Network Architecture in Foundry VTT
Foundry VTT operates on a straightforward client-server model over standard web protocols. Unlike fast-paced action titles that require high-throughput UDP packet pipelines, Foundry VTT communicates exclusively over TCP:
| Port | Protocol | Purpose | Direction |
|---|---|---|---|
| 30000 | TCP | HTTP web interface, static assets, and WebSocket transport | Inbound |
| 443 | TCP | Standard HTTPS port when deployed behind a reverse proxy | Inbound |
| 80 | TCP | HTTP redirect and Let's Encrypt ACME certificate validation | Inbound |
| 443 | TCP | Outbound licensing and package manifest queries (foundryvtt.com) |
Outbound |
Note
Foundry VTT does not use UDP for core gameplay or canvas updates. All actor sync, dice rolls, scene changes, and chat messages transmit through persistent WebSocket connections on the assigned TCP port.
Port Allocation in DustBowl Warden
In DustBowl Warden, ports are assigned explicitly:
- Open your server instance in DustBowl Warden and select the Network tab.
- Note your primary port allocation (default
30000). If multiple containers share a host node, Warden will assign a unique port (e.g.31245). - Ensure your
options.jsonand startup parameters match the assigned port:{ "port": 30000 }
Direct Connections vs. Reverse Proxy
Option A: Direct Connection (Port 30000)
Players connect directly to your server's public IP and assigned port:
http://203.0.113.50:30000
- Requires TCP port 30000 to be open and unblocked by firewall rules.
- Limitation: The site runs under unencrypted HTTP. Web browsers will disable WebRTC camera and microphone access.
Option B: Reverse Proxy (Recommended for Audio/Video)
Deploy an edge proxy (such as nginx, Caddy, or Traefik) that listens on external port 443 with SSL, routing traffic internally to port 30000:
https://vtt.dustbowl.games
- Hides the internal container port from players.
- Provides a secure HTTPS context required for WebRTC audio/video chat.
- Enables HTTP/2 multiplexing for faster image and audio asset downloads.
Generate your reverse proxy configuration with our Foundry VTT Reverse Proxy Config Generator.
Cloudflare DNS and Proxying Rules
If managing your domain via Cloudflare:
- With a Reverse Proxy: You may enable the Cloudflare proxy (orange cloud) for standard HTTP/HTTPS traffic. Ensure WebSockets are enabled under Cloudflare Network settings.
- Without a Reverse Proxy (Direct to Port 30000): Cloudflare free edge proxies do not proxy non-standard HTTP ports like 30000. You must set your DNS record to DNS-Only (grey cloud) to allow direct traffic through to your server.
Verify your server connection strings using our Server Connection URL Generator.