For a direct public connection, make the address given to players lead to the UDP socket your Factorio instance actually uses. The default game port is 34197/UDP. A router entry, host rule and game launch configuration must describe the same path; opening TCP 34197 does not repair it.
This guide starts with a working Factorio server and focuses on routing through a home router or VPS firewall. Keep the existing factory. Password, version and mod rejections belong to the connection diagnosis guide, after packets reach the intended instance.
Write down the endpoint before adding rules#
On the Linux host, inspect its interface addresses, route and expected socket:
ip -br -4 address
ip -4 route
sudo ss -lunp 'sport = :34197'
Replace 34197 in every check if this instance uses another port. Compare the process with the actual service or container. Read the existing launch configuration for --port and --bind; a bind value can include a port too. Do not start a second server merely to obtain a listener.
For a directly installed service, a loopback-only socket cannot accept Internet packets addressed to another interface. A wildcard bind such as 0.0.0.0 means local IPv4 interfaces, not a public address to distribute. Behind a router, bind to an address present on the server rather than the router's WAN address.
Use this allocation sheet before touching the router:
| Item | Home-hosted example |
|---|---|
| Server's reserved LAN address | 192.168.1.50 |
| Observed game listener | UDP 34197 |
| Router's public endpoint | Your actual public IPv4, UDP 34197 |
| Forward destination | 192.168.1.50, UDP 34197 |
| Address players enter | Public IPv4 followed by :34197 |
The LAN address is an example. Reserve the real server address in DHCP or use a correctly configured static address. A forwarding rule aimed at yesterday's DHCP lease may reach another device.
Choose the rule for the actual topology#
On a home router, create a UDP mapping from the selected external port to the server's reserved LAN address and internal game port. Start with matching external/internal numbers to simplify diagnosis. Do not select a broad range or TCP-only profile because a guide for another game uses it.
Check the router's WAN address against the public IPv4 assigned to the connection. An RFC1918 private address or shared 100.64.0.0/10 address on the WAN suggests another NAT layer. A different WAN/public address needs investigation too; a mismatch alone does not identify exactly who controls the extra layer.
If you own two routers in series, both need an appropriate forwarding path, or you need a deliberately planned bridge/routing arrangement. If the outer translation belongs to the ISP, your inner rule cannot create its incoming mapping. Ask about an inbound-capable public address, or use a deliberately supported alternative connection path. IPv6 is a separate address-family and firewall decision, not a promise that every client can bypass CGNAT.
On a VPS, a publicly routed interface normally has no home-router rule to create. Check the provider firewall and any documented provider NAT separately. Rules must target the game instance and correct UDP destination. Do not instruct joining players to forward this server port on their home routers.
Factorio also supports NAT traversal and Steam joining. A successful traversal path does not prove a manually advertised public endpoint works, and a manual forward is not compulsory for every possible session. Keep the route under test explicit.
Add a narrow host permission#
On an Ubuntu host using UFW, inspect the active policy first:
sudo ufw status verbose
sudo ufw status numbered
For an intentionally public, directly installed listener, a missing UDP allowance can be added as:
sudo ufw allow 34197/udp
sudo ufw status numbered
An earlier deny, another firewall layer or a provider rule can still block the attempt. For a restricted group with known source addresses, use the corresponding source-restricted policy. If UFW is inactive, identify the system that actually filters traffic; enabling or resetting a firewall is a separate maintenance change that must preserve SSH and other services.
Keep Factorio's RCON administration endpoint outside this public game rule. It has its own bind and port settings. A player connection failure is not a reason to publish remote administration.
For Docker bridge networking, inspect the host-to-container publication and its protocol as another mapping. UFW's ordinary host rules alone may not control Docker-published traffic. Follow the runtime's documented filtering path rather than disabling its firewall integration.
Validate from outside the network#
Have a player on another Internet connection use Multiplayer → Connect to address with the verified public endpoint. Also test a local client with the server's LAN address. Testing your public address only from its own LAN mixes external reachability with the router's hairpin behavior.
A web TCP checker cannot validate Factorio's game protocol. If the attempt still fails, observe a short UDP capture on the server while that player retries:
sudo timeout 20s tcpdump -ni any -nn 'udp port 34197'
This assumes tcpdump and timeout are installed. It prints packet summaries without saving payloads. Timeout exit status 124 simply means the chosen capture window ended.
No matching traffic directs attention to the chosen endpoint, upstream rules and the capture filter. Incoming traffic without replies requires checking host/container delivery, binding and logs. Traffic in both directions proves some exchange, not successful factory loading. Match the attempt time and player address before drawing conclusions.
Finish with an actual join and completed map transfer. Record the working mapping, provider rule and instance port; remove temporary permissions deliberately if you added any. For machines you own, Nexardo can help organize infrastructure administration alongside this endpoint record. Keep the game configuration and its network path documented together.
