CnC General and ipitables woes. Need HELP PLS!

CnC General and ipitables woes. Need HELP PLS!

[SBlaze]

Recently a friend and I decided we would like to play EA's Command and
Conquer's Generals in a "Direct Connect" game. We had a time finding
information about the ports needed. The Readme file would have you believe you
need to open alot of ports to make this work... however upon inspection of the
games pratices... I discovered that it listens on port 8086 for UDP(always)..
Once a game is started 8088 opens.... So in leaning this(my friend and I)
thought we could get by with just some standard PREROUTING(see below)

iptables -t nat -A PREROUTING -p udp --dport 8086 -j DNAT --to-destination
192.168.1.25:8086
iptables -t nat -A PREROUTING -p udp --dport 8088 -j DNAT --to-destination
192.168.1.25:8088

I'm not the only one having this problem as you can see here...

http://www.computing.net/linux/wwwboard/forum/18596.html  

So my question is... is some sort of con. tracking mod needed? Anyone know
anything about this problem? Thanks for your time and help anyone

P.S. The friend and I also tried the FirewallPortOveride option and had it
ignored as well... So we are at a loss after for searching for help...
I'm turning to you capable guys for help :}}





=====
"No touchy NO TOUCHY! Emperor Kuzko -=Emperor's New Groove=-"

__________________________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo
http://search.yahoo.com

Re: CnC General and ipitables woes. Need HELP PLS!

[Sascha Reissner]

From: "SBlaze" <dagent.geo@yahoo.com>

[...]

> So my question is... is some sort of con. tracking mod needed? Anyone know
> anything about this problem? Thanks for your time and help anyone

[...]

Those kind of games tend to include the IP address of the "gaming" machine
withing the payload of their datapackets.

As i don't know that game i can just tell you that you might want to take a
look into .ini files or parameters for the game to override that behaviour.

Some games allow players via parameter to set a different ip that will get
included into the data payload.

Greets,
Sascha

Re: CnC General and ipitables woes. Need HELP PLS!

[Bret Holbrook]

I also had the same issue with CnC and there is an .ini file with a port
over-ride in it, but adjusting it produced no successful result.  I am
also struggling with NWN.  After putting all the appropriate prerouting
commands in as you did with all the ports they suggest, it still does
not work.  There have been many other games I've struggled with also.  I
have actually only been able to get a fraction of them working.  It
seems by the time I get the rules working and am done scouring the
internet for help, we are playing a different game :).  I am considering
just plugging my dedicated linux server into the internet, setting up
basic masq for my internal pc's to surf, burning an image of the HD, and
leaving it wide open to attack from the internet.  If some kid wants to
run a newsgroup server off it, fine, as long as I can play my video
games with my buddies in college.  Setting up basic Iptables was no
sweat, this more advanced routing for video games and such is extremely
complex to the un-learned.

>>> "Sascha Reissner" <sascha.reissner@toxicnet.de> 04/16/03 10:53PM
>>>
From: "SBlaze" <dagent.geo@yahoo.com>

[...]

> So my question is... is some sort of con. tracking mod needed? Anyone
know
> anything about this problem? Thanks for your time and help anyone

[...]

Those kind of games tend to include the IP address of the "gaming"
machine
withing the payload of their datapackets.

As i don't know that game i can just tell you that you might want to
take a
look into .ini files or parameters for the game to override that
behaviour.

Some games allow players via parameter to set a different ip that will
get
included into the data payload.

Greets,
Sascha

Re: CnC General and ipitables woes. Need HELP PLS!

[SBlaze]

--- Sascha Reissner <sascha.reissner@toxicnet.de> wrote:
> From: "SBlaze" <dagent.geo@yahoo.com>
> 
> [...]
> 
> > So my question is... is some sort of con. tracking mod needed? Anyone know
> > anything about this problem? Thanks for your time and help anyone
> 
> [...]
> 
> Those kind of games tend to include the IP address of the "gaming" machine
> withing the payload of their datapackets.
> 
> As i don't know that game i can just tell you that you might want to take a
> look into .ini files or parameters for the game to override that behaviour.
> 
> Some games allow players via parameter to set a different ip that will get
> included into the data payload.
> 
> Greets,
> Sascha
> 
> 
Hi Sascha,

  I agree with you on the fact that this probably could all be laid to rest by
a configuration "correction."  However there is a small problem with that, and
that is Doccumentaion. Here is the only information reguarding Firewalling and
such in the actuall README of the game.

<snippet>

2.9. Firewall Issues:

If you are running a firewall (particularly a NETGEAR solution) and are unable
to connect to other players while in the Command & Conquer Generals multiplayer
lobby, check the Send Delay box under the Network Options portion of the game's
Options menu. If you are still experiencing connection problems, you may want
to place your firewall in DMZ mode. (WARNING: Doing so will open your firewall
ports to everyone, and this should only be done as a last resort). If you do
not know how to configure your firewall settings, consult your firewall
documentation or contact your Internet service provider. 

