legacyone

Important Multi-player connecting requirement please.

▼

Important Multi-player connecting requirement please.

from AshesoftheSingularity Forums

 

Posting here from what was posted on steam to be sure its addressed.

Please add the ability for fixed source port or fixed source range for RFC 3489 or RFC 5389 for players to connect to one another.

The reason for this is and as it is its fully dynamic which means your source port can be from 49152 to 65535 making firewalling that might be a transparent firewall impossible and the problem can get worse the more I try to explain so I'm going to make this simple in what happens. However note that you can have someone use fixed source port and fixed source range and someone with fully dynamic and this works fine with a firewall setup on fixed source port or fixed source port range. 

When you start a Multi-player you and another player send your source port thats fully dynamic to the server and the server sends your source port to the other player.

The players from their source port (P1 = 49300 P2 = 56000) then tries to connect to the other players source port so.
P1 Source port 49300 > P2 Remote port 56000
P2 Source port 56000 > P1 Remote port 49300 

In a open firewall setup where it allows all the first attempt likely will not work until the firewall make a state on the first attempt. But you can't firewall this on a transparent firewall because you don't know what the ports are going to be until it happens. 

With one wanting to firewall with fixed source port or fixed source range and another player wanting fully dynamic heres how that works

lets say its a fixed source range the game might sent traffic on one of your given fixed source range ports say 60000-60010 and the game picks one thats not in use on your system say 60000 for P1 and P2 has a fully dynamic port say 52001. you can now firewall in UDP ports 60000-60010 for each other to connect without allowing all UDP ports.

P1 Source port 60000 > P2 Remote port 52001
P2 Source port 52001 > P1 Remote port 60000

44,502 views 30 replies
Reply #26 from AshesoftheSingularity Forums Top

You don't understand, nevermind.

Reply #27 from AshesoftheSingularity Forums Top

Quoting eviator, reply 27

You don't understand, nevermind.

I don't know why your even talking about IPv6 other then to side track the issue but I'm happy to example why you think I don't understand when I do and here is why yes every device is Internet addressable with IPv6 there is no NAT you are thinking the firewall is all done by the device which it can but what will really happen when we move to IPv6 is transparent firewalls will be the thing and for years work on cheap transparent firewalls is being neglected that can handle high speed.

 

But like I said thats IPv6 and your side tracking the issue to which I did not said about IPv6 till you said it.

Groupy 2 - Organize multiple applications into grouped tabs on your Windows desktop
Reply #28 from AshesoftheSingularity Forums Top

Quoting legacyone, reply 28

I don't know why your even talking about IPv6


I figured that part out on my own.

Besides, this thread is dead so there is nothing to side-track.

Reply #29 from AshesoftheSingularity Forums Top

Quoting eviator, reply 29

Besides, this thread is dead so there is nothing to side-track.

So you should have no need to post here any more thanks.

So as I was saying the ports for this game does not have to be random some people have NAT types that do not do Port Preservation this causes UDP Traversal problems such that they rely on the other end (another player directly which this game does regardless or tries) to have a port mapping to a random port this all makes things not work very well given that we need compatibility when the whole point of UDP Traversal is to not need UPnP which why have it on and cause a risk
http://www.kb.cert.org/vuls/id/361684
or port mapping  but then we do need port mapping so that people on given NATs that don't do Port Preservation  have a fixed port and solves this as safely as possible.

So I'm saying you don't need port mapping for UDP Traversal to work where both ends have Port Preservation and random ports yes not going to lie about that but then I don't have to because of the problem above where one end if not more does not do Port Preservation.

Now its unlikely a person will have a app on a range of UDP ports as the source and service port and yes it is both because it UDP that makes UDP Traversal possible here is how random ports works.
https://forums.ashesofthesingularity.com/473245/page/1/#3602700
here are destination ports and you will see where the source and service port is done
Outgoing
49194

incoming
58744
58745
63897

So what are the source and service ports used when I make a outgoing connection to the other player at 49194? your looking at them 58744,58745, 63897 and that means 49194 is the other persons source and service and its them ports the game sets up that are sent to the server and sent to us.

So firewall state of outgoing for UDP
IP1 1.1.1.1 source port 58744 > IP2 2.2.2.2 = remote port 49194 = Punch!
blocked by firewall at IP2 2.2.2.2

IP2 2.2.2.2 source port 49194 > IP1 1.1.1.1 = remote port 58744
if you allow all UDP ports out then IP1 1.1.1.1 allows this connection under the firewall state of outgoing to allow IN because of the above

but let say I don't want to allow all UDP port on a firewall that's not my PC firewall and I allow all incoming UDP ports

So firewall block outgoing for UDP random port 
IP1 1.1.1.1 source port 58744 > IP2 2.2.2.2 = remote port 49194 = no punch

IP2 2.2.2.2 source port 49194 > IP1 1.1.1.1 = remote port 58744
allowed under the firewall state of incoming all UDP ports

IP1 1.1.1.1 source port 58744 > IP2 2.2.2.2 = remote port 49194 = connect back
allowed under the firewall state of incoming above

but like I said its random meaning you can't port forward a given port or given range which if it was say 20000-20100 but lets make it interesting and the other player has a random port lets say 49194 again for show and I don't allow outgoing to that port but allow incoming for 20000-20100    
 
So firewall block outgoing for UDP random port 
IP1 1.1.1.1 source port 20000 > IP2 2.2.2.2 = remote port 49194 = no punch

IP2 2.2.2.2 source port 49194 > IP1 1.1.1.1 = remote port 20000
allowed under the firewall state of incoming 20000-20100 UDP ports

IP1 1.1.1.1 source port 20000 > IP2 2.2.2.2 = remote port 49194 = connect back
allowed under the firewall state of incoming above

that simple and I could show one where one or more players has a non Port Preservation connection type where the source and service port is changed on outgoing that the server can not detect but we leave it at that where a given range of  source and service ports the game uses will mean that player can port forward them ports to get the game to work.

Like I said Valve is on the low end of listening to me or others vs the game dev using Valve implementation to request changes that the game dev can add in the game for better network compatibility .