How to set up Cloudflare Spectrum for your MU server

Cloudflare is ubiquitous in website protection, but most MU Online administrators find out the hard way that the standard plan doesn't protect the game itself. The reason is technical and simple: MU Online uses raw TCP between the client and the ConnectServer/GameServer, while Cloudflare's ordinary web proxy only understands HTTP and HTTPS. When an attack targets the game port, the web proxy sees nothing and the server goes down. Cloudflare's own solution for this scenario is Spectrum, a layer 4 proxy that extends the company's mitigation network to any TCP or UDP application. This advanced tutorial shows how to configure it correctly for an MU server, with examples that vary by plan/version.

It is worth stating up front: Spectrum is a paid product, generally available on Cloudflare's higher plans. It is not the only way to protect TCP traffic (providers with dedicated scrubbing and GRE tunnels also work), but it is one of the most accessible for those who already use Cloudflare for the website and want to unify the protection. If the budget doesn't allow it, the concept of hiding the IP and filtering at layer 4 remains valid with another vendor.

Prerequisites

Before configuring, have on hand:

• A Cloudflare account with your server's domain already added and DNS managed by Cloudflare (nameservers pointed).
• A plan that includes Spectrum. Availability and port limits vary by plan/version, so confirm in the panel first.
• The real IP and ports of your server: the ConnectServer port and the GameServers' port range. The exact values vary by emulator version.
• Access to the game client to edit the ServerList / connection file and point it to the new protected hostname.
• Administrative access to the Windows Server to adjust the firewall and restrict game traffic to Cloudflare IPs only.
• A backup of the client and a rollback plan, since a wrong address configuration leaves players unable to connect.

If the server is not up yet, start with the how to create an MU Online server guide and come back here to harden the game connection.

How Spectrum works

Understanding the flow avoids most configuration errors. Without Spectrum, the game client connects directly to the server's real IP, which is exposed to any attack. With Spectrum, the path changes:

1. The client connects to a hostname (for example, play.yourdomain.com) that resolves to a Cloudflare Anycast IP.
2. Cloudflare receives the TCP connection at one of its hundreds of locations, applies layer 4 DDoS mitigation, and cleans the malicious traffic.
3. Legitimate traffic is forwarded to your server's real (origin) IP inside Cloudflare's network.
4. The server responds to Cloudflare, which returns the response to the player.

The result is that the real IP never appears to the player or the attacker. The direct attack surface disappears, as long as you close the other IP leaks and lock down the firewall.

Step 1: prepare the domain and DNS

With the domain already managed by Cloudflare, create a DNS record for the hostname players will use in the game, for example play.yourdomain.com. How that record behaves depends on how Spectrum is configured; in general the Spectrum application is what starts answering for that hostname on the defined port.

Critical point: audit all existing DNS records to ensure that none point to the real IP. A forgotten A record like server.yourdomain.com pointing to the origin IP nullifies the entire protection, because the attacker finds the real IP there and attacks directly, bypassing Spectrum. This also applies to historical, already-indexed records; if the real IP was ever public, it is best to swap it for a new origin IP.

Step 2: create the Spectrum application

In the Cloudflare panel, go to the Spectrum section and create a new application. The essential fields (the exact names vary by panel version):

1. Protocol and edge port. The port on which Cloudflare will listen for player connections. It is common to keep the same port the ConnectServer uses, so you don't have to change the client beyond the hostname.
2. Edge hostname. The play.yourdomain.com that players will access.
3. Origin. The server's real IP and the corresponding internal port, where Cloudflare forwards the clean traffic.
4. Proxy settings. Options such as proxy protocol (to preserve the player's real IP in the server logs) and connection limits, which vary by plan.

Repeat the process for each port that needs protection. The ConnectServer and each GameServer range normally require their own application configuration. Document each mapping of edge port to origin port, because that table will be your reference when debugging connection problems.

