Left 4 Dead 2 and Proxies: The Steam Layer, UDP and NAT Behaviour

What does NAT do when you host a server on your own machine?

In Left 4 Dead 2, a campaign can be hosted on the machine of someone in the group. In that case that computer takes on the server role and the other players connect to it. Technically this means inbound connections must be able to reach your network; a class of problems you never encounter in the classic client role starts here.

Home routers by default only pass responses belonging to sessions initiated from inside. A new session arriving from outside is dropped if there is no mapping. Games try to get around this problem with a method called "hole punching": both sides send packets outward at the same time, creating a temporary mapping in their routers. Depending on how the mapping behaves, the method sometimes works and sometimes does not.

The hardest case is a setup where your line is behind a shared address on the operator side. In such a structure there is no public address that can reach you directly, and no setting you make on your router changes this. What is CGNAT the article explains why this architecture prevents hosting.

A clear warning is needed here: a standard proxy does not solve this problem. A proxy establishes outbound connections on your behalf; it does not accept an inbound game session and pass it to you. If you need to host, the solution is not a proxy but appropriate forwarding on the router or changing the address structure of your line. For the conceptual difference difference between a proxy and NAT article.

The server browser, the ping column and what the measurement means

The ping column in the server browser is the round-trip time of the query your client makes to that server. These queries are made with the game's own query mechanism and are largely datagram-based. Therefore a proxy definition that covers only TCP does not change this column; the value you see is that of your ordinary line.

This detail can be used as a diagnostic tool. If you turn the proxy on and off and see that the values in the server list do not move at all, you have confirmed that query traffic is out of scope. If the values do change, there is a layer somewhere forcibly routing traffic, and you should be sure you did that deliberately.

The measurement itself should not be done only once either. Server load and intermediate backbones change during the day; a value taken in the morning is not repeated in the evening. Ping test try the same target at different times and note the range; do not commit to a single figure.

Setup: what happens depending on where you write the scope?

Where you write the configuration directly determines which traffic is routed. The table below compares three common points in the Left 4 Dead 2 context.

The format of the credentials is the same everywhere: a host name, a port and, if required, a username and password. proxy.example.com, 8080, username, password fields only show the format. Remember that the port number does not determine the protocol; which door is HTTP and which is SOCKS5 port numbers is explained in that article.

Two checks are essential after setup. First with the proxy checker tool verify that the address is live, then look at where domain name resolution is performed: if resolution stays on your network, your destination is visible to your local DNS server and download node selection may be disrupted. where DNS is resolved in SOCKS5 the article separates the two behaviours.

What changes when there are several players on the same network?

If several people are playing at the same time on a home or café network, they all exit from behind a single public address. On the game side this usually causes no problem, because each client establishes its own session outbound. The problem comes from somewhere else when a proxy is added to the same network: the number of concurrent connections.

A proxy package carries a certain number of concurrent sessions. When several people share the same exit, this ceiling fills faster than expected and the symptom is an outage that looks like "the game is freezing". What is actually happening is that the limit has kicked in; for the details concurrent connection limit article.

The second effect is on quota. Downloads made over the same exit come out of a shared pool, and it becomes harder to tell who consumed how much. In a shared setup, the most practical solution is to leave download traffic outside the proxy's scope and put only the requests that genuinely need routing into the tunnel.

On corporate or school networks the decision may not be yours in the first place. How restrictions work on these networks and which path is legitimate access blocks on school and workplace networks the article explains; the right step is to talk to the network administrator.

Common symptoms and their real causes

Most of the problems encountered while a proxy is in play have nothing to do with the game itself. The list below shows the shortest path from symptom to cause.

• The game opens but the exit address has not changed: the client is not reading the system setting; consider application-based routing.
• Workshop content is not downloading: the rule may cover only the main domain name; write a definition that also covers the content domains.
• The file download stalls while connecting to a server: the fast download source is not reachable from the proxy exit.
• Friends cannot join the session I host: this is a NAT problem and is not solved with a proxy.
• The connection drops after a while: concurrent connection limit or end of quota.
• Authentication error: if you use IP authorisation, your exit address may have changed.

Order matters in diagnosis. First verify independently that the exit is working, then check which address you are exiting from on the my IP address page, and only at the end move to the game side. When this order is not followed, hours are spent on what is actually a quota problem visible at a glance in the panel.

Add one more layer rule: do not run more than one routing tool at the same time. When a tunnel and a proxy are stacked on top of each other, separating which one is doing what becomes almost impossible; get a result with a single layer first.

When is a proxy unnecessary in this game?

If you are playing alone, from your own line, in your own country, a proxy gains you nothing. Since match traffic will be out of scope anyway, the only visible outcome is slower downloads and a shrinking quota.

The scenarios in which a proxy is reasonable are narrow: exiting a corporate network with a fixed and traceable address, verifying how a community page looks in a different country, separating lab and test machines from production traffic. None of these relate to in-game performance; they are all needs of visibility and management.

A separate note is needed about free lists. Free exits are suitable for learning and quick trials, but you should not route any account you sign in to through such servers: who operates the server is unknown and stability is low. To set the right expectation the difference between free and paid proxies the article is a good yardstick.

Finally, terms of service: this page is not about disabling in-game protection mechanisms or going outside account rules. Everything described relates to scope, measurement and network management; compliance with the rules is the user's responsibility.