Distinguish a player who cannot join from one who joins and later drops. Verify the incoming route for the first; collect evidence around the interruption for the second. A shared timeout or MTU recipe hides this distinction.
For an existing dedicated server, this guide adds timed connection observations and a controlled repair, using Linux examples and Pocketpair documentation checked on 4 November 2026. Initial mapping is covered in the listener and advertised-port guide.
Record the route that the player actually uses#
Pocketpair documents configurable UDP 8211 as the default game endpoint. Check the actual listener and record the client destination, router/provider mapping, host port and container port; launch overrides can change the default.
Keep three controls separate:
| Control | Purpose | Check |
|---|---|---|
-port | Game listening port | Effective launch and socket |
-publicport / PublicPort | Community endpoint advertisement | Actual outside mapping |
-publiclobby | Community-server registration | Intended listing mode and current entry |
An advertised public port does not change the listening socket. For example, public UDP 18211 can map to the host's UDP 8211; capturing only 18211 inside a container listening on 8211 can miss the relevant traffic.
Xbox and PS5 use the documented community-server route. Compare CrossplayPlatforms, compatible client/server builds and the actual entry selected by the console. A successful Steam direct join does not establish that the console followed the same advertised endpoint. Keep REST and RCON administration private; opening them is unrelated to gameplay UDP.
Establish one observation window#
Choose one affected player and one attempt. Record the timestamp, timezone, client platform, destination and exact failure. Note whether the server had just restarted and whether existing players kept playing.
For a directly installed systemd service named palworld, these commands collect a short baseline:
date -u +'%Y-%m-%dT%H:%M:%SZ'
sudo systemctl show palworld -p MainPID -p NRestarts -p ExecStart
sudo ss -lunp 'sport = :8211'
sudo journalctl -u palworld --since '15 minutes ago' --utc --no-pager
Replace the service and port. Match the game process, not merely a wrapper PID or another installation. Keep output private if launch arguments contain secrets.
For containers, inspect both the game network namespace and published host mapping. A missing host userspace listener does not disprove Docker forwarding; a container socket does not prove publication. Trace both boundaries before editing.
Watch one real external attempt#
Test from another network. Pocketpair documents that some routers cannot reach their own community server through its public endpoint from the same LAN.
With permission to inspect the server's traffic, observe a bounded interval on the correct host or namespace:
sudo timeout 30 tcpdump -ni any -nn -c 80 'udp port 8211 and host 203.0.113.25'
Replace the port and documentation address 203.0.113.25 with the actual port and affected client’s public address visible at that point. A tunnel or translation can change that address. This prints metadata without requesting a payload dump or writing a capture file. Addresses are still private incident data. The command stops after thirty seconds or eighty packets; a timeout exit status of 124 means its deadline expired, not that the game failed.
Coordinate the attempt and correlate addresses and timestamps. On bridge hosts, any can show one packet on several interfaces; duplicates are not necessarily repeated application messages. Capture counts are not loss percentages. Start immediately before the attempt; reaching the cap before the incident makes the window inconclusive. Repeat within suitable bounds.
| Observation during the attempt | Next check |
|---|---|
| No matching arrival at the intended boundary | Destination, public address, NAT, upstream policy and whether the correct interface/namespace was observed |
| Arrival at the host, none at the container boundary | Published mapping, forwarding policy and actual container port |
| Arrival and replies at the game boundary, but no completed join | Return mapping, client receipt and game version/platform/authentication logs |
| Player was already in the world before traffic stopped | Process/restart timeline and the previously established path, including client network changes |
A capture can see a packet before a later firewall hook drops it. A server-side reply does not prove the client received or accepted it. Add a client-side observation when available; consoles may provide only their error and a controlled network comparison.
Choose a repair that matches the evidence#
For a missing route, check UDP mapping, provider firewall and host policy. Carrier-grade NAT requires a reachable upstream arrangement; another home-router rule cannot supply it. On a public VPS, permit the configured UDP port. Follow documented container forwarding policy rather than assuming UFW controls every published path.
For simultaneous server restarts or unresponsiveness, retain application and resource evidence. Longer timeouts cannot restore an exited process. Resolve version or platform rejection before changing network parameters.
If only one player drops, compare the same device and account on another ordinary connection, keeping the server build and world unchanged. Repeat the session: one quiet five-minute test cannot settle an intermittent report.
Treat MTU as a path-specific hypothesis#
Investigate MTU when observations suggest a path problem, especially after adding a VPN or tunnel. Record the original configuration, compare failing and working routes, and escalate demonstrated path-MTU problems through the provider or network owner before permanent changes.
Linux ping tests ICMP echo, not a Palworld UDP handshake. tracepath can contribute path-MTU observations, but incomplete replies and different probes limit the conclusion. A successful ping does not certify the game path, and unanswered probes do not prove that Palworld's packets are too large.
Avoid copying universal MTU values, global UDP timeouts, socket-buffer sysctls or undocumented Engine.ini keys. Change one justified parameter during maintenance, retain its old value and have a recovery route if remote access is affected. The result must improve the original player attempt without breaking working clients.
Verify the same path after the change#
Ask the affected player to enter the expected world, stay through the previously failing activity and reconnect. If a listing was involved, test its current entry as well. After a controlled restart, verify the applied configuration, endpoint and world again.
Keep the mapping, timestamped observations and accepted change with the server record. Nexardo can organize administration of your own infrastructure; retain game network evidence alongside host settings.
Sources#
- Pocketpair: game network requirements, listening and advertised arguments and configuration fields.
- Pocketpair: community-server setup and hairpin NAT and platform joining methods.
- Pocketpair: private REST boundary.
- tcpdump: maintainer's capture manual, Linux socket inspection and journal filtering.
- iputils: ICMP ping and tracepath limitations.
