5 hours ago, mmtaii said:

EDIT: Looks like there's an issue with the underlying server via

Will look into that and report back, thank you for the report.

10 hours ago, mmtaii said:

Modified the following directory paths, everything else is default.

I can not reproduce this on my server, here is the output from a new container installation: corekeeper.log

 

Are you sure that you are on the latest container image? I've edited the container about two weeks ago because a user was reporting a similar issue.

 

10 hours ago, mmtaii said:

ServerFiles: /mnt/user/Applications/corekeeper

 

I would also recommend that you use the real file path (/mnt/cache/... or /mnt/diskX/...) instead of the FUSE file path to avoid issues since some games simply will give you issues when using the FUSE file path and some games wont run at all.

 

EDIT: I pushed another update to the container, can you test if this is working for you now?

On 2/20/2023 at 2:19 PM, ich777 said:

And who is buying me this game...

We'll see when the price is revealed...

14 hours ago, ich777 said:

I can not reproduce this on my server, here is the output from a new container installation: corekeeper.log

 

Are you sure that you are on the latest container image? I've edited the container about two weeks ago because a user was reporting a similar issue.

 

I would also recommend that you use the real file path (/mnt/cache/... or /mnt/diskX/...) instead of the FUSE file path to avoid issues since some games simply will give you issues when using the FUSE file path and some games wont run at all.

 

EDIT: I pushed another update to the container, can you test if this is working for you now?

I've tried all of the above but continue to receive Segmentation Fault error.

Any way to confirm I'm using the latest image beyond deleting when removing Docker container in Unraid UI?

Edit: using docker inspect I've confirmed I have latest image hash... no dice.
 

/opt/scripts/start-server.sh: line 84:   208 Segmentation fault      ${SERVER_DIR}/CoreKeeperServer -batchmode -logfile ${SERVER_DIR}/CoreKeeperServerLog.txt -world ${WORLD_INDEX} -worldname "${WORLD_NAME}" -datapath "${SERVER_DIR}/Save" ${GAME_PARAMS} 2 > /dev/null
Terminated

 

Edited February 22, 20233 yr by mmtaii

5 hours ago, mmtaii said:

using docker inspect I've confirmed I have latest image hash... no dice.

Can you share a screenshot from the container template?

On what Unraid version are you?

Hey folks who may or may not be messing around with the KF2(killing floor 2) server image. Ive spent the last week or so messing around with it and I feel a warning is only fair to those looking to host one these days. 

First off you should be aware, the server code is designed in a way that makes it a target for people looking to amplify their DDos attacks, there is no rate limit on the UDP game port that it uses to accept connections. So bad actors spoof the ip of their target and then push packets to our servers. before you open your ports you should figure out some sort of protection. Here is a link to the tripwire forum post where some peeps seem to have something figured it. it's over my head so I'm just gonna shut mine down! (and close those ports again)

 https://forums.tripwireinteractive.com/index.php?threads/kf2-or-any-unreal-engine-3-server-on-redhat-centos-rocky-alma-linux-ddos-defense-with-the-help-of-firewalld.2337631/ 

 

Second off, if you want to run custom maps, and follow the workshop downloads instructions, you will find they don't work. The solution is a bit ass backwards, but here is what I did. 
If you go into the console for the docker, you can use steam cmd to download maps. This is important because the server wont do it it's self due to some sort of file mismatch (netcomego code 8). But its not super hard, all you need to do is open the docker console and then put each of these lines in individually. 

 

bash

cd /serverdata/steamcmd

su steam

./steamcmd.sh

login anonymous

workshop_download_item 232090 <workshopID from url>

You may have to then move these into the Cache folder inside your game (appdata/KFGame/Cache).

Or not... I'm not %100 sure as I had to mess around a bunch 

What the above does, if you're as Linux inept as I am;

 

• opens Bash which is a terminal emulator, I'm not sure if this is necessary, but I think it is for the user switch you have to do?
• cd (change directory) gets you to where the steam application is.
• su (switch user) steam changes the the user account you're launching steamcmd as, this is important so it has permissions to save the files to its directory.
• ./ launches steamcmd.sh 
• then you're logging in as anonymous, which is how most server stuff works with steamcmd.
• Lastly you're directing it to download an item for game id 232090 (linux version of KF2 server) and then what item you pick.

