Throne and Liberty and Proxy: Coverage Decisions, NAT Behaviour, Account Security
Throne and Liberty looks like a single connection, but the client talks to several different endpoints at once: the publisher account, the regional server, patch distribution and side services. This page explains which of these endpoints a proxy covers, where the NAT type discussion fits in, and how much side effect each configuration layer produces.
Traffic separationThe difference between login, world server, patch and side service traffic when it comes to a proxy.
02
NAT and hole punchingMapping behaviour, the symptoms of strict NAT and why a proxy makes this picture harder.
03
Account securityTwo-factor authentication, the recovery path and the effect of a sudden change of location.
04
Scope decisionThe difference between setting up at router, system and application level.
Configuring a proxy for a game client is not like defining a proxy in a browser. A browser has a single network engine and the rule works predictably; in a game client, different components talk to different endpoints with different protocols. That is why the first question should not be "which proxy" but "which traffic".
For Throne and Liberty specifically the picture is even clearer: account and store transactions run through the browser, the game session is established over the client's own connection, and updates come down through a separate distribution path. Depending on where you define the proxy, some of these are routed and some go out directly.
It is worth being clear from the start: a proxy is not an accelerator. It puts an extra stop in between and lengthens the path. The gain is not on the speed side; it is on the side of a stable exit address, regional appearance verification and corporate network management.
Which endpoints come into play when the client connects to the network?
When the game opens, the client talks not to a single server but to several endpoints that operate independently of one another. First comes the publisher account side: authentication runs over HTTPS and the address visible to the other side is the exit carrying that request. If a proxy is defined, the visible address is the proxy server's address. Once login is complete the client starts carrying a session token; even if your exit address changes later, the session's identity stays the same — the only thing that changes is where that session comes from.
The second endpoint is the regional server your character is on. In an MMORPG architecture the world simulation runs centrally: position, damage calculation, inventory and quest state are held on the server; the client sends input and receives the current state. This flow is based not on large file transfers but on continuous, small packets. The total data volume is modest but the continuity of the flow matters — a one-second pause goes unnoticed in a download but is felt immediately in a game session.
The third endpoint is patch and content distribution. Updates usually come down from separate domains with ordinary HTTP/HTTPS requests and can carry a very large volume in one go. If you use an exit priced by data transferred, most of your quota melts away here; that is why leaving patch traffic outside the proxy's coverage is a deliberate choice in most setups.
The fourth endpoint: side services
Features such as voice chat, party invites and friend lists may run over separate services, and some of them use UDP. An HTTP proxy's CONNECT tunnel carries only TCP; UDP does not enter that tunnel and goes out directly. In other words, the assumption "I set up a proxy, so everything goes through it now" is wrong in most setups. For the general framework using proxies in MMORPG games article is a good starting point.
Note
Seeing the login succeed is not enough to know a setup works. Try logging in, connecting to the world and running an update separately: all three take different paths and one may work while another has been left outside the coverage.
DIAGRAMThe four endpoints the client talks to and the traffic they carry
You can scroll the diagram horizontally to inspect it
The layers go to different endpoints with different protocols; a single proxy rule may not cover all four.
Why do NAT mapping behaviour and hole punching become harder with a proxy?
The NAT type discussion is a classic topic on game forums but is often attributed to the wrong thing. Your router creates temporary mappings for outbound connections from devices on the local network. How these mappings treat an incoming packet is what we call the "NAT type". The open, moderate and strict labels in console interfaces are a simplified expression of this behaviour (the difference between a proxy and NAT).
Mapping behaviour
Its equivalent in the interface
Effect on peer connections
Endpoint-independent mapping
Exposed
The same external port is reused; the other side can predict it
Address-dependent mapping
Medium
Only packets from an address previously contacted are accepted
A separate mapping for each destination
Strict
The external port changes for every destination; a direct match cannot be established
Carrier-grade shared NAT
Usually strict
The external address is shared with a large number of subscribers, and control is not yours
Hole punching exploits the gap in the first two rows of this table: both clients send packets to a common intermediary server, the NAT on each side creates a mapping, the intermediary server tells each side the other's external address and port, and the connection is established directly. In the third row this method does not work, because the external port seen in the packet going to the intermediary is not the one used in the packet going to the peer.
How does a proxy fit into this picture? In reverse. A proxy does not accept incoming connections on your behalf; it only carries the outbound sessions you initiate. When you put a proxy in between, the mapping table gains another layer and, from the outside, the behaviour looks closer to strict NAT. If a feature needs to establish a peer connection, a proxy does not make it easier — it makes it harder. The right tools for this job are port forwarding, UPnP or the mapping settings offered by your router vendor.
The UDP ASSOCIATE method can in theory carry UDP, but few game clients use it and the method itself was not designed to accept incoming connections. For details SOCKS5 UDP support article.
Region selection and the longer path: what does a proxy make more expensive?
