Arma Reforger Server Behind CGNAT: What Still Works
If your Arma Reforger server is behind CGNAT, compare the router’s WAN address, spot double NAT, and choose an internet route players can reach.
You will need
- Access to your router status page
- An external IPv4 lookup and your server network settings
If your Arma Reforger dedicated server is behind carrier-grade network address translation (CGNAT), forwarding a port on your home router may still leave the server unreachable from the internet. The router can change its own rules; it cannot create an inbound route through an ISP’s separate NAT. Compare the router’s WAN address with an external IPv4 lookup, rule out a second router or VPN, then choose a route that remote players can actually reach. You can keep the server on your home network for local play while you diagnose the public path.
This guide is about reachability, not changing your world. Do not wipe a save, change the scenario, or restore a backup to troubleshoot CGNAT. Those actions do not create an inbound route. If you later move or restore a world, confirm that a current backup exists and that you know how to recover it first.
Compare the router WAN address with the public IPv4#
First find the WAN, Internet, or IPv4 address shown on the router connected to the server. On a separate device using the same internet connection, check the externally observed IPv4 address. Do not use a lookup while that device is on a VPN or proxy; the lookup could show the VPN’s address instead of your ISP path.
Compare the two values:
| Router WAN address | What it can mean | Next check |
|---|---|---|
| Same as the external lookup | Your router may have a public IPv4 address | Verify that the server listens on its configured port and check the router and host firewall rules |
In 100.64.0.0/10 |
Strong clue for shared address space used between an ISP and customers | Ask the ISP whether inbound connections are behind CGNAT and whether a public IPv4 option exists |
In 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 |
A private address; another router or upstream NAT may be in the path | Check for a modem/router combo, mesh gateway, or second NAT you administer |
| Different from the lookup, but not in those ranges | Could be upstream translation, a VPN, proxy, or another network path | Disable the VPN for the comparison and ask the ISP to confirm the WAN assignment |
The 100.64.0.0/10 range is reserved for shared address space by RFC 6598. A mismatch is a diagnostic clue, not proof by itself: a VPN, proxy, or a changing connection can also explain it. Your ISP can confirm whether it assigns you a public address and whether unsolicited inbound traffic is filtered.
Separate CGNAT from double NAT and local firewall problems#
CGNAT and double NAT can look similar from a game client, but the remedy differs. Double NAT means two devices you may control are translating traffic, such as an ISP gateway in router mode plus your own Wi-Fi router. CGNAT means the additional translation is at the provider, outside your home router’s control.
Before changing settings, trace the cable path from the server to the internet. If a modem/router combo feeds a second router, check both status pages. You may be able to put one device into bridge or access-point mode, or forward the configured server port through both routers. Ask the equipment provider before changing a managed gateway.
Then check these common look-alikes:
- Host firewall: the server process may be listening while Windows or Linux blocks its UDP traffic. Check the operating system rule for the configured game port.
- Wrong address or port: confirm the server’s current network settings and the address players are using. A stale endpoint can survive a server restart in a saved favorite.
- NAT loopback: a client on the same home network may fail when it tries to join using the public address, even though the router accepts genuine outside traffic. Test from a separate internet connection.
- VPN or proxy: a route on the server machine or test device can change the visible address and path. Record the normal result with that route disabled.
- ISP filtering: the ISP may block inbound traffic or use a shared address even when your local forwarding rule looks correct.
Do not diagnose from only one failed join. A useful test needs a client outside the home network and the exact server address and port that the server advertises.
Forward Reforger’s configured UDP port, not an Arma 3 default#
Bohemia’s Arma Reforger server configuration reference documents the game network port and optional services. The default game port is UDP 2001; the optional A2S query service uses UDP 17777, and native RCON uses UDP 19999 when configured. These are Reforger settings, not a reason to copy Arma 3’s familiar UDP 2302 rule.
| Service | Reforger default | Forward it? |
|---|---|---|
| Game traffic | UDP 2001 |
Yes, if your server config uses this port and the router has a public inbound route |
| A2S query | UDP 17777 |
Only if you enable or rely on the query service |
| Native RCON | UDP 19999 |
Only for the administrator’s intended remote-control setup; keep it private and protected |
Use the ports actually configured on the server. The router’s rule must target the server machine’s current LAN address, and the host firewall must allow the same UDP traffic. Reforger does not use TCP for these listed services, and its documented dedicated-server networking does not support IPv6 as a substitute for a public IPv4 route. A correct local mapping helps only when traffic can reach your router in the first place.
Avoid exposing RCON to ordinary players. It is an administrative service; follow Bohemia’s current configuration guidance and restrict access to the network or administrator who needs it. If you have changed the game port from the default, update both the router rule and the endpoint your players use.
Keep the server available on your LAN while you troubleshoot#
CGNAT does not stop your PC from running the dedicated server or other devices on your home network from joining it locally. Keep local play separate from remote access:
- Confirm the server is running and note its configured game port.
- On another device on the same LAN, test the server’s local address using the supported join flow.