Once that's all good and done, peeps still wont be able to download your maps. HA!
What you have to do is give them some where to get them. 

 

So what I did was make my own HTTP redirect server. 

This guide will get you close.

https://www.reddit.com/r/killingfloor/comments/w2lg4a/a_guide_on_setting_up_a_kf2_server_and_a_url_for/

 

But you want to run that NGINX in a docker right? I installed the one from the community apps. https://github.com/linuxserver/docker-nginx#readme which is the one that comes up as just NGINX when you search for that in our community apps page. 

Once you have that, you're gonna almost follow the instructions from the reddit, except you want the files to be in a subdirectory of the "www" folder. also I recommend changing the port number for this. no need to collect the heat from having it on port 80. (change it during install)
Just copy the entirety of the folder that steam downloaded all your custom maps, into the directory you're hosting in the "www" folder. Don't worry about directory neatness or anything. 

you should be able to visit your index by typing <ip>:port/www/<maps or what ever you called it> if you can, and don't get a 403 or 404 you're set. 

In the ini file, you should add the url that the outside world would connect to your fileserver, for example if you're using a domain, put that in there. even if you connect over lan it will still work. Did for me any way.

Once that's all said and done, you should be able to connect in game, and if you decide to go to a custom map, keep in mind that the game is poorly made, you will be greeted with the loading screen saying downloading success 0% map name. just be patient the loading thing doesn't look like its working but it is, eventually you'll hop right into the game. Once the client has the map, that isn't an issue.  

I sincerely hope this helps, id say ask me if you have any questions, but considering I barely fumbled my way through it, got it working and now give up cause I cant figure out how to secure the game server from DDOsing I don't know if I'm truly going to be able to help!
 

That being said, if you're reading this and have and idea on how I could dump all that DDos traffic and not kill my home network let me know! when my box get's hit I'm uploading 40-80Mbps and my isp router struggles hard, basically kills my network.  one day ill have to build my own router but as of right now I'm using the one my isp gave me when I upgraded to gigabit fiber.

 

 

 

Edited February 22, 20233 yr by Emenblade
Plea for help at the bottom! And fixed some capitalization and spelling mistakes

1 hour ago, Emenblade said:

The solution is a bit ass backwards, but here is what I did. 

This is a solution how you could do it yes, but I would recommend that you either do these commands:

su $USER
$STEAMCMD_DIR/steamcmd.sh +force_install_dir $SERVER_DIR +login anonymous +workshop_download_item 232090 <workshopID from url> +quit

(this does basically the same)

 

I know this command is a bit complicated but for the container it's appropriate and will do the same all in 2 lines.

 

You could also download the workshop contents on your local PC and place the downloaded maps into the appropriate server directory like if you would do it for CS:GO or any other Source game.

 

Modding is always up to the user because I only provide the basic functionality because I simply can't know how to mod every game...

 

1 hour ago, Emenblade said:

But you want to run that NGINX in a docker right? I installed the one from the community apps. https://github.com/linuxserver/docker-nginx#readme which is the one that comes up as just NGINX when you search for that in our community apps page. 

I haven't read through the whole thread for what this is exactly but I think you are trying to set up a URL for the server and a mirror for the maps correct?

 

The easiest way would be ultimately to use SWAG from Linuxserver.io which is also available on the CA App.

With this you just set up your domain and boom you can connect to the server if you want to have a mirror or better speaking fastdownload server for the maps you have to put everything in the www folder and configure it accordingly.

 

1 hour ago, Emenblade said:

DDos

This is a topic that could be discussed really long and opinions on this are really different.

The first thing that you have to keep in mind that I really don't know someone is interested in DDOS your server, of course it could happen but I wouldn't spread the fear that someone could DDOS you, the risk is always there, even with other services but if the game server has no rate limit I would pitch that to the developers from the dedicated server that they implement a rate limit.