A proxy adds an extra stop to your connection: the request first goes to the proxy server, from there it reaches the destination, and the response returns along the same path. For this reason a proxy does not lower your ping; in most setups it increases latency somewhat. The rare exception is when your default route is unnecessarily circuitous and the proxy connects to a more direct backbone; this is not a rule and cannot be assumed without measurement. A detailed discussion of the topic does a proxy lower game ping the article.
In a real-time scenario this cost depends on two variables. The first is the geographic location of the proxy exit: if the exit is close both to you and to the regional server you connect to, the deviation stays small. The second is how many times the route crosses continents; when you choose an exit on a distant continent, the packet covers the same distance twice.
Measure before you decide. Take a baseline without the proxy, then repeat the same measurement with the candidate exit and note the difference. Repeating the measurement at different times of day is important; in shared pools the peak-hour difference is the variable a single measurement hides. A ping test and regular repetition are enough for a simple start.
Keep your exit on the same continent as the regional server you play on.
Avoid chained setups; every stop adds a new detour to the path.
Limit quota consumption by leaving patch downloads outside the coverage.
Take measurements before and after a game session, not during it.
To review the list of locations you can look at the proxy locations page, and if you are looking for a stable, fixed exit, at the ISP proxy side.
DIAGRAMThe relative effect of exit location on path length
You can scroll the diagram horizontally to inspect it
The numbers are not a measurement but a relative weight: they are used to compare how many times the path lengthens.
Choose an exit for your Throne and Liberty setup
In scenarios requiring a stable address an ISP solution is preferred, while for regional verification work a residential exit is preferred.
Choose whichever you need from our residential proxies, datacenter proxies, IPv6 and ISP solutions. Every plan comes with unlimited options, 99.9% uptime, rotating proxies, sticky sessions and 24/7 support. Ideal for web scraping, ad verification, SEO monitoring and digital data collection.
ISP ProxyStatic Turkish IPs registered to an ISP
ISP-registered static Türkiye IPs; they combine datacenter speed with the reputation of a real carrier. Ideal for long sessions and low-ping use.
The account side: two-factor authentication and sudden location changes
Game accounts are tied to a publisher account, and that account gives access not only to the game but also to store purchases and support requests. That is why the job to do before setting up a proxy is to harden the account. Set up two-factor authentication with an authenticator app, store your recovery codes offline, and verify that you still have access to the account's registered e-mail address.
Two-factor authentication works independently of a proxy: the code is generated on your device and has nothing to do with your network path. Using a proxy therefore does not weaken verification. However, if the country of your exit address differs from the account's usual country of use, being asked for additional verification at login is normal. This is not a fault; it is expected behaviour.
The second point is the speed of change. Logging in from your country one day, from a distant continent the next and from somewhere else entirely the day after produces an inconsistent picture. If you are going to put an exit to work, keep it stable; if you really need to change it, do so gradually, and do not run a VPN and a proxy at the same time — a double layer makes diagnosis impossible when something goes wrong.
The third is trust in the provider. On an HTTPS connection the proxy cannot read TLS content; it only establishes a tunnel and carries the encrypted bytes. On the other hand, which domain you connect to is visible on the proxy server and can be logged; choosing a provider is therefore a matter of trust. If you see a certificate warning, stop: it is a sign that your traffic is being decrypted and re-encrypted.
Warning
This page was not written for account sharing, account trading, automation or disabling in-game security measures. Complying with the publisher's terms of service is the user's responsibility; a proxy does not override any enforcement.
At which layer do you set it up?
Where the proxy is defined directly determines which traffic is routed. The narrowest coverage is an application-based rule: only the connections of the processes you mark go to the proxy and everything else goes out directly. The widest coverage is the router level; a decision there affects every device in the house.
Working at the router level sounds practical but has two costs. First, most home routers are not proxy clients; this kind of setup usually requires alternative firmware or a separate routing device on the network. Second is the diagnostic cost: when a problem occurs it becomes harder to tell which device is affected by which rule, and other users in the house connect through the same exit. For the options using a proxy on a router article.
There is a further subtlety on the console side. Consoles may have an HTTP proxy field in their network settings, but that field usually covers only the system's HTTP/HTTPS requests. The game's own session traffic, especially components using UDP, goes out directly without being affected by that setting. So filling in the proxy field on a console does not mean "all game traffic is routed".
On Windows the typical order is this: try it in a browser profile first, verify the result, then widen the coverage if needed. To see which applications work with SOCKS5 applications that support SOCKS5 list speeds up this decision.
DIAGRAMSetup layers and the area they cover
You can scroll the diagram horizontally to inspect it
The further down you go, the wider the coverage and the harder the diagnosis: a router decision affects every device in the house.
What do you verify after setup is complete?
Defining a proxy does not prove that traffic really goes through it. The verification list is short but should not be skipped.
Exit address: From a browser on the same machine my IP address open the tool and confirm that the address you see is the exit you expect. If the game client is in a separate scope, this test applies only to the browser.
