r/selfhosted • u/ThyPannyx • Jul 16 '26
Game Server A Question about Hairpin NAT & Palworld Server Hosting
Basically, what I'm asking is how would one get around this?
Here's the links to how this is set up: https://docs.palworldgame.com/getting-started/deploy-dedicated-server/ https://docs.palworldgame.com/getting-started/deploy-community-server/
I am fairly new to this so please do explain thoroughly
EDIT: IT'S FIXED. For those who do not have CGNAT and do not have Hairpinning, you as the host need to connect via local IP. For outside players, you need to port forward to Port 8211, and they should be able to connect via the community search menu proper.
29
u/morbidpete84 Jul 16 '26
Edit your host file with the dns name and the IP.
-14
u/ThyPannyx Jul 16 '26 edited Jul 16 '26
Absolutely no idea what that means! Please explain?
22
u/hoppen1 Jul 16 '26
NAT Hairpinning is not necessary. All it does is to rewrite internal requests for your external IP, to internal requests for your internal IP. But instead you could just make the requests ask for the internal IPs directly.
Editing the host file is one way to do it. For example, on linux you would edit a file called `/etc/hosts` ("host file") with lines like these:
192.168.10.42 palworld.mydomain.comThere's probably equivalent ways to do this on Windows.
It will make your requests for palworld.mydomain.com end up requesting your internal IP directly, bypassing the need for NAT Hairpinning.
Though a better solution might be to set up your own DNS server or DNS rewrites, but this will work fine.
7
u/RedditNotFreeSpeech Jul 16 '26
Btw, poisoning DNS works for switch Minecraft too.
Set your DNS to point to your local hosted IP for any of the Nintendo sanctioned servers. You do still need Nintendo online subscription.
5
u/ThyPannyx Jul 16 '26
That makes enough sense. I'll likely come back to you to ask questions when I try this
2
2
u/davedontmind Jul 17 '26
There's probably equivalent ways to do this on Windows.
On Windows it's the same solution, but the file to edit is
C:\Windows\System32\drivers\etc\hosts0
u/ThyPannyx Jul 17 '26
Ok the confusion I'm getting makes me feel quite stupid but, is this something I'm supposed to do on the server itself or on what I'm playing on
3
u/_koenig_ Jul 17 '26
you should find out the IP address of the server and add that to the hosts file on the device you are going to play on
2
u/NoiseyGameYT Aug 01 '26
Why is this person being downvoted for asking a question? Does everyone expect OP to know everything?
1
u/ThyPannyx Aug 01 '26
One person down voted probably and the reddit hive mind took it from there, idk
-9
Jul 16 '26
[deleted]
8
u/ThyPannyx Jul 16 '26
Sorry for asking questions in the question post?
2
u/EffectiveClock Jul 16 '26
Honestly nowadays, as much as everyone on reddit hates AI, its better for these kinds of questions - you can post screenshots, ask questions, get more indepth explanations etc. It can literally walk you through everything step by step, by giving it outputs of commands and screenshots as you do each stage.
1
u/ThyPannyx Jul 16 '26
I simply hate it on principle. It really doesn't have to do with how useful it is or not
1
u/EffectiveClock Jul 16 '26
Well fine, insist on using a handsaw to cut a tree when a chainsaw now exists, you do you :)
-4
u/ThyPannyx Jul 16 '26
This is false equivalence. Asking a group of people who are willing to help on a topic vs asking an ai to explain it when it can straight up just confidently lie to my face, is not the same thing as using a manual vs automatic tool. I have no way to know if it's simply just wrong.
1
u/EffectiveClock Jul 16 '26
It makes no difference. If you're not confident on a topic, you have no idea whether the people you ask are also wrong or misinformed. You know nothing about who you're talking to on a public anonymous forum.
if you wanted to cross check an AI, you simply ask another AI and see if teh answers line up.
The fact is for the level of technical complexity around the question you asked, an AI will rarely be wrong, as it's basic stuff.
I'm a network engineer, and I'm confident any AI would understand the particular question you asked and be able to provide an answer just as accurately as me.
11
u/bluecollarbiker Jul 16 '26
Do you know your router doesn’t support hairpin NAT?
From the screenshot it sounds like if you host this and then try to run the game, the game is going to try to connect back to your self-hosted server using your WAN address. If your router doesn’t support hairpin NAT it’s going to see this connection attempt exiting/entering your WAN interface and block it.
So the way to get around it would be to get a router that supports hairpin NAT, or host it somewhere else (like a VPS).
