panel/docs/NETWORKING.md

Networking for normal humans

You run panel at home, your friends want to join your server, and you have a consumer router. This page is for you.

The 60-second version

1. panel gives every instance its host ports at create time (see what the panel auto-allocates). The dashboard's instance card / Ports panel shows the exact numbers.
2. Log in to your router and forward those ports (right protocol — most games are UDP) to the LAN IP of the agent box running that instance.
3. Give your friends your-public-ip:game-port.

You do not need to forward the panel's own ports (8080/8443) for people to play — only to administer the panel from outside.

What the panel auto-allocates

At instance create time the controller assigns each declared port a host port from the agent's configured port window — default 7000–9999 (controller/cmd/controller/portalloc.go). You can set a per-agent window in the agent edit modal (e.g. box A gets 7000–7999, box B gets 8000–8999). The allocator:

• reserves ports of stopped instances too (they come back),
• probes live sockets so it won't hand out a port some other process holds,
• honors manual overrides from the Ports UI when they fit the window,
• errors when the window is exhausted (widen it or delete instances).

So the actual host port is usually not the game's default port — always read it off the dashboard. Ports marked internal in the module manifest (RCON, admin APIs) are never exposed on the host and never need forwarding.

Per-game port table

Defaults from each modules/<id>/module.yaml (ports:). "Forward" means players/queries need it; internal ports are panel-only.

Game	Port (default)	Proto	Forward?	Notes
7 Days to Die	26900, 26901, 26902	udp	yes (all 3, contiguous)	8080/tcp web dashboard optional; telnet 8081 internal
ARK: Survival Ascended	7777, 7778 game + 27015 query	udp	yes	RCON 27020/tcp internal
Barotrauma	27015 game + 27016 query	udp	yes
Conan Exiles	7777 game + 7778 pinger + 27015 query	udp	yes	RCON 25575/tcp internal
Core Keeper	27015	udp	yes
DayZ	2302 game/query	udp	yes	2303/2304 optional; BE RCON 2305 internal
Dragonwilds	7777	udp	yes
Empyrion	30000–30003 (game, query, client, EAC)	udp	yes (all 4)	CSW 30004 internal; EAH API 30007/tcp only if you use EAH
Enshrouded	15637	udp	yes
Factorio	34197	udp	yes	RCON 27015/tcp internal
Minecraft Bedrock	19132 (+19133 IPv6)	udp	yes
Minecraft Java	25565	tcp	yes	RCON 25575 internal
Palworld	8211 game + 27015 query	udp	yes	RCON 25575/tcp internal
Project Zomboid	16261, 16262	udp	yes (both)	RCON 27015/tcp internal
Rust	28015	udp	yes	RCON 28016 internal; Rust+ 28082/tcp optional
Satisfactory	7777/udp game + 8888/tcp reliable	both	yes (both)
Sons of the Forest	8766 game + 27016 query	udp	yes
Soulmask	8777 game + 27015 query	udp	yes	admin 8888/tcp internal
Terraria	7777	tcp	yes
V Rising	9876 game + 9877 query	udp	yes
Valheim	2456, 2457, 2458	udp	yes (all 3, contiguous)
Vein	7777 game + 27015 query	udp	yes	RCON 7878/udp internal
Windrose	7777	udp	yes

Remember: these are the container defaults — forward the host ports the panel actually assigned (dashboard → instance → Ports).

Forwarding ports on a generic router

Every router is different; the shape is always:

1. Browse to your router's admin page — usually http://192.168.1.1 or http://192.168.0.1 (it's the "Default Gateway" in ipconfig / ip route).
2. Find Port Forwarding — sometimes under "NAT", "Virtual Server", "Gaming", or "Advanced".
3. Add a rule per port (or range): external port = internal port = the host port panel assigned; protocol per the table above; internal IP = the LAN address of the agent box.
4. Give the agent box a static LAN IP (DHCP reservation) so the rule doesn't break after a reboot.
5. Test from outside your network (phone on cellular). Sites like canyouseeme.org only test TCP — most game ports are UDP, so the real test is a friend joining.

If you're behind CGNAT (ISP gives you a shared public IP — common on cellular/fiber ISPs), port forwarding can't work; use a VPN/tunnel (WireGuard on a cheap VPS, playit.gg, Tailscale Funnel, etc.) or ask your ISP for a public IP.

What about opnfwd?

You may notice an "OPNsense auto-forward" card in the admin settings and opnfwd_* code in the tree. That is maintainer-specific automation for a home lab running an OPNsense firewall: when enabled, the panel calls the OPNsense API to create port forwards automatically on instance create/delete.

It is off by default (panel_settings.opnfwd_enabled must be explicitly set to true) and is irrelevant to normal users — if you don't run OPNsense, ignore it entirely and forward ports on your router as described above.