Vintage Story Server CGNAT: Find the Right Fix
A Vintage Story server CGNAT fix starts with checking your router’s WAN IP. Compare a public IPv4, VPN, relay, or managed-host option.
You will need
- Access to your router’s Internet or WAN status page
- A public IPv4 lookup from a device on the same connection
- Each player needs a Vintage Story account and a compatible PC client to try a private overlay
A Vintage Story server behind CGNAT cannot receive ordinary inbound connections through a port forward on the home router. The game can still be played with friends, but you need a route that reaches the server through or around the ISP’s network. Start by checking the router’s WAN address, then choose between asking your provider for public IPv4, connecting through a private overlay, relaying traffic through a VPS, or moving the server to a host outside your home connection.
Vintage Story server CGNAT: check the WAN address#
Compare the IPv4 address shown on your router’s Internet or WAN status page with the public IPv4 address reported by a lookup site from a device on the same home connection. You are looking for whether the router itself has the same publicly reachable address that the rest of the internet sees.
| Router WAN address | What it suggests | What to check next |
|---|---|---|
100.64.0.0 through 100.127.255.255 |
The address is in the shared range reserved for carrier-grade NAT. | Ask your ISP whether your line uses CGNAT and whether public IPv4 is available. |
10.x.x.x, 172.16.x.x through 172.31.x.x, or 192.168.x.x |
The router has a private address. Another modem, router, or ISP network may be upstream. | Check any modem or gateway between your router and the internet before naming the NAT layer. |
| A public-looking address that differs from the lookup | There is another routing or translation layer, or the devices are using different address families. | Confirm the lookup is for IPv4 and ask the ISP what address the router should receive. |
| The same public IPv4 as the lookup | CGNAT is less likely to be the problem. | Check the server’s firewall, router rule, target LAN address, and ISP inbound policy. |
The 100.64.0.0/10 range is Shared Address Space reserved for carrier-grade NAT use by RFC 6598. It is a useful signal, not a complete diagnosis of your network. A private WAN address may come from a second router inside your home, and an ISP can use other arrangements too. If the result is unclear, show the WAN value to your provider and ask whether it is assigned a public IPv4 address.
Do not diagnose CGNAT from a failed game join alone. A wrong local forwarding target, a blocked firewall rule, the wrong server port, or an ISP rule against inbound connections can look similar. First compare the addresses; then follow the route that matches your result.
Understand why router forwarding stops at the ISP#
A port-forward rule only changes what your own router does with incoming traffic. If the router is itself behind an ISP-operated NAT, the game packet must pass through that upstream device before it can reach your household router. You cannot create that second mapping from your home router’s settings page.
Vintage Story’s official dedicated-server guide lists 42420 as the default port. Its Linux firewall examples allow both TCP and UDP on that port; the Windows section instead walks through an application rule for the server executable, so follow the instructions for your server’s operating system. Anego’s official v1.20.11 release notes describe the server’s UDP updates and say it falls back to TCP when it has not received UDP from a client for 30 seconds. If you changed the server’s port, use the configured value instead. Your router and computer firewall must allow the traffic your server setup uses; when CGNAT is in the path, fixing only those local rules cannot open the carrier’s translation.
This distinction also helps narrow a failed connection. If the WAN address matches the public IPv4 lookup, return to the firewall, LAN address, and inbound-policy checks. If the WAN address is private or in the shared range, another router menu is unlikely to solve the upstream part. Avoid putting the computer in a router’s DMZ as a shortcut: that does not control the ISP’s NAT and can expose more services on the computer than the game needs.
Ask your ISP for a public IPv4 address#
If the comparison points to upstream NAT, ask your internet provider a specific question: “Can this connection receive a globally reachable public IPv4 address that accepts inbound connections?” Also ask whether the address would be dynamic or static, whether inbound TCP and UDP are permitted, and what the current price or terms are. Availability and charges vary by provider, so a price from another customer or city may not apply to your line.
A public dynamic address can still allow friends to connect, but it may change. A dynamic-DNS name can help friends find a changed address if your router or another service updates it; it does not create public IPv4 and does not bypass CGNAT. A static address is convenient when offered, but it is not required merely because the server is a game server.
After the ISP changes your service, compare the router’s WAN address with a fresh public IPv4 lookup again. If they match, configure the server’s actual port on the router and computer firewall, then test from a friend’s separate connection. If the ISP cannot provide public IPv4, or if incoming traffic is blocked, choose a private overlay or a relay instead of repeating the same forward.
Try a private VPN overlay for a small group#
A private overlay can connect the server computer and your friends’ computers through an authenticated virtual network. This fits a small group that is comfortable installing the same networking client and does not need its server to appear as a public Vintage Story listing. Each friend connects to the server’s private overlay address and port, rather than to your home public address.