Domain resolution: In an HTTP proxy the destination CONNECT domain.example:443 is declared in this form and the proxy performs the resolution. In SOCKS5 the behaviour depends on the client; some clients resolve the address on their own network. If resolution is done on your side, the target domain is visible to your local DNS server. For measurement DNS leak test.
IPv6 bypass: If your exit is IPv4 only but IPv6 is enabled on your device, a request to a destination reachable over IPv6 can bypass the proxy entirely; operating systems prefer IPv6 in most setups. The solution is either to use an exit that supports IPv6 or to disable IPv6 in that profile.
Browser leaks: The WebRTC interface can expose your real address to a page regardless of the proxy setting; if you manage account pages from the browser, a WebRTC leak test is worthwhile.
Run these four checks separately with the proxy on and off and compare the results. Note which profile you tested in as well: the result is profile-specific and two different browsers on the same machine can give two different results.
Symptoms and their possible causes
Symptom
Possible cause
What to do
Login succeeds but the world cannot be reached
Session traffic is outside the proxy's coverage or the port is blocked
Check the coverage and the destination ports the proxy permits
Voice chat is not working
UDP does not enter the tunnel, it goes out directly
Leave the side service outside the coverage or use an exit that supports UDP
407 Proxy Authentication Required
Credentials are not being sent or the IP authorisation has lapsed
Verify your username and password and your authorised IP record
Patch download is very slow
The exit's bandwidth is not enough for a large file
Download the update outside the proxy's coverage
Additional verification is constantly requested at login
The exit country changes frequently
Choose a stable exit and keep the country consistent
Occasional stutters in game
The path has lengthened or the exit is saturated at peak hours
Choose an exit from a closer location and measure again
The connection drops after a while
Concurrent connection limit or end of quota
Check the limit and remaining quota in the panel
407 is almost always related to authentication and has two sources: either your client is not sending credentials at all, or the provider recognises you by IP authorisation and your home address has changed. For a comparison of methods, see proxy authentication methods.
Some disconnections are not errors but the result of a limit. A game client with a browser open alongside it produces far more concurrent connections than you would expect; the ceiling fills quietly and new requests are refused (concurrent connection limit).
In which situations is a proxy really useful?
If you play from your own country, on your own connection, with a single account, a proxy gains you nothing; it only adds a stop to the path and a line item to the budget. An unnecessary layer also becomes the first suspect when something goes wrong.
The meaningful scenarios are clear. If you connect from a corporate or campus network and need a stable address at the exit, a proxy provides it; the framework for the restrictions on such networks is explained in the article on access blocks on school and workplace networks. If you need to verify the regional store appearance or how an announcement looks in different countries, you can do so with the regional price research approach.
If your aim is to encrypt all traffic on your device at a single point, the tool you are looking for is probably not a proxy: a proxy affects only the scope you configure, not every connection on the system. The article on the difference between a proxy and a VPN clarifies this difference in coverage. For other game pages you can browse the game proxy guides section.
Frequently asked questions about Throne and Liberty and proxies
01Does using a proxy make my NAT type open?
No. A proxy does not accept incoming connections; it only carries the outbound sessions you initiate. When it sits in between, the mapping table gains another layer and the behaviour looks closer to strict NAT from the outside. For features that need peer connections, the right tools are port forwarding or UPnP settings on the router.
02What should I watch out for if I need to roll the setup back?
Most game clients have no such field. In that case coverage is determined at the operating system level or with an application-based routing rule. Whichever path you choose, verify your exit with a separate tool after setup; having configured a setting does not mean the traffic is being routed.
03Patch downloads consume my quota very quickly, what is the solution?
Update traffic is many times larger than a game session and eats most of the quota on exits priced by data transferred. The most practical solution is to download updates outside the proxy's coverage and enable the proxy only for the scope you actually need.
04Is filling in the proxy field on the console enough?
Usually not. The HTTP proxy field in the console's network settings mostly covers the system's HTTP/HTTPS requests; the game's own session traffic, especially components using UDP, can go out directly without being affected by that setting.
05Does it make sense to connect to a server in a different region via proxy?
Establishing a connection is technically possible, but because the path is longer, the gaming experience suffers. A region change can also trigger additional verification on the account side. It is more suitable for short-term purposes such as verifying how regional content appears.
06Does two-factor authentication work with a proxy?
Yes. The verification code is generated on your device or reaches you through a separate channel; it has nothing to do with your network path. It is recommended to enable two-factor authentication and store recovery codes offline before setting up a proxy.
07Are free proxy lists suitable for this job?
Free lists can be used for learning and short tests; they are not recommended for a game session where an account is logged in and a continuous stream is required. Who operates the server is unknown, stability is low and disconnections come in the middle of a session.
08Can I use a VPN and a proxy at the same time?
Technically possible but not advisable. When two layers are stacked, the path becomes much longer and when a problem occurs it is harder to tell which layer caused it. Start with a single layer and change it if necessary.