Share your game server without port forwarding

You set up the server. It runs. You send your friend your IP address and... nothing. Connection timed out. Welcome to the most common failure in self-hosted game servers: getting traffic from the internet to the machine under your desk.

Why port forwarding fails so often

The classic advice is to forward a port on your router. That still works for some people, but it fails more every year, for reasons outside your control:

• CGNAT. Many ISPs now put whole neighborhoods behind one public IP (carrier-grade NAT). There is no port to forward, because the public IP is not yours. Fiber and 5G providers do this a lot.
• Router roulette. Every router hides port forwarding somewhere different, and ISP-managed boxes sometimes lock it away entirely.
• Moving targets. Home IPs change. Your friends' saved server address stops working the day your ISP rotates it.
• Exposure. A forwarded port is an open door to your home network that you now have to think about.

Tunnels flip the direction

A tunnel solves all four problems with one trick: instead of the internet connecting in to you, your server connects out to a relay with a stable public address. Outbound connections are never blocked by NAT; that's the same reason your browser works without router changes.

Basalt builds this on frp, and with one deliberate difference from the hosted tunnel services: the relay is yours. You run it on a machine with a public IP, and Basalt points at it. Nobody else sits in the path of your players' traffic, there is no account to sign up for, no free-tier limit to hit, and no third party that can change the terms later.

The honest trade is that you need that machine. A small VPS is the usual answer, and it is the only piece of the setup that has to be publicly reachable: your game servers stay behind whatever NAT they are behind. If you already have a box with a public IP, you already have everything.

What it looks like in practice

1. Stand up a tunnel server once: one container and a config file on a machine with a public IP.
2. Put its address, token and port range into Settings → Tunneling in the panel. Also once.
3. On any instance, open the Tunnel tab and enable the tunnel. Basalt picks a free public port, writes the proxy config, and starts a small agent next to the game container.
4. Copy the address it shows and send it to your friends.

Steps 1 and 2 happen once for your whole setup. After that, giving any new server a public address is a single toggle.

That address stays stable across restarts and does not care what your home IP is doing. Your router config stays untouched, and the only machine exposed is the relay, not your network. Want something friendlier than an IP and port? Point a domain at the relay; for Minecraft an SRV record even hides the port number.

When you don't need a tunnel

If your server only needs to be reachable from your own network (a LAN party, a home lab behind a VPN like Tailscale, or a machine in a datacenter with a real public IP), skip the tunnel and connect directly. Tunnels are for the public-internet case, and they add a relay hop that direct connections don't have.

Read more in the tunnels guide, or start from your first instance if you haven't deployed one yet.