Tailscale’s documentation describes direct UDP connections and fallback relays when direct connectivity is unavailable. It also requires the devices and users to have access under the relevant network policy. Install it on the server computer and each player’s PC, connect the group through one tailnet or an explicitly shared server device, then have one friend try the overlay address with the configured Vintage Story port. A relay can be a fallback when a direct path fails, but its route may behave differently; the documentation does not promise a particular game’s latency or performance. See Tailscale’s connection types and device-sharing rules.
This is a PC-only route: the official system requirements list 64-bit Windows 10 or newer, Linux, and macOS 13 or newer, with no console client listed. The official Family Pack provides four keys for four game accounts, so each friend needs an account. Vintage Story uses its own account system rather than Steam, according to the official FAQ. Use the same current game version on the server and clients; the official release post lists stable 1.22.7, released August 16, 2026, at the time of this review. The dedicated-server guide says the whitelist is on by default in versions 1.20 and later, so the owner must allow each exact game username before a new player can join. Keep account authentication enabled; a VPN changes the network path, not the game’s account check.
This guide has not tested a Vintage Story join through Tailscale. If the friend can reach the host over the overlay but the game refuses entry, check the server version, account login, whitelist, password, and host firewall. If the overlay itself cannot reach the server, check the shared-device permissions and whether the chosen machines are online before changing Vintage Story settings. A private overlay is a route to try, not a guarantee that every network or computer will behave the same way.
Use a VPS relay that carries TCP and UDP#
A VPS relay gives the server a public endpoint without asking your home ISP to accept unsolicited traffic. The server computer creates an outbound tunnel to the VPS, and the relay forwards the configured game traffic back through that connection. The owner then maintains both ends: a public VPS, the relay process, firewall rules, port mappings, updates, and enough logging to diagnose a broken tunnel.
If you use a tool such as frp, verify that the selected mode carries the configured Vintage Story traffic, including its UDP path as well as TCP. Anego’s release notes document TCP fallback when UDP stops arriving, but a relay that drops UDP can still change the route your current game build uses. A generic web or HTTP tunnel is not automatically a game-server relay. The public side must listen on the chosen port, the private side must map that port to the server, and the VPS firewall and any provider firewall must allow it. Do not copy a configuration for another game; test the actual server/client build through the relay before relying on it.
A VPS can make sense if you want a public address and are willing to operate a second machine. It adds another service to patch and troubleshoot, and routing through it can change latency. Have a friend test the actual game connection before you rely on the tunnel for a long session. If you do not want to manage a relay host as well as the game server, compare the overlay or managed-server options first.
Choose managed hosting when network work grows#
Pick the route by how your group wants to connect. A public address from the ISP keeps the server at home; a VPN overlay is private to invited devices; a VPS relay gives you a public endpoint but adds maintenance. If none of those jobs sounds worthwhile, a managed game server runs outside your home ISP connection, so friends use the address shown for that server rather than trying to reach your router.
| Route | Best fit | Main trade-off |
|---|---|---|
| ISP public IPv4 | You want to keep the server at home and your ISP offers inbound access. | The ISP controls availability, terms, and whether the address changes. |
| VPN overlay | A small, trusted group can install the network client and connect privately. | Each player needs access; the server is not automatically public or listed. |
| VPS relay | You want a public endpoint and can maintain a relay machine. | You operate two systems and must map both game protocols correctly. |
| Managed server | You want the server outside your home network without running a router workaround. | Hosting is a paid service after any trial; you still need to manage the game world and who can join. |
For a group that would rather avoid maintaining an ISP workaround, Game Hosting’s Vintage Story server page lists its Dallas, Texas location. The site offers a free 24-hour trial without a card, once per person, so your group can decide whether the server fits before paying. The trial is a chance for your own group to check its connection; it is not a promise about your home ISP, every client, or a particular ping.
If self-hosting is still the right fit, keep the current router and firewall rules, and check the WAN address again if your ISP changes the connection. If the group wants to compare no-cost ways to play before choosing a host, see which free Vintage Story server options actually work. For a managed server, use the provider’s connection address and confirm that each friend has an account, the matching game version, and permission to join.
Quick answers
How do I know if I am behind CGNAT?
Compare your router’s WAN address with a public IPv4 lookup. An address in 100.64.0.0/10 is a strong clue, while another private address can indicate an extra router or NAT layer.
Can I host a Vintage Story server behind CGNAT?
A home-router port forward cannot configure the ISP’s upstream NAT. Ask for a public IPv4 address, use a private overlay or a correctly configured relay, or host the server outside that connection.
Does Tailscale work for Vintage Story?
Tailscale documents private overlay routes and relays, but this guide has not tested a Vintage Story join through one. Treat it as an option to try with every player connected.