Friends Join Automatically

On an Asbern box that may open router ports, friends outside your home can join a game server you made with nothing to set up on your router — when your router lets programs open ports. You choose whether your box may when you install it (Router ports, step 1 below). Your box asks your router to open that game's player ports while it runs, Asbern checks from outside that a friend's game would get in, and members see where to join. When your router says no, Discord says why in plain words, and the fix.

Friends connect straight to your home. Asbern carries none of the game's traffic, and the game, its files and its world stay on your machine.

How it Works

1. Router ports is on for your box. You choose it when you install the box — see Your Asbern Box.
2. Friends outside can join is on for the server. It is a row on the server's card when you add it, on by default where your box's Router ports is on:

   Opens 2 ports on your router while it runs. Players who join can see your home's internet address.

3. While the server runs, your box asks your router to open exactly that game's player ports, and closes them when the server stops. It never opens a game's admin or console ports.
4. Asbern checks the server from outside, the way a friend's game reaches it: one connection, the same one a player's game makes. The server's name is written once that check gets in — or, for a game that cannot be tested from outside, once your router has opened its ports (then ask a friend to try).
5. Members see the join line on the server's card and in /menu › Gaming › Servers, while the server runs. Stopped, the line reads "Joinable while the server is running".

Turn off, on the server's Friends outside row under Game Servers › Power, closes its ports within a minute. If your router stops answering just then, your box keeps asking it for up to an hour, the length of the opening it asked for. Game Server Setup covers that row.

The Server's Name

Each server gets a name under Asbern's names domain, for example valheim-yourserver-k7q2m9x4.play.asbern.net: the game, then your Discord server's part, which is your server's name followed by 8 random characters, so nobody can guess it from your community's name. Members type the name and the port; the port is left out where it is the game's own default, such as 25565 for Minecraft Java Edition.

• A name exists only while its server runs. It is written when the server starts and answers within about a minute, and it is taken down when the server stops, when you turn Friends outside off, when you remove the server or the box, and when your box has been offline for 15 minutes.
• Some games cannot join by name. Their game only takes an address, so the join line shows your home's internet address and the port instead, on the same terms: only while the server runs.
• Change your part of the name with Names on your box's Status: up to 24 letters, digits or dashes. Keep the 8 random characters at the end: they stop guessing. Old names go at once, a name you let go rests for 30 days before anyone else can take it, and you can change it at most three times a day.
• On a deployment with no names domain, friends join at your home's internet address and the port.

What Other People Can See

This is the sentence Discord shows beside Friends outside can join:

Friends join at a name like valheim-yourserver-k7q2m9x4.play.asbern.net. While your server runs, that name points at your home's internet address. Every player who joins sees that address, and anyone who has the name, or finds it (names can turn up in public DNS history without anyone sharing them), can look it up. We take the name down when the server stops, when you turn Friends outside off, when you remove the server or the box, and when your box has been offline for 15 minutes. Our DNS provider keeps a log of the addresses we set for 90 days, and public DNS history services may keep them longer. On some games, friends can join with a code instead.

Asbern's privacy policy has the full statement.

Join by Code

Some games run a join service of their own: friends type a code in the game, and your router opens nothing. For those games the server's card has a Join by code row as well, off by default. Turn it on and the card says:

Friends join with a code through Valheim's own join service. No router ports are opened, and it works even where your router can't open ports.

A server joins one way at a time: turning Join by code on turns Friends outside off. Members then see "Friends join with code <code>." instead of an address.

Today the games with Join by code are: Valheim.

It is a way in, not a privacy setting. Whether a game's own join service passes your address to the players is up to that game, and Asbern does not claim it does not.

List Publicly

Some games can also be listed in their own public server list, while friends still join by name or address. For those the card has a List publicly row, off by default: turned on, anyone can find the server, with your home's address. Where your box cannot list a server publicly yet, the row stays off and says so.

After the server is made, the same switch is its List publicly row on /menu › Other › Admin › Game Servers › Power, under its Friends outside row. Turn on asks once and Turn off acts at once; either way your box remakes the server, so a running one restarts. A server friends join by code is never listed.

Today the games with List publicly are: Valheim.