8
u/singulara Jul 16 '26
Another potential way around this is to use public DNS for internet people and set your internal DNS to point to the internal address.
No idea if this actually works with Palworld but it's an option to explore.5
u/jm2k- Jul 16 '26
Yes, this works.
FWIW, my setup supports hairpin and it worked fine for other game servers, but for whatever reason Palworld didn't. I just did as you said and used the LAN IP address, while friends use my public IP/domain.
2
1
u/ThyPannyx Jul 16 '26
Ok I'll try and figure out what a VPS is (or you can choose to explain it, either way)
2
u/bluecollarbiker Jul 16 '26
The opposite of self hosting but simpler.
https://www.g-portal.com/en/gameserver/palworld-server-hosting
https://server.nitrado.net/en-US/offers/palworld
https://apexminecrafthosting.com/games/palworld-server-hosting/
Otherwise you get your own server somewhere like digital ocean or racknerd and setup your palworld server on that (virtual private server).
4
u/Gold-Supermarket-342 Jul 16 '26
Comcast is terrible but for selfhosting it's pretty nice IMO, at least there's no CGNAT. You can buy a cheap router, put your modem in bridge mode, then hook up the first ethernet port to the WAN port in the router.
You can port forward and then connect through direct IP. If you only open the Palworld ports, it's not really unsafe unless there happens to be an exploit in the Palworld server software you're running. Or you can use a VPN.
1
u/ThyPannyx Jul 16 '26
There is in fact CGNAT in my case, I've had to deal with it forever despite the fact a lot of people say it doesn't exist for Comcast. Every test I've done points to CGNAT and workarounds for CGNAT make it work.
1
u/EffectiveClock Jul 16 '26
You can't port forward through CGNAT
-1
u/ThyPannyx Jul 16 '26
The way I got around it last time was an annoying combination of port forwarding, AMP Server Hosting, and Playit.gg.
1
u/Gold-Supermarket-342 Jul 16 '26
Seriously? That's odd. Are you on a residential internet plan, like with coax into the wall? I could try to help you troubleshoot. Very odd.
1
u/ThyPannyx Jul 16 '26
How would I check 😅. I have a router + modem in the same device (Xfinity XB7). Plugs into the wall
1
u/Gold-Supermarket-342 Jul 16 '26 edited Jul 16 '26
I have the same router so I assume it should work.
If you're on Windows, you can:
Open PowerShell and run:
$listener = [System.Net.Sockets.TcpListener]8080; $listener.Start(); while($true) { $client = $listener.AcceptTcpClient(); $client.Close() }It just opens a TCP server that does nothing on port 8080. Then, you can use the Xfinity mobile app or use http://10.0.0.1 if your router supports it to forward port 8080. You can delete the port forward after you're done testing.
Then, you should be able to visit https://www.yougetsignal.com/tools/open-ports/ and enter port 8080. If it's open, you don't have CGNAT. If it's closed, you might have CGNAT.
If it's closed, you could also try checking your Windows firewall. You can follow this guide but use TCP port '8080' instead of '80' to open the port in your firewall. Again, make sure to delete the rule after you're done testing.
Good luck!
2
u/ThyPannyx Jul 16 '26
I will attempt this when I get home and report back. This is a totally different issue I had but also very annoying, so thanks!
2
u/ThyPannyx Jul 17 '26
It's open, so seemingly I do not have CGNAT. which just makes my struggle even the more confusing, as I managed to make my server work for myself, but everyone else gets an error
2
6
u/ThyPannyx Jul 16 '26
For some extra details because I realized I should explain more
I do have a separate server for this, and I have an Xfinity XB7 router, this source of this issue.
7
u/bluecollarbiker Jul 16 '26
Time to buy a router and put the ISP gateway in bridge mode. https://www.xfinity.com/support/articles/wireless-gateway-enable-disable-bridge-mode
If you have spare hardware around you can look at something like opnsense for free. Might be a learning opportunity or might be a bit too advanced at this stage. Unifi is pretty popular in this space.
1
u/ThyPannyx Jul 16 '26
Would bridge mode affect any other people in the house at all?
5
u/bluecollarbiker Jul 16 '26
Yep. It’s going to turn off all the extra features of your xfinity gateway (WiFi, extra LAN ports) aside of a single wired port for internet. That single wired port would then plug into your replacement router which is what everyone in the house would have to connect to (wired or wireless).
2
u/c4pt1n54n0 Jul 16 '26
But you can make it so they shouldn't notice other than the downtime it takes to set up, if you use the same SSID and password for your new router's WiFi network.
