Port Forwarding and Network Configuration

Overview

Windrose uses a dynamic NAT punch-through system for invite-code connections, but direct IP mode requires the game port to be explicitly exposed. This article covers port requirements, panel allocation, firewall rules, and common network issues.

Port Reference

The game port (7777) is the primary port used when USE_DIRECT_CONNECTION = true. The RCON port (8780) is only required if you are running WindrosePlus and want to access the admin dashboard.

Panel Port Allocation

In Pterodactyl or WISP, each server must have its ports allocated before they are accessible:

1. Go to Admin > Servers > [Your Server] > Build Configuration.
2. Under Allocation Management, add port 7777 (or confirm it is already assigned as the default allocation).
3. If you are running WindrosePlus, also allocate port 8780.
4. Save changes. A server restart is required for new allocations to take effect.

Firewall Rules

Linux Host (iptables)

If the Pterodactyl node runs on a Linux host with iptables, add rules to allow traffic on the game port:

iptables -A INPUT -p tcp --dport 7777 -j ACCEPT
iptables -A INPUT -p udp --dport 7777 -j ACCEPT

For WindrosePlus RCON:

iptables -A INPUT -p tcp --dport 8780 -j ACCEPT

Persist these rules using iptables-save or your distribution's preferred method (e.g., netfilter-persistent).

Linux Host (ufw)

ufw allow 7777/tcp
ufw allow 7777/udp
ufw allow 8780/tcp

Windows Host

Add an inbound rule in Windows Firewall for WindroseServer.exe, or open the ports directly:

1. Open Windows Defender Firewall > Advanced Settings.
2. Create a new Inbound Rule for port 7777 (TCP and UDP).
3. If using WindrosePlus RCON, add a rule for port 8780 TCP.

Alternatively, add WindroseServer.exe as a firewall exception to allow all traffic on any port it uses.

Router / NAT Configuration (Invite Code Mode)

For invite code mode to work, UPnP must be enabled on the router or gateway sitting in front of the host machine. The server uses UPnP to automatically open a NAT mapping:

1. Log into your router admin interface.
2. Enable UPnP (Universal Plug and Play) in the network or LAN settings.
3. Restart the Windrose server — it will attempt UPnP negotiation on startup.

If UPnP is not available (e.g., on a VPS or dedicated server in a datacenter), use direct IP mode instead.

Verifying Port Availability

Before directing players to connect, verify the port is reachable from outside your network. Use an external port checker tool and test port 7777 TCP against the server's public IP. If the port appears closed:

• Confirm the panel allocation includes the port.
• Check that no firewall rule is blocking it at the node, network, or provider level.
• For cloud providers (AWS, Hetzner, etc.), check security group or firewall panel rules in addition to OS-level iptables.

IPv6 Requirement

Windrose requires IPv6 to be enabled at the kernel level, even if you are not using IPv6 addresses for connections. The server opens an AF_INET6 socket on startup. If IPv6 is disabled at the kernel, the server will log a "Data inconsistent" error and fail to start. Confirm IPv6 is not blocked in your VPS or host configuration.

Related

• Direct Connect vs Invite Codes: How Players Join
• Installing and Starting a Windrose Dedicated Server
• Setting Up Admin Access with WindrosePlus and RCON
• Troubleshooting Common Windrose Server Issues