Check Again

The server's join view, under /menu › Other › Admin › Game Servers › Setup › Set up on the How members join step, shows where friends join, the last check and when it ran, and Check again. It also offers It works when only a friend can confirm, and the manual list whenever your box could not open the ports itself. When another device already uses the port, free it there and your box asks for it again within 10 minutes by itself; Move to another port appears once your box can move a server.

Check, under /menu › Other › Admin › Box, lists only what needs a look, each with its one fix; when nothing does, it says Everything checks out. It has a row for each part of the way in: Router (whether your router lets programs open ports), Router ports (the ports it opened), Safety rule (the rule that stops a game opening ports by itself), Other open ports (openings other programs made), Docker networks, and Friends outside (the outside check), plus This PC's address on Windows and a Mac, and Windows Firewall on Windows. Each row says what it found and the one fix. The Router ports row on your box's Status reads, for example, "On · PCP · 3 ports open · friends can join", and Close all now closes everything at once.

Every Answer, and Its Fix

Every answer that is not a way in also shows the manual list, except three: Router ports switched off on your box, an address on your network that just changed (your box takes the port back by itself), and an internet address your provider shares between homes (no forward at home can reach it). The list gives each port, its protocol and "to this computer", and on your own private card the computer's address on your home network. Forward Ports on Your Router shows how; after a forward, press Check again.

When it Works

Friends can join at <name>:<port>.

The router opened the ports and a friend's game would get in. Nothing to do.

Your router opened the ports. This game can't be tested from outside, so ask a friend to try.

The game has no way to be asked from outside, so Asbern cannot prove it. Members still see the join line, because your router's own internet address is the one Asbern sees your box come from.

Your router opened the ports, but it didn't say which internet address it uses, and this game can't be tested from outside. Ask a friend to try, then press It works.

The router made the forward but never said which internet address it uses (a router with no internet address yet answers 0.0.0.0), so Asbern can't tell whether friends reach it. Once a friend gets in, press It works: the name is written and members see the join line.

Friends can join at <name>:<port>. (Your router's ports are forwarded by hand; keep that forward to this computer.)

You forwarded the ports yourself, and the outside check got in. Keep the forward pointed at this computer.

If you forwarded these ports, ask a friend to try, then press It works.

You forwarded the ports, and the game cannot be tested from outside. Once a friend gets in, press It works: the name is written and members see the join line.

This computer is directly on the internet; no router is involved.

The box has a public address of its own, so there is nothing to open. A game that cannot be tested from outside still waits for It works.

Friends join with code <code>.

The server runs with Join by code: no ports are opened and no name is written.

Your Router

Your router doesn't let programs open ports. If your internet is Starlink, 5G home internet or a phone hotspot, your provider probably shares one address between homes, and no setting will open ports: ask them for a public IPv4 address. Otherwise, allow it for this computer only, if your router can (on a FRITZ!Box: this device › Permit independent port sharing), knowing that every program on this computer can then open ports (Asbern's games are blocked from it); or turn on UPnP or NAT-PMP, which lets any program on your network open ports; or forward these ports to this computer yourself:

Your router answered none of the three ways a program can ask (PCP, NAT-PMP and UPnP). Many routers ship with them off, and some guides advise keeping them off. The safest fix that still works by itself is a per-device permission; otherwise forward the ports yourself, then Check again.

Your router refused. Its settings allow only some devices or ports to be opened automatically.

Your router takes requests, but its rules leave this computer or these ports out (on pfSense or OPNsense, the UPnP access list). Add this computer there, or forward the ports yourself.

Your router won't give this server port <port>: another device in your home is using it, or a rule on the router keeps it.

Free the port on the other device, or lift the rule (on pfSense or OPNsense, the UPnP access list), and your box asks for it again within 10 minutes by itself. Or forward another port to this computer by hand. Move to another port, which will make the server again on a free block of ports while it is stopped, keeping its name, appears once your box can do that.

Your router only makes permanent openings, which Asbern won't leave behind on your network. Forward these ports yourself:

Some routers (MikroTik, for one) keep an opening for ever. Asbern only makes openings that end, so forward the ports yourself.

There are two routers between you and the internet (often the provider's box and your own). Put the provider's box in bridge or modem mode, or forward these ports on it to your router, and on your router to this computer:

Your router's own outside address is a private one. Bridge or modem mode on the provider's box fixes it for good; forwarding on both routers works too.

