106 lines
5.0 KiB
Markdown
106 lines
5.0 KiB
Markdown
# Networking for normal humans
|
||
|
||
You run panel at home, your friends want to join your server, and you
|
||
have a consumer router. This page is for you.
|
||
|
||
## The 60-second version
|
||
|
||
1. panel gives every instance its **host ports** at create time (see
|
||
[what the panel auto-allocates](#what-the-panel-auto-allocates)).
|
||
The dashboard's instance card / Ports panel shows the exact numbers.
|
||
2. Log in to your router and **forward those ports** (right protocol —
|
||
most games are UDP) to the LAN IP of the **agent box** running that
|
||
instance.
|
||
3. Give your friends `your-public-ip:game-port`.
|
||
|
||
You do **not** need to forward the panel's own ports (8080/8443) for
|
||
people to *play* — only to administer the panel from outside.
|
||
|
||
## What the panel auto-allocates
|
||
|
||
At instance create time the controller assigns each declared port a
|
||
**host port** from the agent's configured port window — default
|
||
**7000–9999** (`controller/cmd/controller/portalloc.go`). You can set a
|
||
per-agent window in the agent edit modal (e.g. box A gets 7000–7999,
|
||
box B gets 8000–8999). The allocator:
|
||
|
||
- reserves ports of **stopped** instances too (they come back),
|
||
- probes live sockets so it won't hand out a port some other process holds,
|
||
- honors manual overrides from the Ports UI when they fit the window,
|
||
- errors when the window is exhausted (widen it or delete instances).
|
||
|
||
So the *actual* host port is usually **not** the game's default port —
|
||
always read it off the dashboard. Ports marked `internal` in the module
|
||
manifest (RCON, admin APIs) are **never** exposed on the host and never
|
||
need forwarding.
|
||
|
||
## Per-game port table
|
||
|
||
Defaults from each `modules/<id>/module.yaml` (`ports:`). "Forward"
|
||
means players/queries need it; internal ports are panel-only.
|
||
|
||
| Game | Port (default) | Proto | Forward? | Notes |
|
||
|---|---|---|---|---|
|
||
| 7 Days to Die | 26900, 26901, 26902 | udp | yes (all 3, contiguous) | 8080/tcp web dashboard optional; telnet 8081 internal |
|
||
| ARK: Survival Ascended | 7777, 7778 game + 27015 query | udp | yes | RCON 27020/tcp internal |
|
||
| Barotrauma | 27015 game + 27016 query | udp | yes | |
|
||
| Conan Exiles | 7777 game + 7778 pinger + 27015 query | udp | yes | RCON 25575/tcp internal |
|
||
| Core Keeper | 27015 | udp | yes | |
|
||
| DayZ | 2302 game/query | udp | yes | 2303/2304 optional; BE RCON 2305 internal |
|
||
| Dragonwilds | 7777 | udp | yes | |
|
||
| Empyrion | 30000–30003 (game, query, client, EAC) | udp | yes (all 4) | CSW 30004 internal; EAH API 30007/tcp only if you use EAH |
|
||
| Enshrouded | 15637 | udp | yes | |
|
||
| Factorio | 34197 | udp | yes | RCON 27015/tcp internal |
|
||
| Minecraft Bedrock | 19132 (+19133 IPv6) | udp | yes | |
|
||
| Minecraft Java | 25565 | tcp | yes | RCON 25575 internal |
|
||
| Palworld | 8211 game + 27015 query | udp | yes | RCON 25575/tcp internal |
|
||
| Project Zomboid | 16261, 16262 | udp | yes (both) | RCON 27015/tcp internal |
|
||
| Rust | 28015 | udp | yes | RCON 28016 internal; Rust+ 28082/tcp optional |
|
||
| Satisfactory | 7777/udp game + 8888/tcp reliable | both | yes (both) | |
|
||
| Sons of the Forest | 8766 game + 27016 query | udp | yes | |
|
||
| Soulmask | 8777 game + 27015 query | udp | yes | admin 8888/tcp internal |
|
||
| Terraria | 7777 | tcp | yes | |
|
||
| V Rising | 9876 game + 9877 query | udp | yes | |
|
||
| Valheim | 2456, 2457, 2458 | udp | yes (all 3, contiguous) | |
|
||
| Vein | 7777 game + 27015 query | udp | yes | RCON 7878/udp internal |
|
||
| Windrose | 7777 | udp | yes | |
|
||
|
||
Remember: these are the *container defaults* — forward the **host ports
|
||
the panel actually assigned** (dashboard → instance → Ports).
|
||
|
||
## Forwarding ports on a generic router
|
||
|
||
Every router is different; the shape is always:
|
||
|
||
1. Browse to your router's admin page — usually `http://192.168.1.1` or
|
||
`http://192.168.0.1` (it's the "Default Gateway" in
|
||
`ipconfig` / `ip route`).
|
||
2. Find **Port Forwarding** — sometimes under "NAT", "Virtual Server",
|
||
"Gaming", or "Advanced".
|
||
3. Add a rule per port (or range): external port = internal port =
|
||
the host port panel assigned; protocol per the table above; internal
|
||
IP = the LAN address of the **agent** box.
|
||
4. Give the agent box a **static LAN IP** (DHCP reservation) so the rule
|
||
doesn't break after a reboot.
|
||
5. Test from *outside* your network (phone on cellular). Sites like
|
||
canyouseeme.org only test TCP — most game ports are UDP, so the real
|
||
test is a friend joining.
|
||
|
||
If you're behind **CGNAT** (ISP gives you a shared public IP — common on
|
||
cellular/fiber ISPs), port forwarding can't work; use a VPN/tunnel
|
||
(WireGuard on a cheap VPS, playit.gg, Tailscale Funnel, etc.) or ask
|
||
your ISP for a public IP.
|
||
|
||
## What about `opnfwd`?
|
||
|
||
You may notice an "OPNsense auto-forward" card in the admin settings and
|
||
`opnfwd_*` code in the tree. That is **maintainer-specific automation**
|
||
for a home lab running an OPNsense firewall: when enabled, the panel
|
||
calls the OPNsense API to create port forwards automatically on instance
|
||
create/delete.
|
||
|
||
It is **off by default** (`panel_settings.opnfwd_enabled` must be
|
||
explicitly set to `true`) and is irrelevant to normal users — if you
|
||
don't run OPNsense, ignore it entirely and forward ports on your router
|
||
as described above.
|