---
title: "Hosting FastDL Behind Cloudflare (Free CDN)"
excerpt: "Put your CS 1.6 FastDL mirror behind Cloudflare's free CDN: point sv_downloadurl at a proxied domain, force caching of .bsp and .bz2 with a Cache Rule, and avoid the file-type caching trap."
category: "administration"
tags: "fastdl, cloudflare"
image: ""
read_time: "8 min read"
---
<p>If your FastDL host is a single VPS, every joining player pulls maps straight from it &mdash; fine until a popular map change sends fifty clients at your origin at once. Putting the mirror behind Cloudflare's free CDN caches those static files at the edge, so the second and every subsequent client downloads from a nearby Cloudflare node instead of hammering your box. It is free and effective, but Cloudflare does not cache <code>.bsp</code> and <code>.bz2</code> by default, and that trap is why most \"Cloudflare FastDL\" attempts see no benefit.</p>

<h2>1. Prerequisite: a working origin mirror</h2>
<p>Cloudflare sits in front of a real web server &mdash; it does not host files itself. Get a normal <a href="/tutorials/fastdl-setup-guide">FastDL mirror</a> working first, with the correct <code>cstrike/</code> path layout and, ideally, <a href="/tutorials/fastdl-bzip2-compression">bzip2-compressed files</a>. Confirm the origin serves a map over plain HTTP before adding the CDN. Cloudflare cannot fix a broken origin path; it will just cache the 404.</p>

<h2>2. Put the domain on Cloudflare and proxy it</h2>
<p>Add your domain to Cloudflare, then create a DNS record for the FastDL subdomain pointing at your origin IP, with the proxy (orange cloud) <strong>on</strong>:</p>
<pre>Type  Name  Content        Proxy
A     dl    203.0.113.10   Proxied (orange cloud)</pre>
<p>Proxied is what routes traffic through Cloudflare's edge and enables caching. A \"DNS only\" (grey cloud) record points clients straight at your origin and gives you no CDN at all. Then set <code>sv_downloadurl</code> to the proxied hostname:</p>
<pre>// server.cfg
sv_downloadurl "http://dl.example.com/cs"</pre>
<p>HTTPS works too and Cloudflare gives you a certificate; just make sure the origin also answers so Cloudflare can fetch and cache.</p>

<h2>3. Force caching of game files (the essential step)</h2>
<p>Cloudflare's default cache only covers a fixed list of static extensions &mdash; images, CSS, JS &mdash; and <code>.bsp</code>, <code>.bz2</code>, <code>.mdl</code>, <code>.wav</code>, <code>.spr</code> are <strong>not</strong> on it. Left alone, Cloudflare passes every game-file request through to your origin and caches nothing, defeating the whole exercise. Fix it with a Cache Rule (the modern replacement for Page Rules) that forces these files into the cache. In the dashboard under <em>Caching &rarr; Cache Rules</em>, create a rule:</p>
<pre>When incoming requests match:
  (http.request.uri.path.extension in {"bsp" "bz2" "mdl" "wav" "spr"})
Then:
  Cache eligibility: Eligible for cache
  Edge TTL: override, e.g. 7 days</pre>
<p>Alternatively, match the whole path prefix &mdash; <code>http.request.uri.path contains "/cstrike/"</code> &mdash; and mark it eligible. Either way you are telling Cloudflare \"these are static, cache them,\" which it will not assume on its own.</p>

<h2>4. Why this is worth it</h2>
<ul>
<li><strong>Origin offload</strong> &mdash; after the first request per file per edge, downloads are served from Cloudflare, so a crowd joining after a map change hits the CDN, not your VPS.</li>
<li><strong>Geographic speed</strong> &mdash; players download from a nearby edge node rather than your single location, which matters for an international audience.</li>
<li><strong>Bandwidth</strong> &mdash; Cloudflare's free plan does not bill egress for cached static content, so your origin bandwidth bill drops sharply.</li>
<li><strong>Basic protection</strong> &mdash; the origin IP is hidden behind Cloudflare, reducing direct abuse of the download host.</li>
</ul>

<h2>5. Confirm files are actually being cached</h2>
<p>The proof is the <code>cf-cache-status</code> response header. Request a map file twice and watch it go from <code>MISS</code> (fetched from origin) to <code>HIT</code> (served from edge):</p>
<pre>curl -sI https://dl.example.com/cs/cstrike/maps/de_rats.bsp.bz2 | grep -i cf-cache
# first:  cf-cache-status: MISS
# second: cf-cache-status: HIT</pre>
<p>If it stays <code>MISS</code> or shows <code>DYNAMIC</code>, your Cache Rule is not matching &mdash; recheck the extension list and that the rule is enabled.</p>

<h2>Common errors</h2>
<ul>
<li><strong>No speed improvement, origin still hammered</strong> &mdash; <code>cf-cache-status</code> is <code>DYNAMIC</code>/<code>MISS</code>: the game extensions are not covered by a Cache Rule. Add the rule; Cloudflare does not cache <code>.bsp</code>/<code>.bz2</code> by default.</li>
<li><strong>Record is grey-cloud (DNS only)</strong> &mdash; traffic bypasses Cloudflare entirely. Set the FastDL record to Proxied.</li>
<li><strong>Downloads 404 through Cloudflare but work on the origin</strong> &mdash; the origin path is wrong (missing the <code>cstrike/</code> level). Cloudflare faithfully proxies the 404; fix the mirror layout.</li>
<li><strong>Stale file after you update a map</strong> &mdash; the edge cached the old copy. Purge that URL (or purge everything) in the Cloudflare cache panel after replacing content.</li>
<li><strong>Client falls back to slow in-game download over HTTPS</strong> &mdash; a TLS/cert error on the origin or an <code>Error 5xx</code> from Cloudflare. Confirm the origin answers and the certificate is valid.</li>
</ul>

<h2>Verification</h2>
<p>End to end: request a map file through the Cloudflare hostname twice and confirm the second is a cache <code>HIT</code> (above). Then join the server from a client that lacks the map and watch it download quickly; check your origin's access log and confirm most requests after the first are absent because the edge is serving them. Keep the origin mirror and its <a href="/tutorials/fastdl-bzip2-compression">bzip2 files</a> in sync with your <a href="/tutorials/mapcycle-txt-setup">rotation</a>, and remember to purge the Cloudflare cache whenever you replace a file under an existing name.</p>