If you have made changes to your firewall configuration since the last time
that you played Command & Conquer Generals online and are experiencing
connection difficulties, click the Refresh NAT box under the Network Options
portions of the game's Option menu. It is highly recommended that you click
this box every time you change your Internet or firewall settings. 

</snippet>

This to me sounds like it's reffering to NETGEAR routers and local machine
firewalls? This is not the case for me obviously since my issue involves
iptables and the game is Windows based( and my lines posted earlier show it
being fowarded to an internal game). Even if the formentioned is the case with
"external" firewalls both my friend and me updated after changes to the fws.

Now there is another section in the readme following the above one that looks
like it may have some relevance.

<snippet>

2.10. Firewall/NAT Port Number Info:

The game will need to talk to external servers that use the following port
numbers.  These ports need to be open in your firewall in order to play on
Generals Online:
 
TCP ports:
80, 6667, 28910, 29900, 29920
 
UDP ports:
4321, 27900
 
If your firewall does not allow outgoing packets to open ports to incoming
traffic, or you experience problems connecting to other players, you will have
to specify which port you want Command & Conquer Generals to use for
communicating with other players.  To do this, perform the following steps.
 
Go to your “My Documents” directory, and go to the “Command and Conquer
Generals Data” directory.  Right click on the options.ini file and choose
"Edit."

Look for the "FirewallPortOverride" entry. If you don’t see this entry, add it
as a new line.  Then assign the port you want to use to the port override
entry.  After making this change, this entry should look like:
 
FirewallPortOverride = XXXX
 
Where XXXX is the port number you have chosen.  You will need to open the
chosen port in your firewall for communication with players external to your
firewall or NAT device.  If you use the port override feature, the port you
have chosen can not be masqueraded by a NAT device.

</snippet>

This seems to pertain only to "Online" games. We are  trying to play a Direct
Connect one.... In Desperation we tried the FirewallPortOverride option to no
avail....


Coming full circle to your suggestion of changing the actual header's
ip...there is no option for that mentioned in the README.... Case of poor
documentaion? Does that option exsist? Perhaps they have bad headers and need a
con track modules to work with iptables? I'ld sure like to know!

Thanks for everyones time.. I hope we can all put our heads together and figure
this out!

=====
"No touchy NO TOUCHY! Emperor Kuzko -=Emperor's New Groove=-"

__________________________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo
http://search.yahoo.com

Re: CnC General and ipitables woes. Need HELP PLS!

[SBlaze]

I don't believe the problem lies in iptables really. What I think the culprit
is ....is the game makers are not adhearing to TCP/IP standards. Now I'm no
guru on TCP/IP or even more to the case UDP which is what games seem to use. I
think if the makers of Counter Strike can get it right then so should the
others. I had NO problem routing it to internal machines.

That being said I don't think everyone should be left in the cold. If iptables
is to be a real world firewalling soloution... it's going to have to work with
the good and bad implimentations of programinng/TCP/IP stacks etc. So like I
had mentioned before I think some sort of connection tracking module will be
needed... unfortionally I don't know how to program :{{

Now I must reply to the other message I got from Sassan... heh stay tuned!


--- Bret Holbrook <bholbrook@michiganfamilyresources.org> wrote:
> I also had the same issue with CnC and there is an .ini file with a port
> over-ride in it, but adjusting it produced no successful result.  I am
> also struggling with NWN.  After putting all the appropriate prerouting
> commands in as you did with all the ports they suggest, it still does
> not work.  There have been many other games I've struggled with also.  I
> have actually only been able to get a fraction of them working.  It
> seems by the time I get the rules working and am done scouring the
> internet for help, we are playing a different game :).  I am considering
> just plugging my dedicated linux server into the internet, setting up
> basic masq for my internal pc's to surf, burning an image of the HD, and
> leaving it wide open to attack from the internet.  If some kid wants to
> run a newsgroup server off it, fine, as long as I can play my video
> games with my buddies in college.  Setting up basic Iptables was no
> sweat, this more advanced routing for video games and such is extremely
> complex to the un-learned.
> 
> >>> "Sascha Reissner" <sascha.reissner@toxicnet.de> 04/16/03 10:53PM
> >>>
> From: "SBlaze" <dagent.geo@yahoo.com>
> 
> [...]
> 
> > So my question is... is some sort of con. tracking mod needed? Anyone
> know
> > anything about this problem? Thanks for your time and help anyone
> 
> [...]
> 
> Those kind of games tend to include the IP address of the "gaming"
> machine
> withing the payload of their datapackets.
> 
> As i don't know that game i can just tell you that you might want to
> take a
> look into .ini files or parameters for the game to override that
> behaviour.
> 
> Some games allow players via parameter to set a different ip that will
> get
> included into the data payload.
> 
> Greets,
> Sascha
> 
> 
> 
> 


=====
"No touchy NO TOUCHY! Emperor Kuzko -=Emperor's New Groove=-"

__________________________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo
http://search.yahoo.com