- If LAN play works, save the scenario and server state as usual; do not use a reset as a network diagnostic.
- For an internet test, ask a friend on a different connection to join the public endpoint while you observe the server logs.
If the LAN test fails, troubleshoot the server process, local firewall, address, and configuration before involving your ISP. If LAN works but a genuine outside test fails, check the router path and ask the ISP about CGNAT or inbound filtering. Keep notes about the exact timestamp, client platform, game branch, address and configured port so the ISP or host can reproduce the report.
Choose a route with a reachable public endpoint#
If the ISP confirms CGNAT and does not offer a public inbound address, your local port-forwarding rule cannot solve the upstream routing problem. The practical choices are to keep the server LAN-only, ask the ISP about a public IPv4 option, or run the dedicated server on a network with a reachable public endpoint.
For a group that wants a managed dedicated server instead of maintaining a home PC, router and operating system, Game Hosting’s Arma Reforger plans provide a public hosted endpoint and a panel for common server controls. This removes the need for the server owner to forward inbound ports on their home router. Check the current product page for region and plan details, and confirm that the location suits your players. Hosting does not fix an individual player’s internet, make incompatible versions join, or guarantee a particular mod combination.
If you prefer to self-host, ask the ISP whether a public IPv4 address can be assigned to your connection and whether inbound UDP is allowed. You can also place the server on a VPS or another service where you control a public endpoint, but that means you remain responsible for operating-system setup, security, updates and backups. Our guide to choosing between a rented server, home PC and VPS compares those responsibilities.
Third-party UDP tunnels and relays are another category, but their behavior depends on the provider, game traffic, server configuration and client platforms. We have not tested a named tunnel for this setup, so this guide does not recommend one or promise that it works. If you test one yourself, use a disposable or backed-up server, invite a client on a different network, and verify the advertised endpoint, join, session stability and every intended platform. A server appearing in a browser or replying to a query is not proof that players can complete a session.
Recheck branch, crossplay and mods after changing the route#
Changing the network endpoint does not reconcile different game versions or mod sets. Bohemia’s current news identifies stable 1.8.0.13 and Experimental 1.9.0.10 as separate branches. Experimental clients and servers must match each other; do not expect a stable client to join an Experimental server or vice versa. Check the official Reforger news before acting because version labels can change.
For a mixed PC and console group, verify that the server’s game.crossPlatform setting is enabled and that every client can reach that server’s branch. The documented cross-platform setting supports PC, Xbox and PlayStation on compatible servers; it does not mean consoles can host the dedicated server. Keep mod compatibility as a separate check: use the Bohemia Workshop and verify each required mod on the platforms your group uses. The PlayStation and Xbox storage limits for downloaded mods differ, so a collection that fits on one console may not fit on another. Do not assume Steam Workshop is the distribution path for Reforger mods.
Before updating server files, changing a scenario or restoring a world, confirm that you have a current backup and know the recovery steps. Reforger updates can change save formats, and a server/client version mismatch may require attention before the world is opened. A network diagnosis alone does not require a wipe. If players can connect after the route changes but cannot see the expected world, stop and inspect the server version, scenario and backup before making destructive changes. Our dedicated server guide covers the broader setup, while the server persistence guide explains world-state handling.
What to check before you call it fixed#
Use this short checklist after the ISP or hosting route changes:
- Compare the router WAN address with an external lookup again, with VPNs disabled.
- Confirm the server listens on its configured UDP game port and the firewall matches it.
- Test from a genuinely separate internet connection, not only from the home LAN.
- Confirm the join address and port players are using; for a relay, use only the endpoint it documents.
- Match server and clients on stable or Experimental, then check crossplay and mod availability per platform.
- Preserve the current world and verify the backup recovery path before any scenario change or restore.
If the outside join still fails, give the ISP or hosting support the WAN comparison, configured port, server log timestamp and the result of a test from a second network. That evidence narrows the problem to the ISP route, host firewall, server endpoint or client compatibility without risking the world save.
Quick answers
How can I tell if my ISP uses CGNAT?
Compare the router’s WAN IPv4 address with an external IPv4 lookup. A WAN address in 100.64.0.0/10 or a different address can indicate an upstream NAT, but a VPN or proxy can also cause a mismatch. Ask your ISP to confirm.
Will port forwarding work behind CGNAT?
A rule on your router only controls that router. If the ISP also translates or filters the connection, a home rule cannot create an inbound mapping through the ISP network. Ask for a public inbound IPv4 address or choose a reachable hosted endpoint.
Can I host an Arma Reforger server behind CGNAT?
You can run the server for local play, but remote players need a reachable route. A public address from your ISP or managed hosting is a practical option. Treat third-party UDP tunnels as unverified until you test an outside join on your exact platforms and versions.
Can Xbox or PS5 players join through a VPN?
A VPN on one player’s device is different from a public UDP relay for the server. Reforger documents cross-platform play for compatible stable servers when enabled, but it does not guarantee a particular VPN or tunnel path. Check platform, branch, server settings and mod compatibility separately.