Search Unity

Question Network requirements

Discussion in 'Relay' started by daniel414, Jan 10, 2022.

  1. daniel414

    daniel414

    Joined:
    May 13, 2020
    Posts:
    14
    Hi, the Relay service does not work in my companies network. As soon as I connect to a mobile hotspot it works without a problem, so it is definitely a network configuration problem.

    I just copied the sample code from the relay documentation. I can allocate the server, get a join code and connect as client via join code without getting an error. However the scene is not synchronized between client and host.

    Are there any specific requirements I missed, I haven't found anything in the documentation?
    Thanks in advance!
     
    daniel414, Jan 10, 2022
    #1

  2. Unity_Brandon

    Unity_Brandon

    Unity Technologies

    Joined:
    Sep 29, 2016
    Posts:
    23
    Hi Daniel,

    There are a number of factors that can cause networking issues within corporate/secure networks. I should say first that since Relay relies on outbound connections, most issues with firewalls and network address translation are mitigated given that an outbound connection is established, rather than an inbound one like you would see with most traditional game servers.

    Unfortunately, without knowledge of your companies network, I can only provide suggestions as to possible fixes rather than anything concrete. I think the most likely culprit would be some type of intrusion prevention system or a stateless firewall that does not track session context (such as who established the connection) and rather relies on static information such as the source and destination IP address.

    First, I would try connecting to a different subnet within your company network you are allowed to access and see if there are different filtering policies. Second, if you are authorized to use a VPN and are able to successfully establish a connection, routing your traffic over that will almost definitely resolve the issue if caused by the aforementioned. Lastly, it may be worth having a conversation with your network administrators to see what is happening to the traffic, and if it is indeed being filtered, if they can adjust their policy to allow for those communications to pass through.

    Other things to try would be switching to Relay with Netcode for Gameobjects (if you are using UTP), or trying to update your packages to see if there was a bug fix that resolved the issue. If you have any additional questions please let me know.
     
    Unity_Brandon, Jan 10, 2022
    #2
    ADNOC_LNG likes this.

  3. daniel414

    daniel414

    Joined:
    May 13, 2020
    Posts:
    14
    Hey Brandon, thanks for the explanation.
    We found out that there was indeed a blocked connection (TCP/9354) and outbound connections are also filtered by the firewall. Is there a list of specific TCP/UDP ports that are required for the relay?

    A VPN would be impractical to use, since we use all kinds of different devices and we would have to set up the VPN on each device individually.

    I also tested the Unity Lobby which also does not work. Are there any additional requirements or is it the same as for the Relay?

    Also, I forgot to mention in the first post that I use the Relay Unity Transport together with Netcode for Gameobjects and the latest packages:
    Unity 2021.2.7f1
    Relay 1.0.1-pre.3
    Lobby 1.0.0-pre.6
    Unity Transport for Netcode for Gameobjects 1.0.0-pre.4
    Netcode for Gameobjects 1.0.0-pre.4
     
    daniel414, Jan 12, 2022
    #3

  4. UnityKip

    UnityKip

    Unity Technologies

    Joined:
    Nov 15, 2021
    Posts:
    36
    Hi Daniel,

    I wanted to add a little information on top of what Brandon has provided and answer your latest questions.
    Neither Relay or Lobby utilize TCP ports for client-host communications. Both make HTTP requests over TCP/443. Relay leverages UDP for client-host communications, however, the local client range is managed by the Unity Transport Protocol which is further managed by Netcode for Gameobjects. This will take a little more time to investigate. Please note that any findings provided here are subject to change during the beta.

    With that said, it wasn't entirely clear to me from your original post, but you had mentioned that you were able to create an allocation and join it before seeing the desyncs - was this before or after joining the mobile hotspot? If it was after joining the mobile hotspot, then I suspect the main issue lies in the inbound/outbound UDP rules. If the desyncs occur before joining the mobile hotspot (and are resolved using this connection), then I would expect Lobby, Relay, and additionally, Authentication services to report errors. Can you confirm the original timeline for your troubleshooting?