Hey thanks @ich777 for cleaning up the code bit there! Also thank you in general for these game servers, I've used a few of them and have had a lot of fun!

 

But not to be argumentative, in regards to the DDoS thing. I wasn't personally the target, the bad actor uses the kf2 server UDP connection hand shake as a way to amplify their attack on some one else. They do this by spoofing the return IP in their handshake, so that our kf2 servers start sending data to their spoofed IP(actual target). But for us home gamers it's enough traffic to flood a network. This provides a nearly 2x amplification in data. I have a gigabit connection, and my network was inoperable. It's also fairly easy to collect the IPs of the servers (like mine) because the servers do broadcast in-order to populate the server list in game. I think the bad actor refreshes their list every day or two, given I had about 36 hours of uptime untill I got hit. 

 

And while I definitely do agree that tripwire should absolutely patch their code to prevent this, it's been an issue for community servers since at least 2021. My server was only online for a few days and I started to get flooded with UDP traffic. I'm not necessarily trying to fear monger but the game is being completely sunset this year, I kinda doubt they are going to do anything about it. 

 

GIven the headache to get the custom maps working, because their own wiki that tells you how to setup the server directs people to use a system that is absolutely broken in regards to serving custom maps. And because the game is getting on the older side, I wanted to post something somewhere that would explain the current pitfalls of setting up a kf2 dedicated server in 2023. 

 

Ultimately I feel it's important to know that this is an issue that exists, because when I started the docker, I left it running like I would any game server. And when I got hit it took a while for me to figure out what was going on, when I did finally figure it out, I felt that the effort put in to get everything working wasn't worth it. The thing about unraid and these docker containers is that in general they are very easy to set up. If like me, a user have very little experience so far in Linux, but is capable of opening some ports and installing a docker from the apps page, if their network suddenly is saturated they might not know what's going on.

 

I'm not trying to fear monger, but make sure people are aware that this is an issue, and I did link to what is apparently the solution. It's just a little over my head.

 

Because for example I had both Valhiem and satisfactory servers running for over a month(satisfactory even uses the same port) and had no problems. Not all game servers are developed equally. And if had I known this was a vulnerability before setting this up, and given that a lot of us using unraid are doing so from our home networks. I think it's important that there is some awareness that this is a thing.

Also in regards to the webserver bit, I'm assuming that person has a domain, and just directing them how to set up the game server to point to their webserver that is hosting the maps. In the Reddit walk through there are some things that were assumed because the game server and webserver were running on the players windows computer. 

On 2/20/2023 at 2:19 PM, ich777 said:

And who is buying me this game...

 

+1 for Sons of the Forest

59 minutes ago, Zalszibar said:

 

+1 for Sons of the Forest

But nobody answered my question yet...

1 hour ago, Emenblade said:

But not to be argumentative, in regards to the DDoS thing. I wasn't personally the target, the bad actor uses the kf2 server UDP connection hand shake as a way to amplify their attack on some one else. They do this by spoofing the return IP in their handshake, so that our kf2 servers start sending data to their spoofed IP(actual target). But for us home gamers it's enough traffic to flood a network. This provides a nearly 2x amplification in data. I have a gigabit connection, and my network was inoperable. It's also fairly easy to collect the IPs of the servers (like mine) because the servers do broadcast in-order to populate the server list in game. I think the bad actor refreshes their list every day or two, given I had about 36 hours of uptime untill I got hit. 

This is definitely a game thing and they should fix it.

After reading that I'm thinking about pulling the container form the CA App...

 

1 hour ago, Emenblade said:

And when I got hit it took a while for me to figure out what was going on, when I did finally figure it out, I felt that the effort put in to get everything working wasn't worth it. The thing about unraid and these docker containers is that in general they are very easy to set up. If like me, a user have very little experience so far in Linux, but is capable of opening some ports and installing a docker from the apps page, if their network suddenly is saturated they might not know what's going on.

