Skip to main content

Networking, ports & security

Ports​

PortProtocolWhat uses it
port from conf.json (default 22005)UDPThe game connection: handshake, sync, events, RPC, voice
port + 1 (default 22006)TCP (HTTP)Launcher and client downloads: client_packages, DLC packs, loading screen, F1 panel

Open both. With only the UDP port open, players connect and then hang while downloading files. The server forwards both ports through UPnP on home routers ("upnp": true by default). On a VPS or behind a firewall, open them by hand. For example, on Windows:

New-NetFirewallRule -DisplayName "SYNC MP game" -Direction Inbound -Protocol UDP -LocalPort 22005 -Action Allow
New-NetFirewallRule -DisplayName "SYNC MP files" -Direction Inbound -Protocol TCP -LocalPort 22006 -Action Allow

Encrypted game connection​

Every packet between client and server is encrypted and authenticated with AES-256-GCM:

  • When a player connects, the client and the server agree on fresh keys with ECDH (P-256). The keys are unique to that connection and are never sent over the network.
  • Each direction has its own key, and every packet is authenticated: a packet changed on the way is rejected.
  • The server refuses clients that do not encrypt, so old or modified clients cannot connect.
  • The cost is about 0.16 µs per packet, which does not show up in ping or sync.

Nothing needs to be configured.

The file port is closed to outsiders​

The HTTP port (port + 1) answers only the SYNC MP launcher and client. Every request they make is signed (HMAC-SHA256 with a timestamp). A request without a valid signature — a browser, a port scanner, a download script — gets no answer at all: the server closes the connection, so from the outside it looks like nothing is there, exactly like RAGE:MP's 22006. A player whose PC clock is wrong still connects: the server tells the launcher its time and the launcher retries.

Protected files​

  • client_packages, the loading screen, the F1 panel and DLC packs are stored encrypted in the player's cache, and DLC pack names are masked.
  • Files sent over the game connection are encrypted with it (AES-256-GCM).
  • Files the launcher downloads over the HTTP port are encrypted too: the launcher and the server agree on a per-session key with ECDH (P-256) and every response body travels as AES-256-GCM frames. A capture of that traffic (Wireshark, the same Wi-Fi, the ISP) shows nothing readable, and any changed byte is rejected. The download is as fast as before.
  • The DLC key comes from your server (dlcpack.key) and is sent wrapped, never as the plain key.

:::note What encryption cannot do Any client has to decrypt your client code and assets in order to run them, so a determined person with a debugger on their own PC can always see them. Encryption stops casual copying and interception on the network. Keep secrets (database passwords, admin logic, prices) on the server. :::

Server password​

Set "password" in conf.json to make the server private. Players without the password are refused at connect.