SecureNAT VPN for LAN gaming - Connection issues

[deb_user]

Hi everyone!

Bit of a back story:
I'm running SoftEther VPN Server on a Debian 12 VM (Proxmox) for LAN gaming since about two years without any larger problems. All LAN games worked perfectly fine so far, except of one specific game: CoD - WaW Zombies / Coop.

The weird part:
I first tried this game back in Mai of 2024 and it worked perfectly fine. Now over a year later my friend and I wanted to play it again and... it does not work anymore. To be more precise the player who want's to join is able to see the Host in the server browser but as soon as he wants to join the message "This game session is no longer available" appears.

What changed:
Not that much honestly. Back then we've used SoftEther VPN Server v4.43. Both clients used SoftEther VPN Client v4.43. Since then I've updated the server and also client to v4.44. Other than that I've always installed / updated the packages on the server (Debian 12) and we both also always applied the various Windows updates. Back then my friend was on Windows 11, I was on Windows 10. Now we both are on the most recent versions of Windows 11.

Server configuration:
- Enabled SecureNAT with Virtual DHCP (No Default Gaetway or DNS is set)
- Disabled Virtual NAT
- No Local Bridge configured
- No specific Security Policy set for both users (already tried setting unlimitted broadcasts with no success)
- All other settings are basically the default / disabled

What I've already tried:
- As mentioned above I've set unlimitted broadcasts on both users via Security Policy
- Checked that the Virtual VPN adapter metric is set to "1" on both client systems
- Disabled SSDP on both Windows Clients
- Set up another fresh VM and tried with v4.43 of the SoftEther VPN Server, also installed v4.43 of the SoftEther CPN Client Manager for both clients
- Just to be sure: I've tried this game / mode on two pcs on my local LAN which worked perfectly fine

I've tried really hard and searched the internet for days now but I can't find a solution. Oh btw: The settings on the SoftEther Client Manager are all on default as far as I know (haven't changed anything special in there).

I'm happy to provide all important settings / screenshots of the server and / or client configs if needed. Would appreciate any help :)

[solo]

Hi, this is an interesting case.

- Just to be sure: I've tried this game / mode on two pcs on my local LAN which worked perfectly fine

Disconnect one of them from the LAN and connect via a mobile/cell hotspot, while the other connects with SE LAN address. If it still works for you, we'll focus on your friend's PC next.

[deb_user]

Hi, this is an interesting case.

Disconnect one of them from the LAN and connect via a mobile/cell hotspot, while the other connects with SE LAN address. If it still works for you, we'll focus on your friend's PC next.

Thank you for your response. I've already tried that with no luck. The weird thing is that if I connect both LAN pc's with SE LAN address it's the same behavior, I can see the Host (no matter who creates it) but can't connect. This tells me that it has to be something on SE / the connection itself that is blocking, either Server or Client if I'm not completely wrong.

[solo]

You have not mentioned anything about the firewalls - disable both for a test.

[deb_user]

You have not mentioned anything about the firewalls - disable both for a test.

Oh yes sorry I totally forgot to mention that. I already did, it was one of the first things I did on both client pc's. I'm also able to ping each other.

[solo]

Would you be able to test it out on a Windows SE server? If you you don't have a spare PC/VM, simply install it on one of the SE client PCs and from it connect to localhost. The server's settings need to be identical to your Debian's. More info https://www.vpnusers.com/viewtopic.php?f=7&t=68129 and https://sites.google.com/view/softether-vpn-gaming

[deb_user]

Would you be able to test it out on a Windows SE server? If you you don't have a spare PC/VM, simply install it on one of the SE client PCs and from it connect to localhost. The server's settings need to be identical to your Debian's. More info https://www.vpnusers.com/viewtopic.php?f=7&t=68129 and https://sites.google.com/view/softether-vpn-gaming

Yes I was able to test according to your advice. I've set up Windows SE Server on a spare PC and imported my config from my Debian SE Server. The result sadly is exactly the same. No matter who is hosting the game, it's visible to all other VPN clients but no one is able to connect. I even tried adding a third VPN client on the Windows SE Server pc, but it's the same.
I also followed the specific steps on your provided links and changed some of the settings on my server according to them but also with no luck.

[solo]

Now we both are on the most recent versions of Windows 11.