    Additionally, did allowing TCP/9354 fix the synchronization issue or was a more general rule to allow all traffic put in place? If it was specifically the TCP/9354 rule that resolved it, then I believe there may be an additional problem that will need to be resolved by your internal networking team - perhaps an issue with data gateway access on Azure?

    Finally, other than the port ranges requested, do you have any other blockers to development at this time? Let us know and we can look into workarounds for the interim.

    Regards,
    -Kip
     
    UnityKip, Jan 12, 2022
    #4

  5. daniel414

    daniel414

    Joined:
    May 13, 2020
    Posts:
    14
    Hi Kip,
    thank you, I appreciate your help.

    Not sure if I understood your question about the timeline correctly, but I try to explain with more details:
    First, I did not switch networks during a running session. I always connected to a specific network first, then entered play mode on two instances of my project, started the host in one instance and the client in the other instance.
    Every time I sign in via authentication service, create an allocation for the relay, start the host, copy the joincode to the other instance, sign in via authentication service there, join via joincode and start the client.

    With the hotspot (mobile internet connection from a phone) everything is working as expected: Player objects are spawned and objects are synchronized between client/host.
    With the company network I also do not get any errors, but the players do not spawn and objects are not synchronized between client/host.
    I am able to read the allocationId, server IP and port on both the host and the client. Since the authentication and the allocation seems to be working, I would assume the client-host communications via UDP should be the problem?

    We have not tried allowing TCP/9354 yet, because I wanted to ask first if there are any other ports that are needed.

    Two more things I found out:
    1. If I wait too long (about 10 seconds) between creating the allocation on the host and joining as a client, the client throws errors (join code not found). I read somewhere that with Netcode for Gameobjects the host should keep the connection alive.

    2. I tried it again in my companies wireless network (before I was connected via LAN), in this case a warning is spammed in the console:
    There are 1 pending send packets after the baselib process send
    I am waiting for an answer from our IT, if there was something else blocked in this case.
     
    daniel414, Jan 13, 2022
    #5

  6. Unity_Brandon

    Unity_Brandon

    Unity Technologies

    Joined:
    Sep 29, 2016
    Posts:
    23
    Hey again Daniel,

    There's a number of directions we can proceed in, but given this is using a configuration copied from the docs and working in one environment but not the other, I believe it's safe to assume this is an issue with packets being filtered in transit. However, I would recommend just double-checking everything is configured according to the latest version of the documentation.

    Relay relies on outbound connections being established which almost always negates any need for network configuration such as NAT or Firewall policies. At no point while utilizing Relay should you receive packets to your end device over a connection that was not solicited and established by your host machine. Therefore, the only instances which require network configuration are when using firewalls that do not track layer 4 communications (stateless) and/or extremely high-security environments that utilize implicit deny inbound policies. In my personal experience, this is exceptionally rare for subnets that serve employee workstations.

    I think the most efficient way to proceed at this point is to inspect your specific allocations on our end to see when there is a break in the expected data flow. This will require us to collect some sensitive information such as your project ID and organization ID, so I would recommend that you submit a ticket through our portal that can be found by navigating to the Unity Dashboard > Help & Support (Left-hand side) > File a Ticket > Multiplayer > Relay. I'll keep an eye out for your ticket, and once I see it I'll let you know what information I need to proceed with.

    To answer the two other things you pointed out:

    The Relay allocation requires that each connected user, host or client, send keepalive packets every 10 seconds by default to prevent the user from being considered disconnected. This requirement is for the Relay allocation itself, so it applies regardless of if you are using either UTP or NGO. However, you are correct in that this should be taken care of automatically without any additional code when using NGO, as opposed to adding a host driver update function with UTP detailed under "Keep the Relay connection alive" in Relay / UTP documentation. This indicates that the keepalive packet is being filtered.

    Generally, we see this when the process expects a packet to have been transmitted but for whatever reason is still queued on your local machine. More often than not, this is paired with an error that there are too many inflight packets.
     
