description your team and provider can verify together.
For your situation
| Situation | Next check |
|---|---|
| Web application | Assess an HTTP proxy with application-appropriate trust settings and origin access. |
| Remote game traffic | Confirm TCP/UDP requirements, tunnel or relay, MTU and return routing. |
| Authorised network prefixes | Assess BGP with the provider, announcement permissions, filters and a cutover procedure. |
Official sources
These documents describe the relevant protocols and software. Your service terms and configuration still need to be checked.