Configure firewall access

Record the actual ports

Read your INI files before creating rules. These are the Season 6 defaults; retain any intentional custom values.

• Public TCP: ConnectServer TCP_PORT 44405 and each running GameServerPort, typically 56900 for Regular and 56914 for a separate Siege process.
• Private TCP: JoinServerPort 56970, DataServerPort 56960, and ExDataServerPort 56906.
• Private UDP: ConnectServer UDP_PORT 55667.
• Private SQL: the actual SQL listener. A default instance often uses TCP 1433; named instances may use another or dynamic port.
• If a separate ChatServer is installed, read its configuration and allow its required player port. Do not create rules for services you do not run.

1. Add Windows inbound rules

1. Press Win+R on the server, enter wf.msc, and open Inbound Rules → New Rule → Port → TCP → Specific local ports.
2. Enter the ConnectServer TCP port and every player-facing GameServer port, separated by commas. For the default Regular + separate Siege setup, enter 44405,56900,56914.
3. Choose Allow the connection, select the network profiles used by the host, and name the rule MU player TCP.
4. Review existing SQL, DataServer, and ConnectServer UDP rules. Remove broad public allowances. For services on separate private hosts, restrict internal rules to the required private source IPs.
5. Check program-based rules too: an old executable-wide allow rule may expose more ports than intended. Keep Windows Firewall enabled.

2. Configure the network firewall

1. Allow the same player TCP ports in the hosting provider’s firewall if one is present. A Windows rule does not bypass a provider rule.
2. Behind a router, reserve the server’s LAN IP and forward only the player TCP ports to it. Use the same external and internal port numbers for a straightforward setup.
3. Set the public IP in ServerList.xml and MapServerInfo.xml. Update the client’s ConnectServer IP and regenerate ServerInfo.bmd if it changed.
4. If the router’s WAN address is private or differs from the provider’s public address, ask whether the connection uses CGNAT. Request a routable IP or suitable hosting; local forwarding cannot fix upstream CGNAT.

3. Test from another network

Keep each service running during the test. A stopped listener and a firewall block can both cause failure.

1. On an external Windows PC, run PowerShell: Test-NetConnection YOUR_PUBLIC_IP -Port 44405. Substitute the actual IP and port. TcpTestSucceeded should be True.
2. Repeat for every player-facing GameServer port, including hidden transfer servers. Then test the full login with the patched client.
3. If the test fails, run Get-NetTCPConnection -State Listen on the host. No listener on that port means the service is stopped or configured differently. If it is listening, check Windows rules, provider rules, forwarding, and the advertised IP.
4. Check private TCP ports from outside too: they should not be publicly reachable. Test-NetConnection tests TCP, not UDP. Inspect the UDP rule scope separately.

Ready to continue

• External players can see channels, log in, and transfer to required maps.
• SQL and internal services accept only their intended private connections.
• The firewall remains enabled and no obsolete broad allow rules remain.

Continue

Next: Prepare recovery and backups.

Reference: IGCN — Firewall rules. These instructions use the Season 6 file layout; keep configuration files and tools from the same release.