Table of Contents
Network and firewall
The ports
| Port | Setting | Who connects | Open to the internet? |
|---|---|---|---|
| Telnet, 23 by default | TelnetPort | Players, with a telnet program. | If you want players to telnet straight in. |
| Rlogin, 513 by default | RLoginPort | BBS doors. | If other BBSes are to link to the server. |
| Admin, 2399 | AdminPort | The console. | Never. It only listens on 127.0.0.1 anyway. |
On a computer that also runs TWGS, port 513 is taken by TWGS's rlogin: give LORD Server another, such as 5130.
Windows Firewall
The installer's firewall rule allows lordsrv.exe on any port, so changing the ports needs no new rule. Without the installer (the zip), add one in an administrator Command Prompt:
netsh advfirewall firewall add rule name="LORD Server" dir=in action=allow program="C:\LORDSRV\lordsrv.exe"
To limit it to your own network, add remoteip=10.0.0.0/24 (your network's range).
Router port forwards
For players or BBSes outside your network, forward the port on your router to the server's address. Only forward what you need: usually just the rlogin port.
A forward has the outside port, the inside address and port, and the protocol. On a TP-Link Omada controller (NAT > Port Forwarding), “Source Port” is the outside port:
| Field | Value |
|---|---|
| Name | LORD Server rlogin |
| Source IP | Any |
| Interface | the WAN port |
| Source Port | 5130 |
| Destination IP | the server, e.g. 10.0.0.8 |
| Destination Port | 5130 |
| Protocol | TCP |
Other routers call these “external port” or “public port”, and “internal IP” and “internal port”. Keep the same number outside and inside unless you have a reason not to.
Test from outside your network (a phone off Wi-Fi, or another site). A test from inside the network to the public address only works if the router does “NAT loopback”; the server's log then shows the connection as coming from your public address.
What is safe to open
- Rlogin: safe to open only with
RLoginAllowset (to your BBS's address, ornone) so that only BBSes with keys or listed addresses get in. With it blank, anyone on the internet can log in as any player. See Linking a BBS: security. - Telnet: players need their passwords.
AllowNewUsers=0if you don't want strangers making accounts. - Admin port: never forward it.
- Internet scanners will find any open port. The connection limit (
MaxConnections) and idle time-out (IdleMinutes) keep them from tying the server up;Denyblocks an address that keeps trying.
Monitoring
A monitoring system that checks the ports (Checkmk, Nagios and so on) shows up in the log as connections that disconnect at log-in, and an rlogin check from an address not in RLoginAllow is logged as refused. That is harmless. Check rlogin every 5 minutes rather than every minute to keep the log readable. The Windows service is called LORDServer.