|
Security plays a
major part in our day to day activities and our systems
need to be balanced between gaming and access to certain
individuals who would do us harm.
As I explain this you
will have to decide a few things:
A) What am
I willing to open myself up to
B) Are
my settings effecting my gameplay
C) Packet
loss and it's effects
First off we'll
deal with (A) Many people automatically turn off their
firewalls when playing ... This is a major no no.
Specific ports only need to be configured for access
just as you would your browser. Sometimes configuration
is limited by the software/hardware you are using.
If this is your
case you should try either of the following free
software firewalls. I have used both with great results.
Sygate
Personal Firewall ( PC Magazine editors choice)
Zone
Alarm (ZD Net and Cnet editors choice)
Test your security
Here.... You may be surprised
I can host or play
on Hyperlobby or UBI Game service with no loss in
packets or ping with either. Note ** When hosting both
will show your ping as 5 Red on HL/UBI
I prefer the
Sygate over Zone Alarm for it's back tracing ( whois )
abilities and ease of set up.
Now that we have
looked at a few choices for security lets use them to
play and for protection (B). Having your settings in
your choice of firewall to allow only needed programs
access creates a protection layer but also allows for
smooth gameplay. Ports need for IL2 to access the
internet are UDP 21000 and UDP 21010 per the manual and
for UBI game service. Here is a
pretty in depth post from the UBI Tech board by a user
setting up his firewall.
This post is an in
depth analysis of IP traffic while playing online behind
a firewall, specifically Cisco's IOS-based firewall
running on a 2611 router (2 ethernet ports, one to the
cable modem, the other to my network).
Port 21000 references in the manual is UDP, and is used
both inbound and outbound between the client and the
game server.
I just played a short game (I got vulched) and logged
all inbound and outbound traffic. It appears that it may
be possible to play a game through a router without a
firewall, if you allow inbound access to some specific
TCP and UDP ports, some specific servers, as well as
"echo" (ICMP type 8) and "echo reply" (ICMP type 0).
I wanted to learn more about this, because I thought the
firewall was causing some of my poor frame rates. If you
can set up the router to allow specific inbound traffic
without invoking the firewall, (ie punching "holes" in
the firewall) you may be able to increase frame rates.
I do not care about outbound traffic at this point, as
the router configuration allows all outbound traffic by
default, and does not need to be limited, ie, there is
no outbound access-list on my test.
The ports I was able to log inbound are these:
tcp 80 - HTTP (web page stuff from ubi.com arrives on
random ports)
tcp 6667 - IRCU (Universal Internet Relay Chat protocol
arrives on random ports)
UDP 21000 - UNASSIGNED (used by game server and arrives
on port 21000)
tcp 41112 - UNASSIGNED (used by ubi.com server in game
one arrived on random ports)
tcp 41123 - UNASSIGNED (used by ubi.com server in game
two arrived on random ports)
I assume that the port 6667 traffic is the chat server,
running IRCU, this is probably the text chat. The fact
that it arrives on a random port means you have to
create a hole for the UBI IP address.
Not sure what the port 41112 and 41123 traffic is. Each
port was used in a separate game, 41112 in game one and
41123 in game two. Traffic arrives on random ports, so
you have to create a hole for the UBI IP address.
The port 21000 traffic logging appears at the end of the
game, this traffic is one long continuous session. I
only played for about two minutes, and the UDP "session"
recorded 10,247 inbound packets. The traffic is sent and
received on port 21000, so you can open a hole for just
that port.
My computer sent 2,804 UDP 21000 packets over the course
of the game to the game server, ending when I quit the
game. This indicates that the meat of the game includes
my "flight traffic" leaving on port 21000, and all the
rest of the "flight traffic" from the other planes
coming inbound on 21000. This makes sense because there
were about three or four other planes on my game at the
time, and that roughly equates to my 2800 outbound
packets and their 10250 inbound packets. The other meat
of the game is all the pinging going back and forth from
my computer to the other gamers' computers.
Regardless of what the manual says about port 21010, I
did not see any traffic on that port, and I was playing
"across the Ubi.com Game Service."
After looking at the traffic logs, I suspect that
removing the firewall and relying upon a specifically
created access-list will not improve frame rate or game
play that much, because all the UDP 21000 traffic
resides in one session. Since this is the case, I
believe the firewall would only have to open up the one
temporary hole for this session. This is not very
processor intensive.
I tested my new "game" access-list after turning the
firewall off. I allowed all TCP traffic from UBI's
entire class C block (205.205.27.0/24), as much of the
incoming ubi.com TCP traffic is on random ports, and
unable to be isolated by port. I did this because I am
lazy, ie. I didn't want to pick and choose only certain
servers, although the ones referenced tonight were
205.205.27.2, 205.205.27.3, 205.205.27.23.
Here is the access-list, applied inbound on my external
port. I also added access for my DNS servers, as they
are needed for the web portion of the game. Text in
[brackets] is for info only, will not work in Cisco
code:
access-list 102 permit ICMP any host 24.x.x.x [my
computer] echo-reply
access-list 102 permit ICMP any host 24.x.x.x [my
computer] echo
access-list 102 permit UDP any host 24.x.x.x [my
computer] eq 21000
access-list 102 permit tcp 205.205.27.0 0.0.0.255
[ubi.com's network] host 24.x.x.x [my computer]
access-list 102 permit UDP host 24.92.226.x [primary DNS
server] host 24.x.x.x [my computer]
access-list 102 permit UDP host 24.92.226.x [secondary
DNS server] host 24.x.x.x [my computer]
access-list 102 deny ip any log
And as I suspected, no performance increase. I believe
my assumption is correct about the one session only
needing one extended hole in the firewall per game. No
performance hit.
FINAL ANALYSIS:
Being behind a firewall does not appear to be a
bottleneck. Opening UDP port 21000 inbound does not
appear to be critical to game play or higher frame
rates. In fact, I have been playing successfully for the
last two weeks without a hole for 21000.
Bottom line...Its time I bought a better video card.
kajr
Continued Page 2
|