But then pass it over to the developers and make a post there maybe also with performance graphs so that you can proof that their dedicated server is actually bad...

 

1 hour ago, Emenblade said:

And if had I known this was a vulnerability before setting this up, and given that a lot of us using unraid are doing so from our home networks. I think it's important that there is some awareness that this is a thing.

This is certainly true but I'll sleep over it if I pull the container from the CA App.

 

As said above this needs to be passed over to the developers from KF2 so that they become aware of that, I can't think that they can't implement some kind of rate limit into the dedicated server...

I'm trying to get my Valheim server Problems solved and it seems i'm out of luck. So maybe you guys can help me out.

I get random disconnects to my server, checked the autoupdate thingy but as i understood it is fixed anyways because it is always "false". 

So the last thing i've read somewhere is that i have to make sure that my instance isn't using crossplay and to remove the -crossplay option in my start_server.sh. But all of those articles are dealing with normal dedicated server installations and not this docker version. 

So how do i make sure that my container isn't using the -crossplay option?

Or do you have any other ideas? I'm hosting some other games and services and there are no problems with disconnects like we have here with this Valheim docker container.

I have nothing i can do and those constant and randomly occuring disconnects makes playing a real pain.

10 minutes ago, screwbox said:

I get random disconnects to my server, checked the autoupdate thingy but as i understood it is fixed anyways because it is always "false". 

This is not a thing anymore, the auto update does nothing anymore.

 

11 minutes ago, screwbox said:

So the last thing i've read somewhere is that i have to make sure that my instance isn't using crossplay and to remove the -crossplay option in my start_server.sh.

11 minutes ago, screwbox said:

So how do i make sure that my container isn't using the -crossplay option?

If it's not in the Docker template at GAME_PARAMS then it's not enabled.

 

11 minutes ago, screwbox said:

I have nothing i can do and those constant and randomly occuring disconnects makes playing a real pain.

How often is randomly? Do you have CA Backup installed and active, if yes how often does it take a backup?

Do you use your LAN IP to connect to the server or do you use your public IP?

 

Can you share the container logs after it restarted?

3 hours ago, ich777 said:

But nobody answered my question yet...

Hahah, how do you and the other CA devs typically go about creating new containers?  I imagine you probably need the game or app to begin with, and they cost $$  Ya'll need a tip jar!

 

As a new user to unRAID, it's been a super great experience to utilize these dockers ya'll have put so much time into.  I very much appreciate you as a consumer of these things, and my gaming friends do too since I host a few servers for them  

20 minutes ago, Zalszibar said:

I imagine you probably need the game or app to begin with

Exactly, I have created containers for games which I didn't own but giving support for these where a nightmare so I stopped doing that.

 

Lets see if they even publish the dedicated server at launch or if it takes them a year or two to publish the dedicated server like it was the case for The Forest.

EDIT: Found something Click

EDIT2: Found more things Click

 

20 minutes ago, Zalszibar said:

Ya'll need a tip jar!

I have one, but it's always empty because of new game requests.

The link is on all installed containers on your server from the CA App or in the first post...

 

20 minutes ago, Zalszibar said:

As a new user to unRAID, it's been a super great experience to utilize these dockers ya'll have put so much time into.  I very much appreciate you as a consumer of these things, and my gaming friends do too since I host a few servers for them 

Always nice to get from time to time positive feedback... Really much appreciated!

4 hours ago, ich777 said:

This is definitely a game thing and they should fix it.

After reading that I'm thinking about pulling the container form the CA App...

 

But then pass it over to the developers and make a post there maybe also with performance graphs so that you can proof that their dedicated server is actually bad...

 

This is certainly true but I'll sleep over it if I pull the container from the CA App.

 

As said above this needs to be passed over to the developers from KF2 so that they become aware of that, I can't think that they can't implement some kind of rate limit into the dedicated server...

Agreed! Yeah my understanding from reading on their forums, they don't think it's a problem. I'm assuming they just have big pipes or something... Haha. Yeah they used to support the game or at least it looked like they did a few years back but they haven't seemed to put much into it in the last couple. Tis a shame! 

