(INCLUDING THE INSTRUCTOR MODE) Flight Simulator includes a Multiplayer function which allows players to join in group flying sessions. There are Internet servers set up for doing just this, but many people simply want a one to one session with a friend, and would like to join just the two computers. With Windows XP SP2 inbuilt firewall, this is fairly straight forward and is not covered in this version of this document, but if you have a Local Area Network (LAN) and/or a router which has an inbuilt hardware firewall to protect your system behind a broadband connection, it isn t always so simple. Multiplayer Host Connection To host a FS Multiplayer session, you need to configure port forwarding in your router for Flight Simulator 2004 to allow other players past your firewall. For FS2004, you set up port forwarding for ports 23456, 2302 to 2400, 6702 and 6703. (FS seems to need them all). http://www.portforward.com/ gives set up instructions for a host of different routers. The information it gives is very clear, with screenshots of things you recognise! If your WAN IP changes, simply advise the other player of the new address before they connect to your PC. Player Connection A player who is not hosting a multiplayer session, or the "student" in instructor mode goes into multiplayer and enters your WAN IP. He should then see the name of the session he wants to connect to, and that is all there is to his part. Multiplayer Servers As well as connecting with one or two others for a multiplayer Flight Simulator session, (peerto-peer connection) there are many Internet based servers which host multiplayer sessions, although some of them require a special software program to enable access, which may be downloadable from the server s web site. When you log on to one of these services, no firewall configuration is normally necessary. However, if port forwarding is required, then the procedure is the same as for hosting a multiplayer session in a peer-to-peer connection. Broadband and Routers A broadband connection is always on, a telecommunications service rather like your electricity, water or gas supply. All computers connected to the Internet can, in theory at least, be accessed by any other computer on the Internet, and therein lies a security risk. To protect a computer on a broadband connection, most if not all I.T. professionals recommend making the connection via a router A router is a hardware device which behaves in some ways like a computer. In particular where a PC or network of PCs is connected to the Internet via a router, the Internet only sees the router, because it is the router which holds your Internet address, or WAN IP. In some older routers with only a single PC able to be connected, this wasn t the case, and it was the PC which had the WAN IP. In modern routers, any PCs connected to the router are invisible to the Internet, and that is what makes a router valuable for Internet security with broadband. The router also has an internal IP address which is its LAN IP address its place in the family of PCs connected to it. Page 1 of 5
The router contains an inbuilt application programme ( firmware ) which controls the flow of data through it. In modern routers, part of that firmware is a firewall. The firewall monitors the flow of data and by default blocks all incoming data regarding it as hostile a threat to the security of the data held on the computer(s) behind it. However, it has to allow incoming data, otherwise you would se nothing on the screen, so it has to work to certain rules some of which are configurable by the user. In most cases, data flowing outwards to the Internet, for example when you open a web site, is allowed unhindered the router assumes that the user is making a conscious decision to access the Internet. However, inbound data is dealt with in two ways. If the data inflow is in response to data outflow, i.e. a user request, then a two-way channel is opened and the router will allow that response. This allows you to see the content of the web page you have chosen to access. However, any inbound data which is not in response to a request is blocked by the router. Therein lies the security function. With Multiplayer games over the Internet, where a dedicated Internet server such as VATSIM is not being used, the very situation which the router is designed to block unsolicited incoming data - is a necessary part of the game. So the players have to modify the router s rules to allow that incoming data. However, it is very important that the modification is done with great care to avoid any unnecessary exposure to outside threats. A successful malicious attack on your PC can have devastating consequences either from a virus or someone stealing personal data such as passwords, bank account details, Internet credit card transactions etc. WAN IP A WAN IP is an Internet address. It is the unique code by which computers on the Internet recognise each other. Some Internet Service providers (ISPs) give users a fixed WAN IP, although most provide dynamic IP addresses every time you connect to the Internet, your PC may be given a new WAN IP. This is a function of the ISPs service provision policy. A user with a dynamic IP address can request a fixed IP address from their ISP, but if the ISP does provide fixed IP addresses on request, it is usually at a cost premium. However, if a broadband connection is never disconnected, it SHOULD keep the same IP address. The WAN IP addresses are the two ends of a connection along which packets of data flow. Each packet of data transmitted via the Internet contains coded information which tells the Internet where to send it. To find your WAN IP at any time, there is a little free utility called MyWANIP which will return your Internet IP address, if you have no other way of finding it. See http://www.mywanip.com/ Fig. 1 My WAN IP a very useful utility Page 2 of 5
