Hosting UT3 Behind A Router Questions

[XrayDoc88]

I just started playing UT3 with some enthusiasm after the version 2.0 patch. I had hoped to host some multiplayer games from behind my Linksys BEFSX41 router. I have diligently searched the internet looking for guides, necessary ports, etc. What I have concluded thus far is that private server hosting is a mess. All of these potential solutions have been mentioned in one or more places.

1. Forward ports. This should be simple enough, but which ports are actually necessary? So far the ports that I have found mentioned include:

UDP - 6500, 6515, 7777, 7778, 7787, 7788, 8777, 9777, 13000, 13139, 27900, 28902.
TCP - 3783, 6667, 28900, 29900, 29901

2. Download a "Stun Server" and also forward some ports.

3. Buy a router that utilizes "full cone NAT".

If there is a real server expert in these forums I would love to hear some advice. Here are some specific questions:

1. What is the definitive list of ports that should be forwarded?
2. If the correct ports are forwarded, will most routers work fine?
3. What are some routers that use "full cone NAT"? The specific type of NAT used is not typically listed in the specifications for any routers that I've seen.
4. If you do have a full cone NAT router, do you still need to forward ports for the server to be joinable from the internet?
5. Is the "Stun Server" really necessary, or does that only apply if you're not using a full cone NAT router?

Thanks a bunch. I hope someone (maybe an Epic representative) will step up to the plate. The recently invigorated UT3 would really benefit from many more internet servers being available. I would hope that Epic would try to make hosting servers an easy process. Please, someone, try to clear up this mess.

[1N54N3]

All you should need is: 6500 (gamespy), 7777 (UT 3), 13000 (Stats). Foreward those ports and it will most likely work. The results seem to be different for everyone. Myself, I have to foreward the ports AND dmz my router. It seems redundant, but if I don't, I can't host.

If nothing else works, set up your computer to host a dedicated server, and then join it. You'll have to make an alternate gamespy id to host, and use your main one to join the game. Let me know if you need help figuring out the dedicated server stuff. I just spent all day getting mine going and I've got it all figured out (I think :P) except how to get custom maps available for voting. I had it working earlier, but now it has stopped. Anyway, that should work for you, good luck.

[{DCS} Matrix]

@ 1N54N3 Getting Custom Maps to work, you need to enter/delete them in the file called UTMaplist.ini

I have tested It with Standard Maps that should not show up, I didn't test if you can add Custom Maps to the list (Can test it tonight).

The link how I did It :
http://www.dcsautomatisering.nl/Spon...3/Default.aspx

[EmDzei]

All you should need is: 6500 (gamespy), 7777 (UT 3), 13000 (Stats).

I am hosting dedicated UT3, too and have just port forwarded this three UDP ports, except port 7777 I have change to 9777, becouse my UT2004 #1 use default 7777 and UT2004 #2 the 8777. 9777 for UT3. ;-)

But, elsewhere here I am asking now does UTEngine.ini [IpDrv.UdpBeacon] section ache my system (UT2004 games). There are two lines and ports, what are already on use on my system:

ServerBeaconPort=8777 ;;for UT2004 UDP
BeaconPort=9777 ;;for UT3 default UDP port

Information how to build a new dedicated server is hard to find. Specially for me was surprise UT3 didn't incluse web admin interface itself. Found it from here now and am happy.

[Jungle+=]

Epic's Ofiicial Hosting Ports to forward are: 6500,7777,13000
That's all.
A lot of those other ports are from previous Unreal titles, or the ports of Gamespy that the HOST connects to on the internet. A lot of misinformation and confusion out there due to Epic's silence on the issue.
I tested with a raw modem connection while hosting,using CurrPorts to find ports and these are the ONLY ports that ever open :

6500,7777,8767,9989,13000, and a series of random ports in the 45000-65000 range

With ports 6500,7777,8767,9989,13000 port forwarded, I advertise on the server browser, and players can connect directly from server browser like the Pro Host Providers.
The "your network configuration may not be compatible" error just never stops.... I asked for insight on the internal Epic admin mailing list...and the GENERAL consensus was to just ignore the "not compatible" warning if players see you on server browser and can join freely.

I don't think it's our routers having an issue, after 3 Full Cone NAT capable routers, that DON't randomize internal ports ( exactly what Epic asks for) have all failed the NAT test.