 

Yeah also I share the sentiment that @Zalszibar has, thank you in general for providing all this to us! The whole community apps thing in general is amazing and all the effort you put into making all these game ones is really really nice.

 

And in no way was I implicating your work into the adversity I've had with my lil kf2 server. I posted here simply because this is the first place I looked when I was having issues. Plus it's just so easy to setup using the CA page and your docker, I figure other people might end up in the same place I am. 

 

Purely hypothetically, I know dockers have their own networking built in. How hard do you think it would be to implement a connection limit per IP? Some of the folks on the tripwire forums were talking about iptables, firewalld, and or fail2ban. Like I guess I'm wondering if I were to figure that out so my server dumps the repeated connection requests instead of replying to them. Do you think it would be possible for me to implement that in the docker container, or would that be something I'd do on the actual box? Or in your opinion is that something I'd have to do at the router level? I know that's a lot of questions and your a busy person. I guess what I'd like to do is come up with a solution to it given that tripwire hasn't and I sincerely doubt they're going to given how little they seemed to have cared to fix their game over the last few years. 

On 2/16/2023 at 9:55 PM, ich777 said:

From what I see it should be doable, but I don't own the game and I stopped creating containers for games which I don't own.

how do I get you a copy?

7 hours ago, Emenblade said:

Some of the folks on the tripwire forums were talking about iptables, firewalld, and or fail2ban.

I think that's kind of unrealistic because a game server is not a web server in general.

Of course you could use GeoBlock but this is a feature which your Firewall needs to support.

 

7 hours ago, Emenblade said:

Or in your opinion is that something I'd have to do at the router level?

It would be always be better to do it on the Router/Firewall side from my perspective.

 

7 hours ago, Emenblade said:

I guess what I'd like to do is come up with a solution to it given that tripwire hasn't and I sincerely doubt they're going to given how little they seemed to have cared to fix their game over the last few years.

I wasn't even aware of this that you could do that with a dedicated server as you've explained above because usually they own use their own dedicated "proprietary" protocol which only should answer to real requests that come from the client side.

5 hours ago, Newtious said:

how do I get you a copy?

A donation via PayPal or donate the game on Steam to me.

 

But I have to say that I don't see any indication that dedicated servers are supported at launch but I will look into it when the game was released.

19 minutes ago, ich777 said:

I wasn't even aware of this that you could do that with a dedicated server as you've explained above because usually they own use their own dedicated "proprietary" protocol which only should answer to real requests that come from the client side.

Yeah the problem is that the connection handshake is all udp. Because there's no requirement for an actual handshake before data starts flowing, if the hacker doesn't have their network traffic filtered(BCP 38) they can send these packets with the wrong return address. I'm assuming all they needed to do is copy whatever the normal connection request looks like and change the ip in it. Kinda blows my mind how powerful it is when distributed. 

So in the spirit of learning new things I've been doing research all evening on how I could implement the fix posted in the tripwire forum post I linked way up there. Here. But I've gotten stuck, they essentially as far as I can tell, use the game server log, to detect when they are getting hit, if ~5 connection attempts happen in quick succession, they take the ip from that and tell the firewalld thing to dump future packets from that address. Now were fairly certain those attempts aren't actually originating from those ips but it is still a way to identify the packets and drop them before the game server sees them, and starts shooting out data.
 

So I figured, okay I could setup a script to do that using the scripts plugin, shouldn't be that hard, if it doesn't work ill shut the port again! Well I tried to do this any way, got stuck when bash didn't recognize the firewall command. Tried to do some more googling, figuring that unraid which is based on Slackware should have some of this built in some where. but so far my googling returns mainly posts about how unraid needs to be ran behind a fire wall and isn't designed to do firewall-y things. 

So I think I'm stuck, my router is from my isp, cant be tinkered with tooo too much, and I don't have any hardware lying around to turn into a hardware firewall. Plus even if I did, the current "fix" requires reading of the server logs, which I suppose it could over a network share, but that just doesn't seem like the way to do this sort of thing, even to a novice like myself. 

