As a followup on this old thread I'd like to report success in setting
up my own server (nl.netrek.org). Unfortunately I could not use a nifty
iptable firewall, but was limited to the DSL-built-in NAT-firewall. Very
limited indeed. The main problem was that I could not open entire port
ranges to the world. Only single port rules. As a result hardly anyone
was able to get UDP working in the game ;-)

I imagine there will potentially be more people with this issue so I
fixed this by patching the file ntserv/socket.c

   ehb > diff socket.c socket.c_original
   <     /* Use static range of UDP portnumbers. Easier for opening up firewalls */
   <     addr.sin_port = 3333 + me->p_no;
   >     addr.sin_port = 0;

It will now use local port numbers 3333..3348 for players, rather than
the random numbers before. What I now have opened for initial INCOMING
traffic in my firewall is this:

   2591   TCP   Player list (can be used by metaserver)
   2592   TCP   Player game port
   2593   TCP   Observer game port
   4566   TCP   Home player INL port (nothing listening now)
   4577   TCP   Away player INL port (nothing listening now)
   4000   TCP   Home observer INL port (nothing listening now)
   5000   TCP   Away observer INL port (nothing listening now)
   3333   UDP   Netrek Player 0
   3348   UDP   Netrek Player 15
   (observers should be able to live on TCP only. tired of typing)

When typing this I just realized that running both INL as pickup will bring
myself in problems using this scheme... Ahh well. Fixing that later ;-)

Also I have not yet looked into the RSA stuff yet.

The ideal solution I would like to have implemented is every client using
one and the same UDP port, namely 2592. That portnumber is no nicely
reserved for netrek. Clients should send PDU's with an additional 4 byte,
server assigned ID which the server uses to distribute stuff among daemonII
processes. Relying on source ip address won't be sufficient in all cases.

I know it will be hard and there will probably be pitfalls, but i'm bored
and like to try. So I ask you vanilla veterans: is there any reason I
should not do this?

Greetx, Erik

David Watson wrote:
>     If you are doing NAT then you have to disable RSA, I havnt looked 
> into that...
> iptables rules are below, you should be able to grab ports from them.
>     My servers fail to contact the metaservers
> the server must be able to do dns (udp and tcp 53) auth (tcp 113) and 
> whatever game ports that you run on. not my forwarding rule actually 
> allow all ports over 1024 in an attempt to get metaserver working 
> (possibly incoming udp connections 1024 +  needed for portswap?). These 
> rules were under construction when I decided - good enough
> Dave
> $IPTABLES -N verify_netrekout_for
> $IPTABLES -N verify_netrekin_for
> # Allow serving of game server ports to world
> $IPTABLES -A verify_netrekout_for -p TCP --sport 113 -j tcp_verify
> $IPTABLES -A verify_netrekout_for -p TCP --sport 2592 -j tcp_verify
> $IPTABLES -A verify_netrekout_for -p UDP --sport 2592 -j ACCEPT
> $IPTABLES -A verify_netrekout_for -p TCP --sport 2593 -j tcp_verify
> $IPTABLES -A verify_netrekout_for -p UDP --sport 2593 -j ACCEPT
> $IPTABLES -A verify_netrekout_for -p TCP --sport 4566 -j tcp_verify
> $IPTABLES -A verify_netrekout_for -p UDP --sport 4566 -j ACCEPT
> $IPTABLES -A verify_netrekout_for -p TCP --sport 4577 -j tcp_verify
> $IPTABLES -A verify_netrekout_for -p UDP --sport 4577 -j ACCEPT
> $IPTABLES -A verify_netrekout_for -p TCP --sport 4000 -j tcp_verify
> $IPTABLES -A verify_netrekout_for -p UDP --sport 4000 -j ACCEPT
> $IPTABLES -A verify_netrekout_for -p TCP --sport 5000 -j tcp_verify
> $IPTABLES -A verify_netrekout_for -p UDP --sport 5000 -j ACCEPT
> # Metaserver and client verification
> $IPTABLES -A verify_netrekout_for -p TCP --dport 1024: -j tcp_verify
> $IPTABLES -A verify_netrekout_for -p UDP --dport 1024: -j ACCEPT
> # Allow serving of game server ports to world
> $IPTABLES -A verify_netrekin_for -p TCP --dport 113 -j tcp_verify
> $IPTABLES -A verify_netrekin_for -p TCP --dport 2592 -j tcp_verify
> $IPTABLES -A verify_netrekin_for -p UDP --dport 2592 -j ACCEPT
> $IPTABLES -A verify_netrekin_for -p TCP --dport 2593 -j tcp_verify
> $IPTABLES -A verify_netrekin_for -p UDP --dport 2593 -j ACCEPT
> $IPTABLES -A verify_netrekin_for -p TCP --dport 4566 -j tcp_verify
> $IPTABLES -A verify_netrekin_for -p UDP --dport 4566 -j ACCEPT
> $IPTABLES -A verify_netrekin_for -p TCP --dport 4577 -j tcp_verify
> $IPTABLES -A verify_netrekin_for -p UDP --dport 4577 -j ACCEPT
> $IPTABLES -A verify_netrekin_for -p TCP --dport 4000 -j tcp_verify
> $IPTABLES -A verify_netrekin_for -p UDP --dport 4000 -j ACCEPT
> $IPTABLES -A verify_netrekin_for -p TCP --dport 5000 -j tcp_verify
> $IPTABLES -A verify_netrekin_for -p UDP --dport 5000 -j ACCEPT
> $IPTABLES -A verify_netrekin_for -p UDP --dport 1024: -j ACCEPT
> # Metaserver
> $IPTABLES -A verify_netrekin_for -p TCP --sport 3521 -j tcp_verify
> $IPTABLES -A verify_netrekin_for -p UDP --sport 3521 -j ACCEPT
> $IPTABLES -A verify_netrekin_for -p TCP --sport 3530 -j tcp_verify
> $IPTABLES -A verify_netrekin_for -p UDP --sport 3530 -j ACCEPT
> _______________________________________________
> vanilla-devel mailing list
> vanilla-devel at us.netrek.org
> https://mailman.real-time.com/mailman/listinfo/vanilla-devel

vanilla-devel mailing list
vanilla-devel at us.netrek.org