As there is no server OS issue, client OS may be the reason for old LAN games' problems. Before we start dissecting Windows 11 in this context, can you...
- re-try it on Windows 10 from eg. a VM
- check other LAN games from your collection on Windows 11
- try CMR2 on Windows 11 (it's discussed in the above link)

CMR2 was fixed by disabling SSDP, which you have already done, but this game was never run on Windows 11 back then.

[deb_user]

Alright I've got some news on this

As there is no server OS issue, client OS may be the reason for old LAN games' problems. Before we start dissecting Windows 11 in this context, can you...
- re-try it on Windows 10 from eg. a VM

Haven't done this yet but all the other suggestions you mentioned.

- check other LAN games from your collection on Windows 11

The ones I've tested work like a charm, no matter if they are from the 2000 era or newer ones. At least the ones I used to play back then.

- try CMR2 on Windows 11 (it's discussed in the above link)

Installed the most recent version of Collin McRae Rally 2.0 including the "SilentPatch" on both Win11 client PC's and set compatibility mode on cmr2.exe to WinXP-SP3 on both PC's. One client is on the same local network as the Debian SE Server runs, so I connected via LAN IP from SE Client, the other one is connected via mobile hotspot to simulate being "external". And it works flawlessly without doing anything special, both clients are able to host and join a game.

CMR2 was fixed by disabling SSDP, which you have already done, but this game was never run on Windows 11 back then.

It was not necessary to disable it, SSDP service is still running on both Win11 PC's.

[solo]

It was not necessary to disable it, SSDP service is still running on both Win11 PC's.

It would be necessary to disable SSDP when UPnP is offered from a router.

I'll check CoD-BO on my W11 PCs, not sure if 'zombie' co-op mode is there though. Also my W11s are heavily optimized for max efficiency and the test may be inconclusive. For example I could not reproduce the CMR2 problem on my setup because I never allow SSDP service. The issue was revealed when the OP provided MS Network Monitor's packet logs for examination. Here you can clearly see CMR2 'deviating' from the VPN net into LAN and consequently failing...
.

SSDP.png

[deb_user]

It would be necessary to disable SSDP when UPnP is offered from a router.

UPnP is disable on my router (pfSense).

I'll check CoD-BO on my W11 PCs, not sure if 'zombie' co-op mode is there though.

As far as I know there's no real LAN mode in CoD-BO, tho there's a zombie co-op mode.

Also my W11s are heavily optimized for max efficiency and the test may be inconclusive. For example I could not reproduce the CMR2 problem on my setup because I never allow SSDP service. The issue was revealed when the OP provided MS Network Monitor's packet logs for examination. Here you can clearly see CMR2 'deviating' from the VPN net into LAN and consequently failing...
.
SSDP.png

As mentioned above I also wasn't facing the issue with SSDP on CMR2, it worked perfectly fine without disabling it. So I don't exactly know why others had this problem but it isn't there in my case.

I remember that I've read something that CoD-WaW zomboies / co-op mode uses SessionID's to connect, but I'm not 100% sure and idk if this makes any difference. Still strange that it worked last year and every other game I've tested works as well, including CMR2 which seems to have made problems on other ppls configurations.

How can I check which source goes to which destination as your screenshot shows?

[solo]

• install Microsoft Network Monitor 3.4 https://www.microsoft.com/en-us/downloa ... px?id=4865
• reboot
• run Microsoft Network Monitor
• select all net interfaces/networks (if not selected already)
• click on "new capture"
• click "start"
• run the game, start hosting and try to play with a guest
• click "stop"
• check the log

[deb_user]

• install Microsoft Network Monitor 3.4 https://www.microsoft.com/en-us/downloa ... px?id=4865
• reboot
• run Microsoft Network Monitor
• select all net interfaces/networks (if not selected already)
• click on "new capture"
• click "start"
• run the game, start hosting and try to play with a guest
• click "stop"
• check the log

Thank you! I'll debug later and report back my findings asap.

[solo]

Great, while waiting for your net packets observations let's clarify the CMR2 on SSDP issue.

It would be necessary to disable SSDP when UPnP is offered from a router.

UPnP is disable on my router (pfSense).
...
I also wasn't facing the issue with SSDP on CMR2, it worked perfectly fine without disabling it. So I don't exactly know why others had this problem but it isn't there in my case.

Well, re-read your post, can you see the contradiction? SSDP depends on UPnP, so disabling any of them makes CMR2 work and it's no wonder that "it worked perfectly fine" for you.