I found that D-Link consumer grade routers offer 3 levels of NAT. The DIR-655 Extreme N, DGL-4500 Extreme N and DIR 855 Dual Band Extreme N all allow Full Cone. but fail the test, even in DMZ. ALL 3 have allowed me to advertise in server browser and player conections despite the "not compatible with hosting" warning.

I am now experimenting with Linksys and Cisco ( Linksys's parent company, Business class routers).
After 16+ hours on the phone with Linksys AND Cisco, they couldn't point me in the direction of a FULL CONE router for under 500 dollars and even then they werent sure if their info was correct.They wished me luck though. Hahahahahaaaa ! I did after a few more hours find that Cisco routers that use "Cisco IOS" features allow for nat flexibility, offering Pat, NAPT and Port restricted NAT. but no mention of Full Cone.
Ideally port forwarding should be just that, it forwards the ports thru those firewall rules. My current Linksys, "WRT310N" only allows port restricted NAT, yet still allows advertising of the server, and player connections thru the server browser with port fowarding enabled on those ports.

Bottom line so far, over 1 year after the release of the game.....

Epic has taken no firm position on home users hosting a server effectively, they have not clearly spelled out a solution for this to the public. NOR have they offered advice on where to find these mythical routers that behave the way UT3 needs to pass the test.
If you forward ports 6500,7777,13000 and turn off SPI ( stateful packet inspection ), you should be able to advertise on browser AND allow player connections , despite the warning from the UT3 NAT test.

P.S
I used a stun server, but all it does is give the external ip to the nat test, helping to pass the test and eliminate that nagging warning. It DOES NOT help traverse the NAT at all. Stun was only a necessity to unlock all hosting options prior to patch 1.3. Now it has no use as all options are availble for hosting despite the warning.

[XrayDoc88]

Jungle+=, thanks for that very informative, yet disappointing explanation. I don't remember now where I even read about UT3 requiring a "full cone NAT" router. Obtaining "full cone NAT" information from router companies appears to be nearly impossible at best. I too have been in contact with D-Link technical support asking them which of their routers supported "full cone NAT". Here's their response:

"The D-Link DI series of routers (and maybe other D-Link routers as well) can be configured to perform either Symmetric or Full-Cone NAT. Under Tools->Misc., enabling "Gaming Mode" enables Full-Cone NAT, and disabling it enables Symmetric NAT. The out-of-the-box default is disabled (Symmetric). Changing to Full-Cone by enabling Gaming Mode makes configuration of VoIP devices behind the router much simpler, usually eliminating the need to manually forward ports inbound

How ever I think that the DGL series of routers has the same feature as well for further assistance please, call the presales department ."

I think the DI series of routers are all older. I then asked the sales department specifically about the DIR-855 and the DGL-4500, twice. I've yet to receive an answer. If you have access to either of those routers, you might try enabling "gaming mode" and see if the error message in UT3 goes away. It does appear however, that you can successfully host games from behind a non full cone NAT router as long as you have the correct ports forwarded. I am curious if a true "full cone NAT router" would allow hosting without port forwarding? What do you think?

[Jungle+=]

Jungle+=, thanks for that very informative, yet disappointing explanation. I don't remember now where I even read about UT3 requiring a "full cone NAT" router. Obtaining "full cone NAT" information from router companies appears to be nearly impossible at best. I too have been in contact with D-Link technical support asking them which of their routers supported "full cone NAT". Here's their response:

"The D-Link DI series of routers (and maybe other D-Link routers as well) can be configured to perform either Symmetric or Full-Cone NAT. Under Tools->Misc., enabling "Gaming Mode" enables Full-Cone NAT, and disabling it enables Symmetric NAT. The out-of-the-box default is disabled (Symmetric). Changing to Full-Cone by enabling Gaming Mode makes configuration of VoIP devices behind the router much simpler, usually eliminating the need to manually forward ports inbound

How ever I think that the DGL series of routers has the same feature as well for further assistance please, call the presales department ."

I think the DI series of routers are all older. I then asked the sales department specifically about the DIR-855 and the DGL-4500, twice. I've yet to receive an answer. If you have access to either of those routers, you might try enabling "gaming mode" and see if the error message in UT3 goes away. It does appear however, that you can successfully host games from behind a non full cone NAT router as long as you have the correct ports forwarded. I am curious if a true "full cone NAT router" would allow hosting without port forwarding? What do you think?

There is no Gamng Mode on them in Tools. They label Port Forwarding on the DGL-4500 as "Gaming". They all do have "Endpoint Independant" NAT( "A rough equivalent to full cone" they state ) as one of the choices in Advanced tab.
The DGL-4500 is literally the same as the DIR-655 and DIR-855 except they rename Port Forwarding to "Gaming" and Qos to "GameFuel" and add a video game terminal looking led display to the box.