So now I'm trying to figure out how docker networking works, to see if perhaps this is something I could do inside the container, so as not to mess up the rest of the docker stuff... But to be honest, I think I may just play some thing else for a while instead! hahah!

 

16 minutes ago, Emenblade said:

Yeah the problem is that the connection handshake is all udp. Because there's no requirement for an actual handshake before data starts flowing, if the hacker doesn't have their network traffic filtered(BCP 38) they can send these packets with the wrong return address. I'm assuming all they needed to do is copy whatever the normal connection request looks like and change the ip in it. Kinda blows my mind how powerful it is when distributed. 

Are you really sure that this is possible? The above is almost true for every game server, how else would you establish the connection?

Do yave you any other reports from this or some more in depth documentation?

 

19 minutes ago, Emenblade said:

So in the spirit of learning new things I've been doing research all evening on how I could implement the fix posted in the tripwire forum post I linked way up there. Here. But I've gotten stuck, they essentially as far as I can tell, use the game server log, to detect when they are getting hit, if ~5 connection attempts happen in quick succession, they take the ip from that and tell the firewalld thing to dump future packets from that address. Now were fairly certain those attempts aren't actually originating from those ips but it is still a way to identify the packets and drop them before the game server sees them, and starts shooting out data.

But this tutorial describes how to mitigate DDOS attacks on your server, I basically can't help there because that's modding the server/container and I usually don't support this because modding is up to the user, TBH I even don't play KF2.

 

21 minutes ago, Emenblade said:

So I figured, okay I could setup a script to do that using the scripts plugin, shouldn't be that hard, if it doesn't work ill shut the port again! Well I tried to do this any way, got stuck when bash didn't recognize the firewall command. Tried to do some more googling, figuring that unraid which is based on Slackware should have some of this built in some where. but so far my googling returns mainly posts about how unraid needs to be ran behind a fire wall and isn't designed to do firewall-y things. 

But you have to understand that you have to install this all in the container and my containers are based on Debian and you have to install the appropriate software there and not on the host (Unraid).

 

Unraid is a Application server and not a General purpose server, so to speak, you run the application (KF2 Docker) on Unraid and you expose the ports from the application to the world wide web not from Unraid.

Honestly that's kinda great news, if I'm understanding you correctly, it's theoretically possible to install a firewall inside the gameserver docker. That's great I think? It's late o'clock here but I'll definitely be poking around tomorrow to see how I'm gonna do that!

 

Yeah in regards to the handshake thing. I'll be honest I'm not sure. I know the access requests are coming in on UDP. Because if I close off that UDP port 7777 the attack stops. The rest of what I've written about it is what I've come to understand reading that other forum and a cursory google search. I feel like other games must do a TCP handshake before trying to initiate the UDP connection. From what I understand that would stop this sort of attack from working at all. But then again I'm a mechanic not an IT professional or developer or something. So I don't really know. 

 

I also just want to say thanks for looking at the issue at all for me, 😊. Like this really has nothing to do with the docker you made at all. That works ✓%100 great. Just like all of the other dockers you've made that I've used so far. 

 

 

9 minutes ago, Emenblade said:

feel like other games must do a TCP handshake before trying to initiate the UDP connection.

Definitely not the case for most games.

I'm wondering why only KF2 is affected and not other games too which are based on the UnrealEngine...

Hi @ich777! Thanks for you work on all these game servers.

It appears that Core Keeper has updated again on Feb 23, 2023 to v. 0.5.2.5 where they are saying they've "fixed dedicated server not working in docker containers", but it seems to be causing a segfault again on my docker instances now:

 

/opt/scripts/start-server.sh: line 84:   116 Segmentation fault      ${SERVER_DIR}/CoreKeeperServer -batchmode -logfile ${SERVER_DIR}/CoreKeeperServerLog.txt -world ${WORLD_INDEX} -worldname "${WORLD_NAME}" -datapath "${SERVER_DIR}/Save" ${GAME_PARAMS} 2 > /dev/null
Terminated