Play local multiplayer games with remote friends

On November 11, 2025 by Sosthène Guédon

Many games have some form of support for local or LAN multiplayer. This can be quite practical when all the players are in the same place, but is not useful when playing with remote people.

I developed a simple Linux tool that in the right conditions, enables you to make your locally-hosted game accessible over the public internet, at no additional cost.

How game servers work

Whenever you play a multiplayer game, you must connect to a "server". In a lot of modern locked-down games, this might be hidden from you. Most likely the game just connects to the servers that the developers host themselves. However many games, such as Minecraft, expect player to host their own servers.

A server is a computer that runs a trimmed-down version of the game, handling interactions, physics, but skipping the rendering, this means that in most cases, the game itself can be capable of acting as a server with very little added work from the developer.

Every device connected to the internet has an address that is called an IP address, most often of the form 192.168.0.1¹ where each number can be between 0 and 255. These addresses are often hidden from the user through the use of domain names, such as example.com, but we won't be using this here.

On a hosting server (which is a full computer, just without a screen), every application running has its own "address within the server" called a port. Think of it as the hosting server as being an apartment building, and its IP address being the postal address, while the port, is the level and door number of the apartments (the apartements being the applications). In our case the application will be the games that are being hosted, as a single host can host multiple games at the same time.

Most games are pre-configured to work with a default port, which can often be omitted, so the IP address or the domain name is enough. When the port is shown it looks like this 192.168.0.1:6567 where the port (here 6567) is a number between 1 and 65536.

When you open a LAN server on a game like Minecraft, the game starts a server on your computer. The server will therefore have the same IP address as your computer using the default port for the game. People can then join using the IP address of your computer to log into it. Often, games will also make use of other protocols to be able to list all the servers connected to the same router as you, so you don't need to manually write your address, and other local player can join without any configuration.

Why hosting locally won't make it available to remote players

Sadly, if you manually obtain your IP address, you will find out that your friends online outside of your local network can't connect. Why is that?

Your computer is never directly connected to the global internet. In your home, it will almost always be connected to a home router which acts as a gateway for the global internet. This router does a lot of important things, and one of them is separating your local network from the global network through a firewall². In home connections this firewall is setup to reject any incoming connection, even if a device on the home network listens on the specific port. This is done for security reasons. A lot of devices designed to be connected to a home network assume that they are behind a firewall and that anything that can connect to them can be trusted. It is also not a problem since most people never host a server on their local network, but it means that when you do so the firewall plays against you.

Enter Ten-Forward

Lucky for us, most of these firewalls implement a standard protocol to request the firewall to not reject connections to a specific port, and it's possible to use it to make your local game's port publicly accessible. I built a simple app that communicates with your router's firewall using the standard NAT-PMP protocol so that it can start accepting connections from the outside. This app is called Ten Forward, and is available for all linux distributions through flathub.

Here's how to use it.

First, you need to make sure that your router's firewall supports the NAT-PMP protocol. The configuration steps will depend on the exact brand and model of router you are using so I will not document it here, but you need to go into its configuration settings (generally by typing http://192.168.0.1 in your web browser address bar) and look for a toggle to enable NAT-PMP. I almost always use a commercial VPN for this. If you host your server for people you don't know very well, it has the advantage of hiding your true IP address. This is not really dangerous, but can be used to discover your approximate location. ProtonVPN supports NAT-PMP, and Ten Forward is known to work reliably with it. I suppose other providers would also work well with it.

First, install Ten-Forward through flathub: https://flathub.org/en/apps/fr.sgued.ten_forward

Then, launch it. If your router or VPN supports NAT-PMP it should open and display the gateway address, and show you your IP address.

Note: On some VPN setups, such as ProtonVPN with WireGuard, detecting the gateway can fail. In this case you need to input it manually. To do so, click "configure", toggle "override default", and enter your gateway's IP address. For ProtonVPN wireguard, this will be 10.2.0.1:

Once that is done, you need to create new port mapping for each game you want to play. Click on "New mapping", then give it a name, leave the type to the default "TCP and UDP" if you don't know what this means, set the public port and the private port. The private port is the port that the game server is configured to run on. The public port is the port that you want to request from your gateway. The two can be separate so that multiple users can host servers for the same game behind the same gateway. If you use ProtonVPN, you can also request the special port 0 so that the gateway chooses the public port for you, ensuring that you will always have a port allocated to you. When mapping is started, Ten Forward will request the public port to be allocated to you from the gateway, and it will forward incoming connections to the private port that you configured. It is therefore important that the private port be the port your game expects. If using a VPN and two customers use the same port on the same server, one of them will be rejected or given a port they don't expect. If your gateway is your home router and you know there won't be conflicts, just use the same private and public port. Otherwise, use a random number between 1001 and 65535 (ports lower than 1000 are often restricted).

For example, a mapping for the Mindustry game can look like:

• Name: Mindustry
• Type: TCP and UDP
• public port: 0 (this can be anything)
• private port: 6567

To start playing, you can click on "start", if all is working, you can then click on the public port that was given to you to copy your public IP address and port where your friends can join you.

Then, in Mindustry, launch the campaign, go into the menu with escape and click on "host multiplayer game".

Tell your friends on their end to launch the game, click "play" then "join game", then "add server". Tell them to input the address and port you copied from ten forward, and they should be able to join! They don't even need to use Ten Forward themselves.

The process will be similar for other games. Launch the mapping that corresponds to the game, then start hosting a local game, and tell your friends to join a remote server using the public ip and port combination that Ten Forward gives you.

Caveats

When hosting a server this way, there will almost not be any authentication. Anyone could join your game using the right IP and port combination. This is why using a VPN for this is useful, as it will allow you to easily change the public IP address for the server if someone has it and you don't want them to join.

Alternatives

There are other solutions to this problem.

Hamachi has historically been pretty popular to do that, but is proprietary and for profit.

If you and your friends are nerds, using Tailscale is likely one of the simplest and most secure option, as it will allow you to skip using a commercial VPN, will not expose your game to the public internet, so you will be able to filter who can join. The downside is that everyone has to install Tailscale on their machines.

List of known configurations for games

Here are a couple of games that are known to work with ten forward:

Game	private port	Type
Mindustry	6567	TCP
Battle for Wesnoth	15000	TCP
Stardew Valley	24642	TCP and UDP
Minecraft Java Edition	25565	TCP and UDP

Don't hesitate to contact me so I can add more.

---

1. Let's not talk about IPv6... ↩

2. For IPv4 networks it also does Network Address Translation (NAT), but that is not what is interesting here, as NAT could be configured to still expose local ports to the global internet by default. ↩