Networking: firewall issues for internet connection

[Aviras]

Hello everyone.

I've been programming on a co-op RPG for quite some time now, but my networking side has seen some troubles.

I'm using the lower level serverSocket-Socket way. Everything runs flawless within my own network, however connection over the internet is where the trouble is.

I understand this is due to the firewall. For the last couple weeks I've been browsing the internet, finding things like http tunneling, however never accompanied with a link to some useful info.

My architecture is as follows: a player has the option to make a serverSocket at a specified port. A new thread is created to allow incoming connections up to four. The player that created the serverSocket then connects to self as a client, for programming efficiency.

Clients send messages in text format to the server, provided a message protocol. Those messages are read and interpreted at the server side, and dealt with, such as sending a trade request to the right client socket.

I've looked up RMI, however it doesn't seem to fit my cause, since I don't see how to control all connections, so I can for example but player names and their sockets in a hashtable. If this isn't the case, this would help a great deal :).

If you have any other suggestions, I'd love to hear them. :)

Thanks for reading,
Aviras

[peter_budo]

Not having experience in network programming, but playing games for me logical approach would be to look on commonly used socket by commercial game companies Activision, EA or similar as usually they can get their game set without change to firewall rules (for many security products).
If that doesn't work, then obvious approach would be include in your installation/readme file requirement for changing firewall or enabling XYZ application to access/receive internet connection
(Hoping for someone else inside view as this is interesting question)

[Aviras]

I have no knowledge of how those companies do it. Also, it would be in C++, which has been quite a while.

However, if anyone knows how to manage single connections through RMI, it would also be greatly appreciated, since I can't seem to find the answer.

[JeffGrigg]

Generally the way multi-user Internet games work is that each client connects to the server(s) on port 80 with the HTTP protocol. This is the only reliable way to get through firewalls from arbitrary clients.

In particular, in general you cannot connect to clients: Servers cannot open connections to clients. Clients cannot open connections to other clients. This has to do with firewalls, and also the way the IP addresses are assigned: Many clients on the Internet don't have IP addresses visible from the Internet.

So this suggests that clients could use web services to talk to servers. For efficiency, one can hold client-to-server connections open and send multiple requests and responses through it. As long as the connection is open, the server can stream as much data as it wants to the client.

[Aviras]

I have a basic understanding in how networking works, however not enough to extract what I need to do about it from your message, though thanks for clarifying things.

What do you understand under web services ? If you could give me some general directions or links to useful information, I'd love to hear, I've been struggling with this for a while...

[Aviras]

Another issue would be NAT hole punching, if anyone has some tips..

[JamesCherrill]

I don't see anything fundamentally wrong with your current approach.I've used it myself more than once. It's just a bit fiddly getting the network setting right. Assuming your server is on a LAN sitting behind a NAT router:
Open a firewall exception on the server PC to allow incoming connections to the server socket's port.
Create a port forwarding rule on the router to map an incoming WAN IP/port to the LAN IP/port of your server. If necessary open the appropriate ports on the router's firewall.
Connect internet clients to the WAN IP/port.

[Aviras]

I am indeed on a LAN behind a NAT.

Thanks a lot for stating it so clearly. Although I haven't had the time yet to try what you said, it's a burdon falling off my shoulders knowing there's a well-defined solution.

I have one last question however. I want to make it as user-friendly as possible considering network setup, is it possible to change the manual port-forwarding to programmatical NAT hole punching ?

Thanks a lot.

[JamesCherrill]

...is it possible to change the manual port-forwarding to programmatical NAT hole punching ?.

I'm sure it is, but personally I have no idea how to do it! Perhaps someone else can step in here...

[Aviras]

At the moment I was able to make the connection through manual portforwarding and configuring my firewall through Firestarter in ubuntu 11.04 as a server, and a windows machine from outside as a client. Using windows as a server gave some problems, however I'm unsure what caused it at the moment, but I'll keep you updated.

[JamesCherrill]

I found this http://teleal.org/projects/cling/support/manual/cling-support-manual.html#section.PortMapping - looks like exactly what you need?

[Aviras]

It's indeed an awesome find!

However, for my situation, there are some things troubling me.
The technique they use requires UPnP, which lacks a lot of safety features.

This is ok for connecting your TV or things like that, but doing this with multiple PCs creates quite a security hole. Also, UPnP is turned off by default with almost all NATed boxes, due to this safety concern, thus requiring the user to manually configure their router anyway.

Also, through Port Forwarding(/NAT mapping), it is impossible for multiple computers within a network to be running a separate client.

In the meantime, I found some NAT hole punching material though.
For people looking, i suggest googling TCP hole punching java STUNT.

There seems to be a functioning library developed by Cornell University's Dep. of CS.
I haven't had the time to try it yet, but I'll let you know.

PS: Connection on windows as a server was also successful through manual portforwarding. When it failed I didn't configure the windows firewall settings correctly.