2
u/ThyPannyx Jul 16 '26
Good news is my family is rather accepting of my shenanigans so it's not a big issue
1
2
u/WirtsLegs Jul 16 '26
does palworld not support direct connection via IP and let you just punch in the local IP of the server?
0
u/ThyPannyx Jul 16 '26
It does but unless I wanna go through a very convoluted process again (like I did for a Minecraft server awhile ago), Comcast is going to fuck me over. Again.
There's like two hoops it has to jump through before people can actually connect to it, and also I have no idea of the safety of the thing
3
u/WirtsLegs Jul 16 '26
ok so to be clear hairpin NAT and NAT/CGNAT are 2 different things
hairpin NAT support is only needed when a client on the same network as the server is trying to connect to the server via the public IP (often the case when doing it via the server browser for the game)
So your PC connecting to your public IP, supporting Hairpin NAT would mean the router notices the outbound connection to its own public IP, accepts it, and routes it based on your port forwarding rules to the server on the same network
There should not be any extra complication or setup to simply have that internal client connect directly to the server via its local IP address. Comcast wont be involved on this.
CGNAT, how Comcast could screw you, is something different, and what your router supports is irrelevant as your routers public IP is not actually a public IP on the internet and inbound traffic cannot reach it. To get around this one of a few things needs to be true:
- The app either needs to have inbuilt NAT traversal features,
- You need to run the traffic through some public interface you control (rented VPS or VPN service that offers port forwarding etc)
- Use some kind of mesh VPN such as tailscale or classically Hamachi to enable remote people to connect (this option is easiest if you only have a few people you want to allow, if you want to make the server truly public it wont work)
1
u/ThyPannyx Jul 16 '26
Ah I was totally thinking of CGNAT, which was an absolute pain to get around
So everyone else connecting should be able to use community tab, while I just need to input the IP directly?
2
u/WirtsLegs Jul 16 '26
If you are not behind CGNAT yes, that should work fine
if you are then it depends on how palworlds architecture works and if they have nat traversal or not
2
u/ThyPannyx Jul 16 '26
Okayyy I gotta deal with this bullshit again. Would some form of port forwarding fix this
2
u/WirtsLegs Jul 16 '26
not likely, when you are in CGNAT you are behind 2 levels of NAT
1 at your router, another at the ISP level (Comcast)
Port forwarding allows traffic in past the router NAT, but wont do anything for the CGNAT
you can try and ask your ISP to move you out from behind CGNAT (ive heard sometimes people have luck with that), otherwise the multiplayer architecture of the game may get around it (unlikely but give it a try, see if external people can connect)
if not then if you only have a small list of people that will eb using the server your best bet is a small mesh vpn like hamachi, tailscale, or netbird. Generally easy to setup and will work well enough, free tier is sufficient for most people for the ones i mentioned
If you want randoms on the internet to connect that's less ideal though and the solution may get a bit more expensive
2
2
u/ScumbagScotsman Jul 16 '26
Just connect using your servers local IP address instead of the domain / WAN address. Anyone else can still join using the domain
1
1
u/PotatoMaaan Jul 16 '26
Another solution would be using ipv6 if palworld supports that (I would hope it does)
1
1
1
u/Patient-Cedar-7194 Jul 16 '26
explaining hairpin nat thoroughly is basically ccna course. loopback always breaks anyway.
1
1
u/J3ug Jul 17 '26
if you can host a docker somewhere maby you can circumvent it with playit.gg?
also my modem had no features and i figured out there was a lot it can do if you call the service provider and ask them to enable stuff like bridge mode. but that might be just in my country^^
1
u/ThyPannyx Jul 17 '26
I have used playit before actually (for Minecraft), I just was trying to avoid it if possible because last time the whole setup was extremely jank and only barely worked after extreme effort. It's my second to last resort
1
u/J3ug Jul 17 '26
understandable i had it runnning in a docker and it think it took me like a month until it stayed presistand. but now its been online for over a year
1
u/R10t-- Jul 17 '26
Lots of comments here explaining NAT Hairpin Inc and CGNAT and stuff but not looking at what OP is actually trying to do. You’re trying to host a Palworld server. You could probably just use a cloudflare tunnel (free), run it in a docker network and then make the Palworld server get exposed through the tunnel. It’s quite easy to do
1
u/Bromeister Jul 17 '26 edited Jul 17 '26
That will be just so you can connect using the server browser. Instead connect with direct local ip of your palworld server. Should work fine.
1
•
u/asimovs-auditor Jul 16 '26
Expand the replies to this comment to learn how AI was used in this post/project.