This computer's address on your network changed. Your router is still holding port <port> for the old address; Asbern will take it back within 10 minutes.

Nothing to do: your box takes the port back by itself. If you forwarded by hand instead, Discord says "Port <port> reaches another device's server, not this one. Point your forward at this computer:" — change the forward to this computer's new address, and give it a fixed address on your router.

Asbern can't find your router. If you changed router or moved house, paste this once in PowerShell:

Windows and a Mac only: the router your box knew stopped answering and no other one matched. Paste the line Discord shows, once.

Your Provider

Your provider shares one internet address between many homes (CGNAT, common with Starlink and 5G home internet). No home can open ports on it. Ask your provider for a public IPv4 address; some give one free or for a small fee.

No setting at home can fix this one. A public IPv4 address from your provider can; Join by code works too, on a game that has it.

Your connection has no public IPv4 address for friends to join.

Your connection reaches Asbern only over IPv6. Names point at IPv4 addresses only, so ask your provider for a public IPv4 address.

Your box reaches the internet through a VPN or a second connection, so friends would knock on the wrong door.

The address your router reports is not the one your box's link arrives from. Let the box's machine reach the internet without the VPN, or forward the ports on the connection it really uses.

Your router opened the ports, but something before the game still blocks them: your provider, or this computer's firewall.

On Windows, the Windows Firewall row of Check says which rule. On Linux, look for a firewall that filters forwarded traffic (a DOCKER-USER rule, firewalld, or an nftables forward policy). On a Synology, its own firewall (Control Panel › Security › Firewall); on Proxmox, the guest's firewall. Some providers block incoming connections: ask them.

This Computer

A Docker network on this computer, <network>, uses the same addresses as your home network, so your games can't reach your router or your other devices.

If nothing uses that network, the row offers Remove it, asks once, and your box checks again before removing it. If a container uses it, the row names the project it belongs to: give it another range of addresses there, or remove it when you no longer need it. See Your Asbern Box.

Something on this computer keeps using the ports Asbern picked. Restart the computer, then press Start again.

Another program grabbed the ports three times in a row.

Asbern couldn't install its safety rule on this computer, so it won't open router ports. Forward these ports yourself:

Your box opens nothing without its safety rule. Forward the ports yourself; the rule is tried again each time the box starts.

Router ports are switched off on your box.

Your box's choice. Only the box can turn it on: docker exec -it asbern-agent asbern ports on.

This computer can't run Asbern's safety rule, so it won't open router ports.

Rootless Docker, Docker inside WSL and a system with no nf_tables firewall cannot run it. Its games wait until an admin allows them: Start without it, on the Safety rule row of Box › Check, says the risk first. Once allowed, nothing keeps them away from the other devices on your home network, so allow it (and forward the ports yourself) only if you accept that, or install Docker as Your Asbern Box describes. Stop allowing takes it back, and a replaced box asks again.

Windows Firewall

Windows is blocking Docker because a firewall prompt was answered No. Paste this to remove that block:

Paste the line Discord shows once in PowerShell. It asks before it removes the block.

Windows Firewall is set to block all incoming connections. Turn that off in Windows Security › Firewall for this network.

Your organisation manages this PC's firewall; ask its admin to allow Docker Desktop Backend.

<product> controls this PC's firewall: allow Docker Desktop Backend there.

Windows treats this network as public, and you chose not to open ports on public networks.

If this is your home network, mark it Private in Windows' network settings, then Check again.

Windows Firewall has no rule that lets friends reach Asbern's game ports. Paste this once in PowerShell:

Paste the line Discord shows, once. It adds one rule for Asbern's game ports, for Docker only, after Windows asks you.

Playing From the Same House

Playing from the same house? If the name doesn't connect, your router doesn't loop back — use this computer's local address.

Many routers do not let a device at home reach the home's own outside address. The join view on your private card shows the computer's address on your home network for that.

Tested Routers

No router has been through Asbern's own testing yet. The routers it has been tested on, and how each one answered, are listed here once that testing is done. Until then, automatic opening on any particular router is unproven: Check tells you exactly what yours did, and forwarding the ports by hand always works.

What it Costs

Nothing. Asbern is free: every feature on this page is included in every server, and no card is needed.