NodeWorld
ENFR

Ports and firewall

Players' games connect straight to your server, on one port: 25252 by default (GamePort in the configuration). The game uses it in UDP, the world downloads in TCP: open both.

The setup assistant does most of it: it opens the port on your router with UPnP and has NodeWorld test it from the internet. This page is for what it cannot do, and for when the test fails.

On the machine

Linux (ufw)

bash
sudo ufw allow 25252/udp
sudo ufw allow 25252/tcp

Windows

Installed as a service, the server has its Windows Defender Firewall rule: nothing to do. Without the service, the first start asks whether the server may use the network: allow it. Otherwise, open a PowerShell as administrator:

powershell
New-NetFirewallRule -DisplayName "NodeWorld Server UDP" -Direction Inbound -Protocol UDP -LocalPort 25252 -Action Allow
New-NetFirewallRule -DisplayName "NodeWorld Server TCP" -Direction Inbound -Protocol TCP -LocalPort 25252 -Action Allow

On your router

At home, the machine is behind your internet box. The setup assistant asks the box to forward the port with UPnP; with Upnp: true in the configuration, the server asks again at each start and every 30 minutes, because a box forgets it when it restarts. Most boxes accept; some have UPnP turned off in their settings.

Otherwise, forward it yourself: in the box's settings, forward port 25252, UDP and TCP, to the local address of the machine (192.168.1.20, for example; the assistant shows it). The name of the page changes from one box to another: port forwarding, NAT, virtual server.

Then set PublicAddress to your public IP address, or better, a domain name that points to it (your IP may change). If the box forwards another outside port to 25252, put that outside port in PublicPort.

When your provider shares your address

Some internet providers give the same IPv4 address to several customers (CGNAT). The setup assistant warns you when it sees it: your box's internet address is then not a public one (100.64.x.x to 100.127.x.x, for example). Nobody outside can reach a server there, port forwarding or not. Ask your provider for a public IPv4 address, or use a rented server.

On a rented server

A cloud or rented machine often has a firewall in its provider's panel too (security group, firewall rules): open 25252 UDP and TCP there as well.

Check

Stop the server and run its assistant again with --setup: its port test says whether NodeWorld reaches the port in UDP and in TCP, and lists what to check when it does not. When the server starts, its log shows Public Endpoint: with the address and port players get. Ask a friend outside your network to join your server from Explore. If the game says This server isn’t available. or loads forever, the port is not open from the outside.

What the worlds' scripts reach

The FL# scripts of a world that run on your server can make web requests and open WebSockets to any address: no player is there to allow it. That includes what your machine sees and the internet does not:

  • the services of the machine itself (127.0.0.1, localhost): an administration panel, a database, the API of another program;
  • your local network: your box, a NAS, the other computers;
  • on a cloud machine (AWS, Google Cloud, Azure…), the metadata address 169.254.169.254, which can give out the machine's credentials.

NodeWorld blocks none of it on a server. Install only worlds you trust, and if you want to keep their scripts out of these addresses, block them in the firewall of the machine.

The cloud metadata address

On a cloud machine, for the whole machine:

bash
sudo ufw deny out to 169.254.169.254
powershell
New-NetFirewallRule -DisplayName "Block cloud metadata" -Direction Outbound -RemoteAddress 169.254.169.254 -Action Block

The machine and the local network, for the server only

Linux: the server runs as the user of its service; these rules refuse that user's new connections to the machine and the local network, but its name lookups (127.0.0.53, systemd-resolved). They apply to every program of that user: on a machine used for other things too, run the server as a user of its own. If cat /etc/resolv.conf shows a name server on your network (192.168.1.1, for example), add an ACCEPT line for it like the 127.0.0.53 ones, after them (-I puts each rule first, before the rules of ufw).

bash
U=$(systemctl show -p User --value nodeworld-server); [ -n "$U" ] || U=$(whoami)
for net in 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 100.64.0.0/10; do
  sudo iptables -I OUTPUT -m owner --uid-owner "$U" -m conntrack --ctstate NEW -d "$net" -j REJECT
done
sudo iptables -I OUTPUT -m owner --uid-owner "$U" -d 127.0.0.53 -p udp --dport 53 -j ACCEPT
sudo iptables -I OUTPUT -m owner --uid-owner "$U" -d 127.0.0.53 -p tcp --dport 53 -j ACCEPT

These rules are lost at the next start of the machine: sudo apt install iptables-persistent keeps them (it asks to save the current rules).

Windows: a rule for the server's program only (the service's, or put the path of your NodeWorld.Server.exe in $exe). Windows does not filter the connections of a program to the machine itself (127.0.0.1): a service of the machine that listens there stays reachable, so give it a password or stop it.

powershell
$path = (Get-CimInstance Win32_Service -Filter "Name='NodeWorldServer'").PathName
$exe = if ($path.StartsWith('"')) { $path.Split('"')[1] } else { $path.Split(' ')[0] }
New-NetFirewallRule -DisplayName "NodeWorld scripts: no local network" -Direction Outbound -Program $exe -RemoteAddress 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,100.64.0.0/10 -Action Block

The scripts of a world that try a blocked address get an error, and your log shows a [Web] line with the address and why.