Prevent randomization of source port

[mldentlinger]

I've recently acquired an old (out of support) 60F to "play around with" at home and learn its interface.

One issue I've run into that I cannot seem to figure out is how to host a Factorio server.

From their wiki they list the following:

• All game instances need the installation of exactly the same game-versions and mods.
• Factorio servers use port 34197. The port can be changed in the config file.
• Factorio uses UDP only. The game builds its own "reliable delivery" layer built on UDP to deal with packet loss and reordering issues.
  • Make sure you configure your router's port forwarding correctly for port 34197.
  • Make sure your router does not randomize the source port on packets outbound from 34197. Some routers do this and require additional configuration to prevent it.
  • Make sure there is no firewall or anti-virus blocking the UDP-packets.

It is the not randomized source port that I cannot seem to figure out. To me what makes sense would be under Firewall Policy having it's own policy and under Firewall/Network Options have Nat enabled, use outgoing interface address and preserve source port. Am I missing something?

[pminarik]

FortiGate actually only changes the source port of a SNATed session if not changing it would lead to a session clash (another session with the same IPs and ports).

With that said, requiring static source ports is generally considered silly, maybe this is just a misunderstanding? (maybe the documentation is looking at this from a stateless firewall POV and is asking you not to change the src-port of the reply traffic from your server to the clients, e.g. <SRV-IP>:34197 ---> <client-IP>:<random-port>)

Have you tried testing if it works as-is?

[mldentlinger]

I have tried just as is. And I agree, I don't know why you'd design it this way. The whole idea is to setup a headless server for the game. But the documentation linked all goes to pfsense, which is what I had before this fortigate and was able to get it to work (although it was a headache there too, even WITH documentation). I've tried various methods as well beyond that, I figure it's got to be some combination of factors I'm not understanding 

[pminarik]

I still don't really want to believe that at face value, as it would imply that it is very likely impossible to have two clients in the same location (behind the same NAT IP) connecting to the same server online. (how would the router decide who the reply packets belong to?)

Anyway: If you're using a VIP (let's say for just the port 34197), this will not only keep the session's destination port static to 34197 in reply-direction traffic (server->client), but it will also automatically apply static SNAT in the reverse direction (traffic initiated from sever:34197 should have src-port 34197 after NAT as well, even though I have no idea why any game server would be initiating a traffic session to a client).