Port Forwarding. What exactly happens when using port forwarding for gaming?
In: 6
Normally sending things across the internet is like using a set of mailboxes to send and receive mail.
Your computer has 65536 “ports” with numbers. Think of them as letterboxes, mailboxes, etc. each with a number on. When you send a message out to the world (like posting a letter), you put it in a certain number mailbox and it gets sent out to the world. When you receive a message, it has to be addressed to a number, and the message is then put into that mailbox only.
For the majority of home users, you can send mail from any of those numbers. When you do, any reply will come back to the same number mailbox that you sent it from.
Your router/firewall have a thing called a NAT gateway that is clever enough to pass that mail on for you, but also remember what number mailbox you started the conversation from.
So if someone tries to send you something to an mailbox that you HAVEN’T used, the computer/router are smart enough to know that, and they just throw that mail away. You didn’t “start” that conversation, so they know it’s nothing you’ll be interested in.
For instance, say you want to go to Facebook. You send a message to Facebook but you send your “letter” to Facebook from a random number. If Facebook get the message, they only know the address it came from, so they will send their reply back to that same number. Because the numbers match (you spoke to Facebook from that number, and Facebook replied to that number), your router/firewall allow the rest of the conversation to happen.
But if someone comes along and wants to talk to your computer and just picks any number, including the number you spoke to Facebook on, the router/firewall knows that you weren’t having a conversation with them on that number. That’s the number you were using to talk to Facebook, not them. So it refuses the conversation. Similarly, if someone just made up a number, and you’ve not started any conversations from that mailbox, it will just throw any incoming messages to that mailbox away.
This works great, and has many benefits beyond a mild security. But it means that people can’t “just talk” to you without you starting the conversation. For instance if you want to talk to your friend, and both you and your friend use the same system, neither of you can ever start the conversation because the other side will always just ignore it.
In the old days, everyone moaned about NAT and how it worked, because it meant that you couldn’t “just talk” to someone. Now almost every home users on the planet have such a NAT setup in their router. Most webservers, game coordination servers, etc. do *NOT* have a NAT setup. So you can always talk to Facebook, or XBox Live because they want you to start the conversation. But when you’re trying to play with a friend who is also behind NAT, both of you will not let the other side start the conversation, so you have to have some way to “start” the conversation and that means changing your router/firewall slightly.
So what you have is a “port-forward”. This basically says to the firewall “any mail that comes into number 2319, wherever it came from, let me read it on my computer over there”. And your firewall/router will then allow that. Now, one of you can initiate a conversation and once it’s started, both of you will know how to reply and your routers/firewalls will allow it through.
Port-forwarding is generally only required when you’re doing this kind of “hole-punching” in your firewall, and it can be a security risk if the computer that you “allow” to handle those incoming messages is vulnerable. You never really need port-forwarding to do ordinary consumer things like web browse, watch videos, send email, or play through a game co-ordination service like XBox Live or Steam. That’s because the other end WANTS you to start the conversation, so they don’t have a NAT setup (and in the case of Steam, etc. both you and your friend can start the conversation with Steam, and Steam relay the messages between the two of you so that you don’t have to forward any ports). But almost every home and most offices will have a NAT setup.
And most datacentres, companies hosting servers, etc. will either have to configure port-forwarding for the services they want to offer (e.g. web, email, etc.) or do not have a NAT setup at all.
Generally speaking, port-forwarding should be unnecessary for the average user. In fact there are ISPs out there that won’t LET you port-forward, even if you try to. But it’s only when you want to “host services” (i.e. you want to let all messages through and have the OTHER side to initiate the conversation) that you ever need to do it.
In work I host websites, so I have to “port-forward” port 80 (which is the HTTP web port) and port 443 (HTTPS) to my webserver. Now anyone in the world can talk to my webserver, even though there’s a firewall between us. This could be dangerous. You’re basically opening up holes in your firewall.
For the most part, port-forwarding should be entirely unnecessary these days, and if you don’t understand when you need it and when you don’t, then I would suggest that you shouldn’t be forwarding ports at all. As an IT manager, I refuse port-forwards on my networks unless someone has a really good reason for them, AND we can justify it from a security point of view.
If you want to host, say, a Minecraft server from your home PC, then it’s possible you’ll need to “forward” the Minecraft port to the address of your home PC. What you’re doing it when that happens is that you’re cutting a small hole in your firewall to allow the entire Internet to talk to your Minecraft server.
For everything else – including the vast, vast, vast, vast, vast majority of games etc. that you’ll ever play, port-forwarding isn’t needed. And there’s something called UPNP which is like an “automatic” port-forwarding, which is both dumb, insecure and dangerous. It’s also entirely unnecessary (I’m a massive gamer, and host many IT services, and I disable UPNP on all my routers and networks, personal and professional). UPNP is like having your computer shoot holes in your firewall whenever it feels like it.
Latest Answers