Hosting a G1R:MP dedicated server

Hosting a G1R:MP dedicated server

Public network access is required. A server hosted on your own computer still needs a publicly reachable address and the required ports opened or forwarded.

This requirement also applies when the dedicated server, launcher, and game are running on the same computer. The current 0.1.3 release uses Protocol 35 and the official G1R:MP service for server discovery and connection authorization, including direct-connect attempts. Private-only server addresses are not accepted for public registration. Update both the client and server; see Update 0.1.3.

The official service does not relay gameplay. After authorization, gameplay, voice, and resource traffic connects directly to the public endpoint advertised by the dedicated server. This architecture requires that endpoint to be reachable from the Internet.

Public address requirement

The host must have either:

• a public, externally reachable IP address; or
• a DNS name that resolves to that public address.

Addresses such as 127.0.0.1, localhost, 192.168.x.x, and 10.x.x.x are not reachable from the Internet.

If the server is behind a home router, configure port forwarding from the router's public address to the computer's fixed LAN address. If the ISP uses carrier-grade NAT (CGNAT), ordinary router port forwarding is not sufficient; request a public IP address from the ISP or host the server on a publicly reachable VPS.

For the standard automatic listing configuration, leave listing.publicHost empty. The official service can use the source address of the server heartbeat. Set it only when advertising a public DNS name that resolves to the same server.

[listing]
publicHost=

Default ports

The current default configuration uses the following ports:

Purpose	Default port	Protocol	Public access
Gameplay transport	7777	UDP	Required
Voice relay	7778	UDP	Required when voice chat is enabled
Resource download service	7780	TCP	Required when http.mode=auto or the built-in HTTP service is used
RCON administration	7781	TCP	Do not expose; loopback-only by default
MariaDB/MySQL	3307 in the shipped Gothic RP configuration, or the locally configured database port (commonly 3306)	TCP	Do not expose when the database is on the same host

The server also requires outbound HTTPS access, normally TCP port 443, to synchronize with the official G1R:MP service. This is an outbound connection and does not require router port forwarding.

If any ports are changed in serverconf.cfg, update the firewall and router rules to match the configured values.

Recommended bind configuration

The public services should normally listen on all local interfaces:

[server]
bind=0.0.0.0
port=7777

[voice]
enabled=true
bind=0.0.0.0
port=7778

[http]
mode=auto
bind=0.0.0.0
port=7780

Keep RCON restricted to the local machine:

[rcon]
enabled=true
allowRemote=false
bind=127.0.0.1
port=7781

Player capacity and server password

Set the player limit and optional join password in the [server] section. maxPlayers accepts any integer from 1 through 5000, inclusive. The server refuses to start when the value is outside that range.

[server]
maxPlayers=500
password=

The password setting supports three forms:

Configuration	Result
password=	No join password. The server is advertised as public.
password=a-literal-secret	Uses the literal value from serverconf.cfg. A non-empty password must contain from 1 through 128 bytes.
password=env:VARIABLE	Reads the password from the named environment variable when the server starts. The resolved value must contain from 1 through 128 bytes.

The environment-variable form keeps the credential out of serverconf.cfg and is recommended for hosted servers. The variable name must be a valid environment-variable identifier, and the server stops during configuration loading if the variable is missing, empty, longer than 128 bytes, or contains a forbidden control character.

Do not set listing.passworded manually. The advertised passworded value is derived automatically from the resolved [server] password, so the server list and health response cannot claim a password policy different from the one enforced by the server.

Before downloading resources, the launcher checks the server health response. It stops early when players has reached maxPlayers, and it requests a password when passworded is true. These checks provide immediate feedback only: the dedicated server independently enforces the slot limit and validates the password during admission. A stale server-list entry or modified client cannot bypass either rule.

Resource package limits

These expanded values apply from update 0.1.3 BUILD81. Older 0.1.3 clients must be updated. See Scripting limits and Server configuration limits for all other budgets and exact units.

The dedicated server and client enforce matching compatibility limits for Lua scripts and downloadable resources. Values at a stated hard boundary are accepted; a resource that exceeds that boundary is rejected before it can run.

Limit	Value	Scope
Lua script size	128 MiB	Each individual .lua script.
Resource file size	256 MiB	Each individual file included in the client resource catalog.
Catalog file count	262,144 files	All client scripts and downloadable files across the complete catalog.
Catalog payload	32 GiB	Sum of the file sizes declared by the complete client resource catalog.
Catalog JSON document	128 MiB	Serialized catalog.json metadata returned by the resource service.
Lua VM memory	1024 MiB by default	Each client-side resource Lua VM uses the 1024 MiB default. For each server-side resource Lua VM, [lua] memoryLimitMB is configurable from 4 through 4096 MiB; the shipped default is 1024 MiB.

The dedicated server validates manifests, script sizes, file counts, payload totals, and catalog JSON size while building the catalog. The client validates the catalog and every downloaded file again before caching or executing it. When http.mode=external is used, a CDN or reverse proxy may impose stricter transfer limits, but it cannot raise the limits enforced by the client.

Firewall examples

Windows

Run PowerShell as Administrator:

New-NetFirewallRule -DisplayName "G1R:MP Gameplay" -Direction Inbound -Action Allow -Protocol UDP -LocalPort 7777
New-NetFirewallRule -DisplayName "G1R:MP Voice" -Direction Inbound -Action Allow -Protocol UDP -LocalPort 7778
New-NetFirewallRule -DisplayName "G1R:MP Resources" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 7780

Linux with UFW

sudo ufw allow 7777/udp
sudo ufw allow 7778/udp
sudo ufw allow 7780/tcp

On a VPS or cloud host, add equivalent inbound rules to the provider firewall or security group as well as the operating-system firewall.

Testing reachability

Test the server from a different Internet connection, such as another household or a mobile hotspot. Testing only from the same LAN can give misleading results because routers handle NAT loopback differently.

A server appearing in the master list confirms that its outbound heartbeat reached the official service. It does not by itself prove that UDP 7777, UDP 7778, and TCP 7780 are reachable from the Internet.

Do not solve a connection problem by opening RCON or MariaDB publicly. Those services should remain private.