Port forwarding for game servers

What a port actually is#

A machine has one address. A port is the number saying which program on it a packet is for. A server picks a port at startup and listens there, so a packet sent to your address on that port reaches it and one on any other port does not.

At home there is a second layer. Your router holds the one public address, and every device behind it has a private address that means nothing outside your house. When a packet arrives on port 25565, the router cannot know which device wanted it. A forwarding rule is the answer: traffic on this port goes to this internal address on this port. Funcom say the sentence people skip: your friends connect on your external address, and your local address is only valid on your side of the router.

TCP or UDP, and why you cannot guess#

Games use both transports. Forward exactly what the vendor names: the two are separate rules, and the wrong one looks identical to forwarding nothing.

Minecraft's server-port is documented as TCP. Factorio is UDP only. Rust runs game and query on UDP and remote console on TCP, and Facepunch add an instruction: if your router offers a "both" or "all" protocol option, avoid it. Funcom say the opposite for Conan Exiles, to forward both, because that game needs both. SCUM is the sharpest case: the game port is UDP and the query port is TCP, so one rule across a range on one protocol leaves the server invisible.

The ports, per game#

Every number there is from the game's own documentation, and each is a default you can change. Check your config first.

The query port is the one people forget#

Two ports do two jobs. The game port carries play. The query port answers "is there a server here, what is it called, how many people are on it", and that answer is what puts you in a browser. Forward only the game port and you get a server that works by direct connect and does not exist to any list. Facepunch state it for Rust: game and query both have to be open and reachable, and cannot be the same number. Bohemia's DayZ config says the same beside steamQueryPort. If your server is missing from a list rather than unreachable, our page on a server not showing in the server list goes through the rest.

Do these three things, in this order#

One: pin the server's local address. Funcom explain why, and it is the failure that looks like forwarding breaking for no reason: after a reboot the machine can come back on a different address from the one your rule names. Give it a fixed address on the router.

Two: add the forwarding rule. Interfaces differ, and Funcom's summary holds for all of them: you pick some input ports and redirect them to a specific machine on your internal network. Use the same port on both sides, one rule per protocol.

Three: open those ports on the machine's own firewall. A router rule delivers the packet to the machine; the firewall decides whether the program gets it. Funcom's checklist: inbound rules for each port you use, query port and remote console included.

On Windows

Microsoft's route is the Windows Firewall with Advanced Security console. Press Start, type wf.msc, Enter. Select Inbound Rules, then Action and New rule, and take Custom on the Rule Type page, which Microsoft note shows every page of the wizard. On Protocol and Ports pick TCP or UDP; for an incoming rule you normally set only the local port. Choose Allow the connection, pick the profiles, name it. For a machine that never moves, Microsoft suggest applying it to all network location profiles, since a disconnected card is treated as public.

On Linux

Ubuntu's default tool is ufw. Canonical are upfront that it is not a complete firewall interface, just an easy way to add and remove simple rules, which is what a game server needs. It starts out disabled.

• sudo ufw allow 22 opens a port, sudo ufw deny 22 closes one
• sudo ufw allow proto tcp from 192.168.0.2 to any port 22 limits a rule to one address
• sudo ufw status verbose shows what is in force; status numbered gives the numbers to delete by
• sudo ufw enable turns it on, and sudo ufw logging on makes a blocked packet leave a trace

Open the SSH port before enabling the firewall on a remote machine.

When forwarding cannot work#

Sometimes the rule is correct and traffic never arrives, because your router holds no public address at all. Carriers short of addresses add a second layer of translation, and RFC 6598 set aside 100.64.0.0/10 specifically to number the link between that carrier equipment and the customer's router, distinct from ordinary private space because it belongs to the provider's network. If your router's external address sits in that range, or does not match what a "what is my IP" page shows, your forward stops at your own router, and nothing you change at home adds a rule to the translation in front of it.

Bohemia are the bluntest vendor here. Their Arma 3 documentation states the server does not support IPv6 or DS-Lite IPv4 tunnelled over IPv6, that you must have a real IPv4 connection, and that if in doubt you should contact your internet provider. That is the right call to make: some providers hand out a public address on request, sometimes for a fee, and if yours will not, home hosting for that game is over. One more trap, from Wube's Factorio documentation: some routers randomise the source port on outbound packets, which breaks the server even when forwarding is correct, and they need extra configuration to stop.

Testing it honestly#

Joining from inside your own network proves nothing: traffic between two devices in the house never touches the forwarding rule, so a working local join beside a failed remote one is exactly what a missing forward looks like. Funcom say the same in reverse, that if you cannot join your own server but others can, use the local address. Test from outside, one protocol at a time.

What renting changes, honestly#

A rented server sits on a machine that already has a public address, so there is no router in front of it and no carrier translation to argue with. That removes this chore and none of the others: the config, the mods, the backups and the updates are still yours.

Where RadarHost fits#

RadarHost rents game servers hosted in Beauharnois, Quebec, Canada, across sixteen games in three plans, Standard, Premium and Diamond, priced in Canadian dollars, with no setup fee and cancel any time. Renting changes who keeps the machine on and where it sits on the network; the settings above are still yours. After payment, our team reviews the order and emails setup details or next steps within 24 hours. Current plans and prices are on the plans section of our home page.