[SOLVED] VAC not working with OVH firewall

[Keviro [ts.silence.ovh]]

Hello, I since I closed all uneccesary ports in our firewall we get the following error when we start our garrys mod servers: "Could not establish connection to Steam servers. (Result = 3)" and cause of that VAC is disabled on our server.

Our Firewall configuration:

Priority Action Protocol Source-IP Port Option Satus
8 Allow TCP All 27030 Activated
9 Allow UDP All 27020 Activated
10 Allow UDP All 27006 Activated
11 Allow TCP All 27006 Activated
12 Allow TCP All 27005 Activated
13 Allow UDP All 27005 Activated
14 Allow UDP All 27016 Activated
15 Allow TCP All 27016 Activated
16 Allow UDP All 27015 Activated
17 Allow TCP All 27015 Activated
18 Allow TCP All established Activated
19 Block IPv4 All Activated

Maybe someone could help? Is there some port missing or which ports are really needed?

Greetings Keviro

[Melody]

Keviro GamingMine.net a écrit :

ReBoot a écrit :

In a dedicated firewall, its easier to simply allow outgoing traffic and put manual attention into not installing crap on the actual work machine.

Allow outgoing traffic? Then please tell me, which rule is missing for that ^^

Melody a écrit :

OVH Firewall acts like a spam/ddos firewall, which won't help contain the network overload, but will preserve machine's CPU for a while, then the attack will be sent to consolidation structures.
My OS acts like a regular firewall, instead.

So if I understood you correctly, I should just leave the firewall blank, because it does all alone? That would be a very nice idea if wanted to open any port on my server to be accesible from somewhere else. Even OVH writes in thier tips:

OVH Network Firewall settings: Ensure that only authorised and necessary ports are enabled on your server; don't miss any port or service so that disconnection due to incorrect settings is avoided. Use the Firewall Network interface on your OVH Control Panel or API.

You may need OVH Firewall just to avoid spam/ddos though known IPs, since OVH has its own Anti-DDOS and Anti-SPAM system on their firewalls. Then setup a regular firewall on your OS and only allow your game server and steamcmd to accept connections.

[ReBoot]

The rule would be "Outgoing: All". I can't tell you what tondo exactly as ive never seen OVH personally, I "just" known networking and then apply my general knowledge on a case-by-case-basis.

[Melody]

ReBoot a écrit :

The rule would be "Outgoing: All".

All the Outgoing connections must be allowed, I don't think he set up his firewall to disallow outgoing connections, since that would be counterproductive.

[Keviro [ts.silence.ovh]]

Melody a écrit :

Keviro GamingMine.net a écrit :

Allow outgoing traffic? Then please tell me, which rule is missing for that ^^





So if I understood you correctly, I should just leave the firewall blank, because it does all alone? That would be a very nice idea if wanted to open any port on my server to be accesible from somewhere else. Even OVH writes in thier tips:

OVH Network Firewall settings: Ensure that only authorised and necessary ports are enabled on your server; don't miss any port or service so that disconnection due to incorrect settings is avoided. Use the Firewall Network interface on your OVH Control Panel or API.

You may need OVH Firewall just to avoid spam/ddos though known IPs, since OVH has its own Anti-DDOS and Anti-SPAM system on their firewalls. Then setup a regular firewall on your OS and only allow your game server and steamcmd to accept connections.

If a software firewall isn't really effective against ddos,because the server still hast do answer all requests with a no, it's easy to get a server with software firewall offline :)

But this all isn't a answer for my problem, outgoing traffic is allways allowed and I can reach the Steam download and API servers and I can join our server without problems but VAC is disabled because the gmod server can't create the connection with steam vac servers.

[Godless]

VAC is available as a name. In practice, anyone using cheating can not be blocked.

[ReBoot]

Next idea: Fetch a network monitor and monitor the server's connections. I prefer Microsoft Network Monitor as it allows per-process-monitoring (something Wireshark never heard of) amd is pretty simple to use.

[Keviro [ts.silence.ovh]]

☠ C☢ncertâ ツ 恐惧 a écrit :

VAC is available as a name. In practice, anyone using cheating can not be blocked.

Its not about blocking cheaters, we have another AntiCheat for that. Its about removing the "Authentificating with Steam" error.

ReBoot a écrit :

Next idea: Fetch a network monitor and monitor the server's connections. I prefer Microsoft Network Monitor as it allows per-process-monitoring (something Wireshark never heard of) amd is pretty simple to use.

Do you know somthing for Linux, that can switch between eth0 and eth00 because we have 2 Ip adresses??

[Melody]

Keviro GamingMine.net a écrit :

☠ C☢ncertâ ツ 恐惧 a écrit :

VAC is available as a name. In practice, anyone using cheating can not be blocked.

Its not about blocking cheaters, we have another AntiCheat for that. Its about removing the "Authentificating with Steam" error.

ReBoot a écrit :

Next idea: Fetch a network monitor and monitor the server's connections. I prefer Microsoft Network Monitor as it allows per-process-monitoring (something Wireshark never heard of) amd is pretty simple to use.

Do you know somthing for Linux, that can switch between eth0 and eth00 because we have 2 Ip adresses??

In Windows I would say to put a static Route policy on your process to match the outgoing IP. I don't know whether you can do the same on Linux.

[Keviro [ts.silence.ovh]]

Okay we found a solution! You have to allow udp on port 26901. We found that out using netstats and I wonder why this is documentated somewhere? I searched a long time for the official Steamserver Ports but this one was never mentioned.. Thanks for your help anyway :)

[Melody]

Keviro GamingMine.net a écrit :

Okay we found a solution! You have to allow udp on port 26901. We found that out using netstats and I wonder why this is documentated somewhere? I searched a long time for the official Steamserver Ports but this one was never mentioned.. Thanks for your help anyway :)

Some ports may be dynamic, like in the Unreal Engine, so I suggest checking it further.