    Unity_Brandon, Jan 13, 2022
    #6

  7. daniel414

    daniel414

    Joined:
    May 13, 2020
    Posts:
    14
    For now our IT will unlock the mentioned ports, in case that does not help I will submit a ticket.
    Anyway, I will post the solution here in case someone else has the same issue.
     
    daniel414, Jan 14, 2022
    #7
    Unity_Brandon likes this.

  8. daniel414

    daniel414

    Joined:
    May 13, 2020
    Posts:
    14
    Update:
    It works now, but the mentioned port TCP/9354 was not the only one required.

    Here is the list of ports that were allowed to make it work:
    Tcp_443
    Tcp_5671
    Tcp_5672
    Tcp_9350-9354
    udp_10000-49999
    stun-msturn (UDP/3478)
     
    daniel414, Feb 7, 2022
    #8
    Unity_Brandon likes this.

  9. daniel414

    daniel414

    Joined:
    May 13, 2020
    Posts:
    14
    Hi @BrandonUnity3D and sorry to bother you again,

    I want to share my recent experiences, because I still see a problem here.
    In your previous comment you said that in your experience networks that block this kind of communication are very rare. From what I experienced lately, the Relay does not work in most corporate networks. Also, for me it still does not work from time to time and since I cannot check the firewall myself it is cumbersome to pinpoint the error source (either other ports that are not unlocked or a bug in the project?).
    If the problem occurs for others I cannot just give the advice to play the port-guessing game again and again until it is fixed eventually.
    Imho there should be a section in the documentation (also for other services like Lobby, Voicechat) that precisely describe the requirements to eliminate that error source once and for all.
     
    daniel414, May 3, 2022
    #9

  10. daniel414

    daniel414

    Joined:
    May 13, 2020
    Posts:
    14
    daniel414, Jun 2, 2022
    #10

  11. unitydev_unity75

    unitydev_unity75

    Joined:
    Aug 24, 2022
    Posts:
    2
    Hello, I'm also facing similar issues , How can I solve it
    Thanks.
     
    unitydev_unity75, Dec 14, 2022
    #11

  12. daniel414

    daniel414

    Joined:
    May 13, 2020
    Posts:
    14
    Via support ticket I got the following information:
    For us, opening the whole UDP range was a no-go, so we are investigating a custom solution with the Websocket Protocol instead of UDP, which only requires communication through the standard TCP port 443 (and as a nice side effect, also makes multiplayer WebGL builds possible).
     
    daniel414, Dec 14, 2022
    #12
    unitydev_unity75 likes this.

  13. unitydev_unity75

    unitydev_unity75

    Joined:
    Aug 24, 2022
    Posts:
    2
    Hey, I tried opening the ports but I am still facing the same issue on my phone on the other hand on PC it works completely fine.
     
    unitydev_unity75, Dec 15, 2022
    #13

  14. WilliamMonrocq

    WilliamMonrocq

    Joined:
    Apr 29, 2021
    Posts:
    4
    Hi, just to give the answer I found after testing a lot. The current Relay servers are on ports ranging from 30000 to 60000, so opening up to 49000 only allows some servers to work, and your allocation may sometimes be on a server with a higher port.
    I had the problem using Relay, Lobby & NGO, where sometimes it worked and sometimes not. After opening all ports between 50000 & 60000, it works all the time.

    We could allow the IP & Port of each server only as I tried to get all of them, but the list may change anytime...
     
    WilliamMonrocq, Jan 27, 2023
    #14

  15. thiagownt

    thiagownt

    Unity Technologies

    Joined:
    Jul 30, 2021
    Posts:
    22
    hi all, Relay is currently operating only on the 37000-37100 range.
     
    thiagownt, Aug 1, 2023
    #15

  16. andreyshade

    andreyshade

    Joined:
    Aug 8, 2017
    Posts:
    10
    I have the simillar symptoms when testing connection trough VPN connection and without Relay. I'm able to send and receive CustomNamedMessages, sync scene but I unable to receive any spawn objects messages.
     
    andreyshade, Sep 1, 2023
    #16