Well....after hours of inane " could you give an example of full cone" convos with D-link, Linksys AND Cisco... AND trying the top 3 consumer routers from D-Link, AND the near top model from Linksys consumer grade(WRT310N), I am nowhere further ahead. I was informed that Linksys doesn't offer any full cone routers.Yet mine allows connection of players and advertises ( while in Port restricted NAT,using Port Forwardning single Ports mode, and SPI off )

True full cone ( also known as one-to-one ) is a rarity if going by router company support feedback. If I could find a TRUE Full cone router that UT3 likes, I would be happy to pass on the info. But when Hosting Service Providers on the Servers/Admin Mailing List tell me , "just ignore it"... I get the inference that it's the test that's a problem, not the routers. Let's see, tried the top 3 D-Links ( with quasi full cone ) tried top tier LinkSys ( Port Restricted like all other Linksys') now only end of line obscure routers are left OR motorcycle priced business class routers. Ive NEVER in my life heard of a game that required a business class router to host. Seems like this IS as good as it gets. I wil be possibly trying one business class router from someone..if I can EVER find a support staff that is actually familiar with router features............

I hate loose ends like this so it's driving me quite batty. The reality after our experiences would be to just keep buying/exchanging routers that imply some sort of full cone behaviour as the Router Company support staff have less experience than we do. OR we can do as I've been advised on the internal Admin/Servers Mailing List... just ignore the message and enjoy advertising and having people connect to the server despite the message.
The most I've learned from D-Link and Linksys is Philipino swear words...LOL !

[Jungle+=]

Well I got creative and asked an aquaintance of mine that owns Lavalife and a few other entities on the net what his networking Manager could do to point me towards a good "Full Cone" router. Here is his Networking Manager's reply:

Lol, I haven’t heard full cone nat in years! I think that was the confusion right there, it’s called one-to-one nat here, but anyways, D-Link and Linksys won’t have anything for you, you will want to step into entry level Sonicwalls anything from the TZ-180 to the TZ-210, I’m just not 100% sure everything you are looking for; have a look at this sheet http://www.sonicwall.com/us/products/TZ_Series.html to see what best suits you, I believe the TZ-180 starts around $600.00 CDN, but do give them a call to talk about the products so you can make certain that it fits all of your requirements.

When you add things up, being told UT3 needs full cone, NON randomized ports, the jargon appears outdated and thus leading many down the wrong path.

One to One... not available at consumer level is what I glean from all the bits and pieces. Starting at 600 Dollars CDN...wow. Sounds like this was only meant to be served properly by renting from one of the long time Server Hosting Rental Providers.
Is there NO PERFECT consumer grade router for home servers?

If you can connect players at all and get advertised...THAT IS as good as it gets. No point hunting for perfect consumer grade routers it would seem.

http://www.sonicwall.com/us/products/TZ_190.html <----- Ooooh LOOK! UT3 Grade router ! No price listed ..this is going to hurt !

[Jungle+=]

From the D-Link Dir Series Help Page:

Endpoint Independent

Once a LAN-side application has created a connection through a specific port, the NAT will forward any incoming connection requests with the same port to the LAN-side application regardless of their origin. This is the least restrictive option, giving the best connectivity and allowing some applications (P2P applications in particular) to behave almost as if they are directly connected to the Internet.

That sounds like One-to-One/full cone to me....... and as defined by wikipedia.org :
http://en.wikipedia.org/wiki/Network...ss_translation

Full cone NAT, also known as one-to-one NAT

• Once an internal address (iAddr: port1) is mapped to an external address (eAddr: port2), any packets from iAddr: port1 will be sent through eAddr: port2. Any external host can send packets to iAddr: port1 by sending packets to eAddr: port2.

So... the knowledge has evolved since we last spoke.. It would appear that D-Link is capable of One-to-One NAT in Endpoint Independat NAT. It overrides port rules that try to limit connections.
So...if D-Link's DIR Series routers offer one-to-one NAT...and don't randomize internal ports ( you can check port mappings in D-Link's router log "active sessions" where it shows both internal and external port mappings to remote addresses )...what gives?
It more and more appears that UT3's NAT test is wonky, not these D-Link routers.