# Conceptual mapping example (the values vary by version/emulator)
# play.yourdomain.com : connectserver_port  ->  REAL_IP : connectserver_port
# play.yourdomain.com : gameserver_port_1   ->  REAL_IP : gameserver_port_1
# play.yourdomain.com : gameserver_port_2   ->  REAL_IP : gameserver_port_2

Step 3: point the game client

There is no point configuring Spectrum if the game client still points to the real IP. The client's server list file (the ServerList.dat, MainInfo, or equivalent, which varies by version) must point to the protected hostname play.yourdomain.com and the configured edge port.

Steps:

1. Locate the connection file inside the client folder. In many Season 6 clients it is encrypted and must be edited with your emulator's correct tool.
2. Replace the destination address with the protected hostname.
3. Confirm that the port matches the edge port defined in the Spectrum application.
4. Generate a new installer or update package with the corrected client and distribute it to players.

Test with a clean client, from outside your network, to make sure the connection completes the full flow: client, Cloudflare, server, and back. A test done from within the server's own network can be misleading, because the internal route differs.

Step 4: lock down the firewall at the origin

This step is what closes the defense. Once Spectrum is forwarding the traffic, you must configure the Windows Server firewall to accept connections on the game ports only from Cloudflare IPs, refusing any direct connection from other sources. That way, even if the real IP leaks in the future, a direct attack is rejected at the edge of your server.

# Example: allow the game port only for Cloudflare IP ranges
# (Replace with the official Cloudflare IP list, which changes over time)
New-NetFirewallRule -DisplayName "Game via Cloudflare" -Direction Inbound `
  -Protocol TCP -LocalPort GAME_PORT -RemoteAddress CLOUDFLARE_RANGES -Action Allow
New-NetFirewallRule -DisplayName "Block Direct Game" -Direction Inbound `
  -Protocol TCP -LocalPort GAME_PORT -Action Block

Keep the Cloudflare IP range list up to date, since it changes periodically. An outdated list may block legitimate traffic forwarded through new ranges. The official ranges are published by Cloudflare itself and change over time.

Step 5: preserve the player's real IP (proxy protocol)

A side effect of the proxy is that, without extra configuration, all connections arrive at the server with the Cloudflare IP as the source, and you lose the ability to identify and ban players by IP. To recover the player's real IP, Spectrum offers the proxy protocol, which injects the true source IP at the start of the connection. The emulator needs to support reading that header, which not all do. Check your version's compatibility before enabling it, because turning on the proxy protocol without server support breaks the connections.

Step 6: validate the protection

Once everything is configured, validate objectively:

• Verify from an external machine that the hostname resolves to a Cloudflare IP, and not to the real IP.
• Confirm that a direct connection attempt to the real IP, on the game port, is refused by the firewall.
• Test the full login and gameplay flow for several minutes, watching latency and stability.
• Check the server logs to confirm that the players' IPs appear correctly (if the proxy protocol is active).

Common errors and fixes

Launch checklist

• Domain managed by Cloudflare with active DNS
• Plan with Spectrum confirmed and available
• All DNS records audited without exposing the real IP
• Real IP swapped if it was ever public
• Spectrum application created for the ConnectServer port
• Spectrum application created for each GameServer range
• Edge-to-origin port mapping documented
• Game client pointing to the protected hostname
• New installer/update distributed to players
• Firewall accepting the game only from Cloudflare IP ranges
• Direct-connection block rule active at the origin
• Proxy protocol evaluated for emulator compatibility
• Direct connection to the real IP tested and confirmed refused
• Full login and gameplay flow validated from an external machine
• Latency measured and acceptable for the players' region

Conclusion

Cloudflare Spectrum solves the most dangerous blind spot in MU Online server protection: the game's raw TCP traffic, which the ordinary web proxy simply ignores. By forwarding the ConnectServer and GameServer connections through Cloudflare's global network, you hide the real IP and gain layer 4 mitigation without changing hosting providers. But Spectrum only delivers that protection when the rest is locked down: DNS audited, the client pointing to the protected hostname, and the firewall refusing direct connections at the origin. Once the full configuration is done with the values calibrated to your plan and emulator (which vary by plan/version), your game traffic gains the same shielding that large services use, and the attacks that used to take the server down dissolve before getting anywhere near the real IP.

Frequently asked questions