Ports & firewall

The most common reason a freshly installed node never comes online is a firewall. GameDash needs the panel to reach the node, not merely the node to reach the panel.

Why inbound matters

When a daemon starts it asks the panel which ports to bind, binds them, and then completes a status handshake. The panel finishes that handshake by calling the node back. A node that can reach the internet but cannot be reached will install cleanly, appear to run, and never come online.

Ports

PortServiceWho connects
2145Daemon REST API (HTTP)Panel
2146Wrapper control API (HTTPS)Panel
2147Daemon REST API (HTTPS)Panel
2149Daemon SSH / SFTPUsers, when enabled
2153Daemon TCP relayPanel

2146 is the wrapper's, not the daemon's. It has to stay reachable even when the daemon is down — that is how a stopped daemon gets started again. Opening only the daemon's ports leaves you unable to recover a node remotely.

2149 is only bound when ssh.server.enabled is exactly true. It is off by default.

Game ports

Instances need their own ports on top of the above, and they vary per game — often a range, and often UDP as well as TCP. Plan for them when sizing a node's firewall rules rather than opening them one at a time.

Where ports come from

For the four service ports, precedence is:

  1. What the panel tells the node to bind
  2. daemon.properties
  3. The compiled default

So changing api.server.https.port on a node may not take effect if the panel is supplying a different value. Change it in the panel.

Example

Allowing the panel in on a Debian-family node with ufw, where PANEL_IP is your panel's address:

ufw allow from PANEL_IP to any port 2145 proto tcp
ufw allow from PANEL_IP to any port 2146 proto tcp
ufw allow from PANEL_IP to any port 2147 proto tcp
ufw allow from PANEL_IP to any port 2153 proto tcp

Restricting by source is worth doing. The daemon's API is authenticated, but there is no reason to expose a node's control plane to the whole internet.

Checking

From the panel host:

curl -sk -o /dev/null -w '%{http_code}\n' https://NODE_IP:2147/

Anything other than a connection timeout means the port is open and something is listening. A timeout is a firewall or routing problem; a refused connection means the port is reachable but nothing is bound, which points at the daemon rather than the network.