Gaming troubleshooting
Dedicated game server networking: test local, LAN and internet in order
Port forwarding cannot repair a server process that is not listening. Prove each boundary in order.
Three-stage rule: prove the server works on the host, then from another LAN device, and only then from an external network.
The three stages
| Stage | Test | Failure means |
|---|---|---|
| Local | Connect on the host | Application, configuration, database or bind issue. |
| LAN | Connect from a second device | Host firewall, address or local routing issue. |
| Internet | Test from mobile data | NAT, public address, ISP filtering or CGNAT. |
Expose the minimum surface
- Reserve a stable private IP.
- Create a narrow host-firewall rule.
- Forward only documented ports and protocols.
- Keep database and admin ports private.
- Test externally and remove unused rules.
When forwarding still fails
Compare the router WAN address with the public address. A mismatch can indicate carrier-grade NAT, where extra local rules do not create inbound reachability.
Separate binding, firewall and forwarding
These are different layers. The server process chooses an address and port to listen on. The host firewall decides whether packets may reach it. The router forwards public traffic to a private host. A mistake at any earlier layer makes later configuration irrelevant.
| Observation | Most likely layer | Check |
|---|---|---|
| Nothing is listening | Application/configuration | Server log, bind address, database dependency and startup order. |
| Host connects, LAN cannot | Host firewall or bind address | Private profile firewall rule and whether service listens beyond loopback. |
| LAN works, internet cannot | NAT/public reachability | Forward target, protocol, WAN address and CGNAT. |
| Some players connect, others time out | Protocol, relay, ISP or game-specific multi-port requirement | Compare successful and failed paths; verify every documented port. |
Do not test public access from inside the same LAN
Some routers support NAT loopback and some do not. A failed test using the public address from inside the network does not prove external failure. Use mobile data or a genuinely external connection.
TCP and UDP must match
A port number without its protocol is incomplete. Forwarding TCP when the game uses UDP—or vice versa—creates a rule that looks correct but cannot carry the expected traffic.
Keep databases private
A game server may need SQL locally, but public players normally do not need direct database access. Exposing SQL or remote administration ports dramatically increases risk. Use a VPN or secured management channel when remote administration is necessary.
Frequently asked questions
Does an open-port website prove my server works?
Only partially, and often only for TCP. The application must be running and listening at the moment of the test.
What is CGNAT?
Carrier-grade NAT means the ISP shares a public address among customers. Your router may not receive a directly reachable public address, so normal port forwarding cannot accept unsolicited inbound traffic.
Sources, scope and corrections
This guide prioritizes official platform and operating-system documentation, then uses reversible diagnostic steps. Exact locations and options vary by game. Report corrections to bugridez@gmail.com.