Internal IP Addresses In the same addressing system as for WAN IPs, computers on a LAN have an IP address which the router knows. Every network adapter installed in a computer has a unique hard coded address known as a Media Access Control address (MAC). The MAC of every computer on the network is mapped to an internal IP address by the router. This is normally done automatically by a process called Dynamic Host Configuration Protocol (DHCP), but in most routers DHCP can be disabled, though this isn t recommended. Fig. 2 Internal IP Address of a PC on a Local Area Network This means that the internal IP address of a PC on the network may change (hence dynamic) without the user knowing (or needing to know) that it has. So for a FS2004 multiplayer connection, you need to know the internal IP address of the computer running FS2004. To check your PCs internal IP to which the router sends data, go to Control Panel, and select Network Connections. When the Network Connections window opens, double click the Local Area Network icon, and then select Status. In the window which appears, click the "Support" tab, and there the PCs internal IP address will be displayed. Port Forwarding Many applications, particularly online games (and FS) require port forwarding in order to work over the Internet. The rules by which the router manages data have to be changed. However, in some routers, setting rules to let specific incoming data past your firewall doesn't work, because rules can be applied to one, two or all of the PCs connected to the router behind the firewall, but you can only forward a particular port to a particular machine. You can only post a letter through one letterbox to use a more familiar analogy. If a packet of data arrived at port 1111 and the user had set a rule to forward it to multiple computers, the Page 3 of 5
router would not know which one it was intended for. All it knows is that the packet was destined for the WAN IP. To configure port forwarding for a PC on a network behind the router, you have to define both what to allow through and where to send it. As far as the destination PC is concerned, the transmission comes from the router, not from the originating PC on the Internet. The originating PC s IP address is translated into the router s WAN IP. This process, called network Address Translation (NAT), can take place for more than one PC on the LAN at the same time. The user configurable part of NAT is a list of ports and the internal IP addresses to which data packets arriving at those ports have to be sent. Some routers use a NAT table to forward ports, although it isn t obvious that it is the NAT table which has to be configured for port forwarding. Others use phrases such as ports to open or ports to forward in their rules configuration screens, which is a little more readily understood, or at least recognized, by the non-technical user. As an example, Figure 3 below is the NAT table for setting up port forwarding on a Zyxel router. Fig. 3 Setting up Port Forwarding for FS on the Zyxel 660H Router For port forwarding to work easily, internal IPs really need to be fixed. It isn t essential, but if they are not fixed, then you would have to check the internal IP address before each multiplayer session and possibly go into the router configuration and change the port forwarding rules. Most routers allow the user to allocate IP addresses based on the MAC address of the network adaptor, thus you still get a DHCP allocated IP address but it remains fixed. Page 4 of 5
To find the MAC Address of a PC If you need to find a PC s MAC address on a small home network, open a Command Prompt window on the PC you are checking (Start/All Programs/Accessories/Command Prompt.). Type ipconfig /all (without the quotes), find the line Physical Address and read off the 10 digit code the MAC address. You use this is the Router DHCP settings to give the same IP address to that MAC address each time the PC asks. You can also use ipconfig to find your PC internal IP address ( IP Address in Figure 4 below) as an alternative to the Windows method described above. Note that if there is no valid network connection, the internal IP will not be shown, but the MAC address will be. FINAL WARNING Fig. 4 Using ipconfig to find a PC s network addresses A malicious attack on your PC is more likely than not! It is definitely worth repeating that opening your firewall has the potential to allow unauthorized and malicious access to your computer. So do be very careful when changing settings. If in any doubt about what you are doing, do seek professional advice. There are a lot of IT professionals on CIX who will gladly help you. ACKNOWLEDGEMENTS Author Peter Dodds Technical assistance from Pete Allnutt and Tony Driver Page 5 of 5