[XrayDoc88]

Do you know if the newer D-Link routers DIR-855, DIR-655 or DGL-4500 even have a way to change the type of NAT utilized? The response I received from their technical support stated the "DI" series had a way of switching between full cone and symmetric modes, but symmetric was the default. If the newer routers don't even have that setting in the firmware, I would suspect the default is still symmetric.

Endpoint Independent

Once a LAN-side application has created a connection through a specific port, the NAT will forward any incoming connection requests with the same port to the LAN-side application regardless of their origin. This is the least restrictive option, giving the best connectivity and allowing some applications (P2P applications in particular) to behave almost as if they are directly connected to the Internet.

That description sounds exactly like what port forwarding settings would do on a router, and I suspect is what allows non full cone (1:1) routers to work when hosting games. If I understand the WIKI description of full cone correctly, it also requires an incoming packet to be specifically directed at the same external IP address and external port that were originally used by the game server. Port forwarding wouldn't require the external IP address match. (Though I always assumed that the external IP address used by an application behind my router is always the very same as my ISP assigned dynamic IP. Otherwise, how would internet originated packets ever find my router? Surely the application (or router) can't just make up a totally different external IP address, could it? Such a fictitious external IP address would have to already exist somewhere on the internet and cause problems with packets finding the correct home.)

[Jungle+=]

They have 3 levels of NAT Filtering....UT3 screams that its still misconfigured though.. here are the 3 levels of NAT filterig:

-Endpoint Independant ( roughly equivalent to Full Cone, whatever "roughly" means )
-Address restricted
-Address and Port Restricted


Here is a list of links to ALL of D-Link's router conifg emulators

http://support.dlink.ca/faq/view.asp?prod_id=1457

And a link directly to the DIR-655 emulator NAT config page:

http://www.support.dlink.com/emulato.../Firewall.html

Their definition of Endpoint Independant is very close the the definition of Full Cone/One-To-One on Wikipedia.

Linksys supposedly only offers consumer routers with Port restricted NAT. ( but don't forget that once ports were forwarded, the server still advertised and was connectable with my WRT310N.

[XrayDoc88]

Thanks Jungle+=, especially for the emulators link. Having played with the emulators, I now think I understand as well as possible. I'm also more impressed with D-Links' help comments. I've always bought Linksys equipment, but I think my next router will likely be either the DGL-4500 or the DIR-855. I curently don't have a wireless router, so it would be nice to add that feature.

[Jungle+=]

Well here's a shocker !

I forwarded my ports 6500,7777,8767,9989,13000 UDP & TCP to be a little overkill.
Turned off SPI
Set my firewall to "Endpoint Independent" ( roughly same as Full Cone/One-To-One according to D-Link )

The first week with those settings and Patch 2.0, I kept getting the " May not be compatible " warning..despite the server advertising properly and allowing player connections.
I added a couple of lines to activate a redirect service for the server, using the best free one I could find (1000+KB/s!!)--->


http://uz3.gameservers.net/ut3/ <---The redirect

http://forums.gameservers.net/announ...ouncementid=45 <---Their instructions page

and magically, I no longer recieve "May not be compatible" messages !
I used a D-Link DIR-655 AND/OR DGL-4500 ( they have identical features ).
It may be worth investigating to see if redirect adress info is the magic cure for the message, as I have not tampered with my files/router settings since adding the the redirect lines to my ini.

Either way ... I'm getting compliments from players , and being asked who I rent the server from ! LoL !
Soooo...Now I will OFFICIALLY recommend either of these routers to be UT3 capable (even when the error message was there).

A little warning about the DGL-4500 though... with latest Firmware, settings won't save properly in the router settings if you disable wireless. I don't use the wireless for gaming, just guests. I had to set the wireless to have its own custom schedule, 12:00-12:01 every Sunday ...to still keep it off 99.99 percent of the time. All settings save properly now.

From the UTComp3 V4 b2 in game server browser :

[Thelios]

Jungle+=, I have a D-Link DGL-4300 router. Tried the same setup as yours to get rid of the message that recommends putting my router in the DMZ, (Really now Epic, that's the best suggestion?). I was still getting the message. Found a post in the UT3 tech forum that suggested editing the Stunserver entries in the UTEngine.ini file to:

Stunserver=UT3
Stunserver=UT3

Once I did this, I no longer get that aggravating message. I did leave the router set per your suggestions.

Oh, and thanks for the tip about the redirect server!

[JCSWW]

Thelios. Would you mind listing your settings for me? I have a DGL-4300 running the 1.9 firmware, but I'm having issues with people connecting to me.

