Factorio Proxy: Lockstep, Servers and Network Scope

Connection states and the moments when a proxy is effective

A session moves among several states, and each state has its own fault profile. The moment of connecting is full of handshakes and verifications; an error received at this stage usually comes with a clear message. An interruption during the map transfer, on the other hand, is silent: progress stops, the error message comes late.

While in the synced state, client and server advance at the same step. If a client falls behind, the game slows down for it or the client is put into resynchronisation. Since resynchronisation means the world state being transferred again, it consumes bandwidth and interrupts the session.

In this state map, a proxy plays a meaningful role only at the first stage. Authentication and server list requests carry TCP; using an exit to reach these endpoints from a network with restricted access can make sense. The same does not apply to the game stream itself. SOCKS5 although datagram transfer is possible in theory, it requires client support; SOCKS5 UDP support the article details this condition.

Three ways to host your own server

The first way is for the player who opens the game to be the server at the same time. It is the simplest option to set up but has two costs: when the person who started the session leaves, the game stops, and every hitch on that person's home connection is reflected on all players. Sufficient for small groups, fragile for a team that plays regularly.

The second way is a headless server: a process that runs without a graphical interface and only executes the simulation. You can run it on your own machine or on a server you rent. The configuration is read from a text file, the port to listen on is defined there too and can be changed. This route frees the session from depending on the presence of a single player.

The third way is community servers. Here the one setting the rules is not you but the server administrator: accepted addresses, player count, mod list and rules of conduct are all defined by them. A connection being refused may not be a technical fault but the enforcement of that policy, and the right step is to get in touch with the administrator.

When you open your own server to the outside, verifying reachability is a separate job. A test made from inside your own network is misleading, because the packet never leaves for the outside world. A check made from a different line shows the real situation; tools such as proxy checker tool can be used to see whether an endpoint responds from outside. For the difference between the inbound direction on the server side and the outbound direction on the client side, the difference between forward and reverse proxies article.

What does configuration on the router cover?

The idea of defining a proxy on the home router looks attractive: let all devices be routed from a single point. The real scope, however, is narrower than supposed. Most consumer-grade devices have no setting that routes outbound traffic to a proxy; on those that do, this setting generally covers only web traffic. For details, using a proxy via the router article.

There are two concepts that get confused: address translation and a proxy are not the same thing. What your router does is map the addresses on the internal network to a single external address; this is a mapping operation working at the transport layer and it does not send the traffic to another server. A proxy, on the other hand, is an intermediary that terminates the connection and re-establishes it on its own behalf. The difference between the two difference between a proxy and NAT article.

This distinction has a practical consequence on the Factorio side. If you host your own server on your home network, what you need to do is not a proxy definition but the forwarding of incoming connections to the internal machine. These two operations are done in different menus, with different logic, and one is no substitute for the other.

The scope table clarifies which configuration affects what:

Finding the layer of the block on networks with closed ports

On dormitory, campus and office networks, outbound traffic is mostly limited to a narrow set. Web traffic is free, the rest is closed. On such a network it is a typical picture for the authentication and server list steps to pass without trouble while the game stream cannot be established, and the reason is directly this policy.

Here you first have to separate the layer of the block. A block at the application layer is the closing of access to a specific domain name and looks like a problem that can be overcome by using an exit; a block at the transport layer, on the other hand, is the complete closing of certain protocols, and having a server in between does not change that. The latter is the case that applies to Factorio's game stream.

The right approach is the administrative one: conveying the destination, the protocol and the purpose to the network administrator in writing. Defined exceptions are normal on corporate and academic networks. Trying to work around network policy by technical means is against institutional rules and does not produce a lasting solution. The general framework access blocks on school and workplace networks article.

There is also an intermediate case: if the network allows outbound access but your address comes from a dynamic pool, defining an access list for your server becomes difficult. In such cases a fixed exit address helps; how the gateway architecture provides this gateway architecture article.

Mod lists, updates and download traffic

In a group that uses mods, part of the network traffic also comes from the mod portal. Mod download and update requests are web traffic; they therefore fall within proxy scope and may be the only component that is unreachable on a restricted network. If the game stream works but the mod list cannot be fetched, it becomes clear that the block is at the application layer.

On the volume side, mod traffic is larger than the game session but generally smaller than the save file transfer. If you are using an exit with a quota counter, the real thing to watch is update periods; when a group updates a large mod package at the same time, the total volume rises fast.

Version consistency is, moreover, not a network matter but a coordination matter. Since the lockstep simulation requires all clients to run the same code, fixing the mod list within the group is the most practical solution. Otherwise every session starts with a round of version matching, and that is mistaken for a connection problem.

An in-group update schedule makes this easier: mod versions are fixed before the session rather than during it, and the change is applied to everyone at the same time. The party hosting the server has to use the same list as well; even the smallest difference between the server and the clients prevents joining. This is a matter of discipline independent of network configuration, and in groups that play regularly it eliminates a significant portion of connection complaints.

If you hesitate over what the terms correspond to, a short glossary makes your job easier; for the transport layer and relay concepts mentioned on this page, proxy terms glossary is a quick reference source.

Compliance, server rules and realistic expectations

Community servers hold an important place around Factorio and each has its own rules. Using an intermediary server does not change those rules, it only changes the address the connection comes from. The server administrator's choice not to accept certain address ranges is legitimate and should not be read as a technical fault.

This page is not intended to interfere with anti-cheat mechanisms, nullify account sanctions or work around institutional network policies. Such expectations are both contrary to agreements and technically unfounded.

The realistic expectation is this: on the Factorio side a proxy is a routing tool for the components that carry TCP — authentication, the server list, the mod portal and external verification of the server you host. Since the game stream itself carries UDP, it stays out of scope in most setups, and a configuration built in the knowledge of that puts the expectation in the right place.

One last reminder: every hop added in between adds to latency, it does not subtract from it. A proxy does not lower your ping; the rarely seen exception is the case where the default route is circuitous and a more direct path is proven by measurement. Build your setup decision on that fact.