CoD-BO Zombies on LAN is not easy as it tries to contact a server on the internet first. I'll get CoD-WaW co-op soon.

[deb_user]

Great, while waiting for your net packets observations let's clarify the CMR2 on SSDP issue.

It would be necessary to disable SSDP when UPnP is offered from a router.

UPnP is disable on my router (pfSense).
...
I also wasn't facing the issue with SSDP on CMR2, it worked perfectly fine without disabling it. So I don't exactly know why others had this problem but it isn't there in my case.

Well, re-read your post, can you see the contradiction? SSDP depends on UPnP, so disabling any of them makes CMR2 work and it's no wonder that "it worked perfectly fine" for you.

Aah yeah got it, sorry I phrased it a bit strangely. Tho one thing isn't clear to me: Why does the game in LAN mode depend on UPnP?

CoD-BO Zombies on LAN is not easy as it tries to contact a server on the internet first. I'll get CoD-WaW co-op soon.

That's what I also found about playing CoD-BO Zombies on LAN. Alright that would be awesome if you could check it out by yourself and maybe there's something I'm just missing.

I do have the logs form Microsoft Network Monitor. This is the protocol when hosting a lobby and it looks exactly the same, no matter if I'm connected to the VPN (Subnet: 10.20.30.1) or just hosting in LAN (Subnet: 192.168.1.1). Looks like it does not bind to the correct IP, tho why I'm then able to see the host?

CoDWaW_Host.png

[solo]

Hold on, why is dem-onw-are there? Haven't you applied the LAN Fixed patch?

[deb_user]

Hold on, why is dem-onw-are there? Haven't you applied the LAN Fixed patch?

That's a good question. Yes I have applied the LAN fix patch.

[solo]

- Just to be sure: I've tried this game / mode on two pcs on my local LAN which worked perfectly fine

Please make another test in this non-VPN, LAN-only mode but disconnect the internet from your router. Can you still play it normally?

If not, then for VPN play you need to enable DG/DNS and vNAT in SecureNAT (default settings). Microsoft Network Monitor says so :-)

[deb_user]

Please make another test in this non-VPN, LAN-only mode but disconnect the internet from your router. Can you still play it normally?

If not, then for VPN play you need to enable DG/DNS and vNAT in SecureNAT (default settings). Microsoft Network Monitor says so :-)

I can't just disconnect internet from my router because of my server, but I did add a fw rule on my pfSense to block all IPv4 and IPv6 traffic to go outside of the LAN for the two PC's. And I'm still able to play in LAN co-op, tho the game loads a lot longer trying to connect to a server. First it says: "Retrieving accounts information..." for about 10 seconds and then it says "Online Service Error - Can not connect to Online Service". I can click "Ok" and then I'm in the main menu of the game and can host and / or join a LAN session.

This is what the Microsoft Network Monitor has logged:

CoDWaW_Host_NoInternet.png

[solo]

OK, keep blocking "Subnet: 192.168.1.1" and also block "Subnet: 10.20.30.1" then try it on VPN. Blocking with the exception of WAN VPN traffic of course. Alternatively check what happens when only IP of the URL we see in MS NM is blocked.

[deb_user]

OK, keep blocking "Subnet: 192.168.1.1" and also block "Subnet: 10.20.30.1" then try it on VPN. Blocking with the exception of WAN VPN traffic of course. Alternatively check what happens when only IP of the URL we see in MS NM is blocked.

Alright I've tried your suggestions:

• Blocking my LAN subnet and also the VPN subnet didn't change much. The output of MS NM still looks kinda the same and connecting via VPN behaves the same - I'm able to see the game host but can't connect.

• Blocking the IP of the dem... - URL leads to the loading / trying to connect to online services delay when starting the game. Also MS NM does not log anything about the CoD Lanfix exe this way.

[solo]

I see. Apart from the patch, is it v1.7.1263, v1.6.1252 or something else?

Also, to finalize all easy tests please "enable DG/DNS and vNAT in SecureNAT (default settings)" and try it on VPN.

[deb_user]

I see. Apart from the patch, is it v1.7.1263, v1.6.1252 or something else?

Yes it's updated to v1.7.1263 and then applied the LAN fix.

Also, to finalize all easy tests please "enable DG/DNS and vNAT in SecureNAT (default settings)" and try it on VPN.

I'll try that later when I'm back home. What should I put in as DG and DNS address there?

[solo]

The defaults...
.

SecureNAT-defaults.png