SERVER OWNER RUNBOOK

A separate way in.
A personal key for each player.

You can use the player guide with servers hosted by any provider. To make it work, you or your hosting provider must supply a VPN gateway, a personal .ovpn file and the correct private join address. This website does not connect itself to independent servers or install software on them.

1. If your server is hosted by Slikz

1. Sign in to Panel → VPN Access.
2. Find the intended game server. Access is unavailable for suspended services or nodes with VPN disabled.
3. Select Guest profiles. Enter a player's name and choose a lifetime (1, 7 or 30 days in the UI, limited by the service's end date).
4. Choose Create & download .ovpn. Send that file privately to that one player.
5. Use Copy join instructions. Send those instructions together with this website.
6. Repeat for the next player. Re-downloading one existing profile does not create a second identity.
7. Revoke a profile when it is no longer needed. Guests only receive access to the selected server. Keep your owner profile on your own device.

The current panel limits active guest profiles to 20 per server and 200 per node. If you need more concurrent players, ask the administrator to provision additional capacity before distributing access. Do not work around capacity limits by sharing one profile.

2. If you host elsewhere: collect the right information

Give your host administrator this checklist. The game server can remain in its existing mode while an additional VPN route is tested.

3. Build the gateway with your administrator

This is an administrator task, not a player step. Existing firewall rules, container networks and provider filtering vary, so do not paste generic firewall-replacement commands onto a production machine.

1. Install a maintained OpenVPN server. Follow the official OpenVPN setup documentation. Keep CA/server private keys on the gateway or in your controlled PKI, never on the public website.
2. Create the server identity and individual client certificates. Each player gets a unique identity. Configure certificate verification and a revocation list. Avoid a shared certificate and shared fixed VPN IP.
3. Use a routed tunnel for direct IP joining. Provide the specific game route to the client. Do not route all player Internet traffic through the host just to reach a game server. A routed tunnel does not automatically provide LAN broadcast discovery.
4. Restrict access to game traffic. Allow the intended TCP/UDP game ports between that player and the permitted server. Keep SSH, XML-RPC, databases, control panels and other customer destinations blocked. Do not enable unrestricted client-to-client access.
5. Translate the destination only if necessary. If publishing a private alias, the gateway must map that alias to the correct game process and preserve the return path. Account for ports advertised by the game; a successful initial query alone is insufficient.
6. Export a complete player profile. Include the correct reachable gateway, protocol, certificate verification, that player's certificate/key and required TLS settings. Provide separate external files if your deployment requires them. Never include the CA or server private key.
7. Configure expiry and revocation. Enforce expiry on the gateway, including when any management website is unavailable. Revocation should disconnect existing sessions and reject reconnects.

The official OpenVPN manual describes client-specific configuration, routes and certificate revocation. A certificate reused by another connection can replace the original session; issuing individual profiles avoids that conflict.

4. Verify before telling the community it works

1. Use a test player's own profile from a different Internet connection. Confirm the VPN handshake completes.
2. Confirm the route to the game address uses the tunnel and identifies the intended game server.
3. Join with an affected United Forever account. Also test Nations Forever if you support it. Actually enter the server and play; a TCP connection is not a gameplay test.
4. Connect a second player at the same time using a different profile. Both should stay connected.
5. Confirm unrelated servers and administration ports cannot be reached.
6. Revoke the test player's profile. Verify the active session ends and the old file cannot reconnect.
7. Publish the tested join address and a support contact. If you move a server, recheck routes, certificates, profiles and join instructions.

5. Send a package a beginner can understand

Send these three items privately to each player:

1. Their personal .ovpn file. A standard OpenVPN app plus this file is the preconfigured client setup. Do not repackage or modify an installer just to include a shared secret.
2. The exact private join address. For example, tmtp://#join=PRIVATE-IP:ACTUAL-PORT. Replace that example with the tested value. Do not guess a public port.
3. A guide link and an expiry. Use the guide link generator to prefill your server name and join address. The link contains no credentials; send the profile separately.

6. If a player still cannot join

Ask for the server name, the exact private join address, time of failure, OpenVPN app/version, whether a separate guest profile was used, and the final error lines in the VPN log. Ask them to run the read-only Windows checks. Do not ask them to post their full .ovpn file.

Check the gateway's connected certificate identity, the route pushed to that identity, the allowed server, expiry/revocation, actual game ports and return traffic. If the VPN connects but the game fails, investigate game traffic separately from the tunnel handshake.

This is a setup and verification runbook. Independent gateways are not automatically onboarded, monitored or operated by this website.