You might want to setup proxy because

• Your game server uses a specific route that is highly congested during certain hours but it has a completely uncongested alternate route that is not easily publicly available thus you can setup another VPS as a kind of VPN to force a different uncongested route.
  
• Your game server, like home server, has no DDOS protection and you want to use a VPS with DDOS protection as the face server.

There are several options available to route connections from one server to another

• Direct Routing
  
• IPIP Tunnel
  
• GRE Tunnel
  
• VXLAN
  
• Wireguard
  
• IPSec/ikev2

Out of these options, I found wireguard to be the most reliable. Wireguard is an open source UDP-based VPN therefore it has encryption which means overhead but despite the overhead, it is very reliable in latency and stable in connectivity. IPIP, GRE, and VXLAN all have some degree of latency problems, with IPIP being the worse, follow by GRE then VXLAN. IPSec/ikev2 is very complicated to setup and that complicity is not worthwhile, its ports are also fixed thus not always deployable in all environments. Direct Routing seems to subject to instability.

Wireguard, despite really good compare to other options, it also has downside. As mentioned, there's encryption and this encryption is CPU-bound thus you need decent CPU for it to perform. Fortunately, it is multi threaded thus having more cores can improve its performance easily.

• Two servers
  
• FirewallD (I like FirewallD)

RHEL-based Linux
Debian-based Linux

Open SSH on both servers since you gonna do similar things and need keys from each server.

On your public facing server, we call this server A. We do the followings

Enable IP forwarding

Generate Wireguard Private and Public Keys

Take note of the keys

We will add the config file, simpler than doing commandline

Enter this into wg0.conf

Start the wireguard

Setup the firewall

Allow the ports if you haven't

Forward the port while retaining their public IP address

Support outgoing connections

Finally add Server's A Wireguard Port

Reload the rule list

We doing similar things

Generate Wireguard Private and Public Keys

Take note of the keys

We will add the config file, simpler than doing commandline

Enter this into wg0.conf

In order for allow wireguard to accept users' public IP, we need to modify "AllowedIPs" further by using this calculator[www.procustodibus.com].

We cannot arbitrarily use 0.0.0.0/0 which means allow all IPs as this will include VPS's IP and gateway which will conflict with wireguard automate routing table creation, ultimately destroying our SSH connectivity. So we exclude the VPS IPs, VPS gateway IP and also wireguard IPs range because we only want the user to connect with their public IPs.

Example
This will be the result

Start the wireguard

Setup the firewall

We need to add Server's B Wireguard Port

On both server, enter this code, you should see "Last Handshake" if is connected

You are done, players now can connect to server B via server A's IP.

After you done the basics, you should have a working peer to peer wireguard connection. However, it might not be enough for you. At this point, you should realize that your game server is still advertising machine B's IP. What if you want to host the server via machine A's internet?

To do that, we need to do network namespace. While it can be complicated, has its benefit of just allowing your PZ application to run on the wireguard network while the rest of your applications will continue to run on the main network. This is good because bandwidth cost money in many locations.

Some VPS use their own nameservers which work for local machine but does not work for our VPN machine so we need to use public dns like cloudflare or google. Do this on both machines.


Add this as first nameserver

To get PZ running in wireguard network, we have to use network namespace, an isolated network container where you can get your applications to run on specific interface.

Disable wireguard (coming from basic)

Modify wg0.conf on game server. We now only block private IPs range. We can don't include our VPS IP and VPS gateway IP because network namespace is isolated from host network thus won't destroy our SSH connectivity.

Create the namespace

Activate the loopback on namespace

Start the wireguard in the namespace and move the interface into namespace. Wireguard by default will always be created at host thus we need to do this command together or we will be locked out from SSH.

Set IP to the interface. Wireguard lose its IP address when moved.

Start the interface. Wireguard is turned off when moved.

Set wireguard as default gateway

To execute PZ in the network namespace, you do this

IP command is not persistence thus will be gone after you reboot. To make it persistence, you need to run the commands again after reboot but we can simply create a service to do that.

Add these

Enable the service

If you want normal user to able to run "ip netns", it is a root command. You need to allow them to do so. Note that they will able to use root commands through namespace.


Add this line at the end

Then, they can do this

Maximum transmission unit (MTU), it is the maximum packet size you can send. In wireguard, the default MTU is 1420 but depending on your network, 1420 might be too high or too low for you which can impact your transfer speed.

You can do a very bandwidth expensive test using https://github.com/nitred/nr-wg-mtu-finder but as mentioned, it is very bandwidth expensive thus I would recommend you to tweak the test criteria a little.



We do by increment of 10 and we start from 1400 instead of the lowest 1280. Even so, this test would estimate to cost you about 200GB worth of bandwidth.

Is this test absolutely necessary? Nope. Only if you encounter noticeable gap in transfer speed with and without wireguard. Of course, you can also do this test if you want to push your network speed to its very limit.

At the end of the test, the tool will plot a graph based on the csv file, the white cell is the one you want to put your MTU value at. To assign MTU value in wireguard, you edit the conf like this.


In general, if you are using a standard IPv4 network and the routing between servers are not going through some major jumps which involve more encapsulations, you can set your MTU to 1440 and 1500. Wireguard has a overhead of 60 for IPv4 and this overhead is only applied on one end.