Docs / Guides / Game servers

Game servers

Game, TCP and UDP apps forward raw ports from your nodes to a server in your home. Minecraft Java, Minecraft Bedrock and FiveM have presets; anything else is a list of ports. Keep a server public, allowlist it, or make players log in to play.

Before you start

You have a connected home and the game server's LAN address, such as 192.168.1.31.

Presets#

Preset	Ports	Notes
Minecraft Java	25565/tcp	Supports PROXY protocol, so the server can see players' real IPs.
Minecraft Bedrock	19132/udp
FiveM	30120/tcp and 30120/udp
Custom	Any list of `port/tcp` and `port/udp`	For example Valheim: 2456/udp and 2457/udp. Terraria: 7777/tcp.

A listen port must be unique across all apps on a node, and can't be 22, 80, 443 or a tunnel or mesh port. Open the same ports in your provider's firewall (see install a node).

Add a game app#

In the panel, open Apps, choose New app and pick Game / TCP / UDP. Choose a preset or list the ports, then the home and the server's address. The app is served on every node the home is attached to, and players connect to <hostname>:<port> or a node's IP and port.

Point a hostname at the app's DNS target with a CNAME, as for web apps, so players always reach a healthy node:

zoneat your dns provider

mc.example.net.   300  IN  CNAME  p4w8z2rt.edge.example.net.

There is no certificate step for game apps.

Who can connect#

Access	Behaviour
`public`	Anyone can connect.
`allowlist`	Only listed addresses and ranges, such as `198.51.100.0/24`.
`login_to_play`	Players open a sign-in page (your play host, for example `play.example.net`), sign in under an access policy, and their current IP is allowed for a set time (12 hours by default).

Allowlist entries added at runtime replicate to every node serving the app. On a node you can also manage them by hand:

shellon a node

$ ingressd l4 list
$ ingressd l4 allow minecraft 198.51.100.23 --ttl 12h
$ ingressd l4 revoke minecraft 198.51.100.23

Limit abuse per source address with connections per IP and a new-connection rate such as 30/s.

Proxy or transparent#

Mode	What the game server sees	Needs
`proxy` (default)	Connections from the tunnel address. With PROXY protocol (TCP only), the player's real IP.	Nothing extra.
`transparent`	The player's real IP on every packet.	Replies must go back through the tunnel: a connector in `tun` mode on the server's router, or a router that routes them.

PROXY protocol only helps if the game server understands it, for example a Minecraft proxy such as Velocity with haproxy-protocol enabled. Leave it off otherwise.

Standalone config#

The same app in a standalone node's config.yaml:

config.yamlstandalone node

l4:
  valheim:
    preset: custom
    listen: [2456/udp, 2457/udp]
    target: { tunnel: home, address: 192.168.1.32 }
    access: login_to_play
    login_to_play: { policy: friends, ttl: 12h, portal_host: play.example.net }
    limits: { conn_per_ip: 20, new_conn_rate: 30/s }

ingressd l4 snippet valheim prints the settings to use on the game server's side.