Edit: If you're running the same firmware, you could also send me a back up config file for the router if that's not too much to ask.

[Thelios]

Well, I used Jungle+-'s port info and people were able to connect to my pc when I hosted a game. Internet game not a lan game.

However, I found this thread, http://utforums.epicgames.com/showthread.php?t=664224

I opened those ports listed in Night's post, from the linked thread instead of Jungle+-'s, in my router and people still can connect and play. In another post by Night, he stated that those ports are ones that Midway support sent him, and should be opened in your router/firewall in order for online play in UT3. Note, there are differences between Jungle+- and Night's/Midway's list. Night's/Midway's port list are all UDP ports only.

The key to having my router let UT3 through, in addition to opening either set of the ports, was making sure that I had Endpoint Independent set in Advanced/Firewall for both TCP and UDP Endpoint Filtering, I also disabled SPI in Advanced/Firewall in the router setup. I had to change to these settings on my router, because before I did there were issues with connecting.

I am running router firmware version 1.8. The update feature in the router says it is up to date, was not aware of a newer firmware version. Thanks for the tip!

I do not run a software firewall on my pc, not even windows firewall. I just use the one in the router. The last software firewall I used was a pain, Comodo, man what a pain.

Another useful thing I did was set a static ip address for my pc in the router. You don't want your ip to change in the middle of a match!

I read somewhere that if you are hosting a lan game, to make sure the pc's are all in the same windows workgroup.

I hope this info can help.

[JCSWW]

I really appreciate all of that info Thelios! (: Thanks! I no longer get that annoying message when I go to setup a game to host. After all the reading I did yesterday, I was only missing a couple of the ports Night had listed.

In terms of the firmware, perhaps it's region specific. I've had 1.9 for quite sometime. I did go and check and noticed the 1.8 that used to be up is now gone on D-Link's site. Here is the link that I used to check for firmware. Thanks again!

[Thelios]

You are welcome, JCSWW!

I checked on the router firmware. Best I can tell, the version 1.8 firmware was removed from download by D-Link due to some issues with WINS and some issues with wireless connectivity. Since, I am using static ip addresses and am wired to the router, v1.8 has been working well for me the last few years.

Also, I see where the v1.9 firmware is a beta. Some have said it works for them and others it is not. I did not see the 1.9 on the d-link site but it is available from other sources.

I will say getting wireless to work on the 4300 was a trial at best. But with a wired connection I get to enjoy the 1GB throughput to the router instead of wireless 100MB connection.

Edit: The D-Link page I went to previously did not show the v1.9 firmware and the one you give one does, Cool! (Must have been a cached page or something.) I am now running v1.9 final firmware on the router. That was too easy. Even was able to restore my router settings. Thanks again!!

[JCSWW]

This whole mess is starting to make me feel like a complete idiot. I can connect to servers in the server list without issue. I can't however host a match that friends can connect to and I can't connect to any matches my friends are hosting. Would you mind saving a config file for me and posting it? I would greatly appreciate it. At least then, it would rule out my router as being the problem. I do have my software firewall disabled.

[Thelios]

Yeah, that was the problem with the Comodo firewall. I had all the ports I wanted open set in the firewall, would not connect. Disabled the firewall, could not connect. Uninstalled that danged firewall, Hey I can connect! May want to give that a try, your router firewall will keep you safe.

I sent you a pm.

[Fijut]

1. Forward ports. This should be simple enough, but which ports are actually necessary? So far the ports that I have found mentioned include:

UDP - 6500, 6515, 7777, 7778, 7787, 7788, 8777, 9777, 13000, 13139, 27900, 28902.
TCP - 3783, 6667, 28900, 29900, 29901

Sorry to revive such an old thread but i've forwarded every single one of these ports and ut3 still won't host a server and i can't even load a map in the campaign.

At least i can host 2k4 servers

[{DCS} Matrix]

The only ports I have opened, UDP and TCP are:

6500 : Query port
7777 : UT3 port
13000 : Gamespy

[Cosmicjerk]

Actually I found this thread really helpfull the message went away for me without using the stunserver thing. but im still unable to host a campaign game. can anyone help me? I have the DIR-655 I turned off SPI make both of the things endpopint independent, and used the ports that jungle had posted. the message went away telling me I couldnt host a match but when i tried to have my friend join me it always fails, I give him my IP to join and it fails. I changed my ports and I get the message again but a complete stranger was able to join my game WTF? so im confused on whats going on...why did epic do this? if its not epic then who do I blame for making a joinable campaign so difficult.