UPnP Port Forwarding

With UPnP turned on, TCAdmin asks your router to forward the panel's ports and the ports of every running game or Docker server, so a panel hosted at home or in a small office works without touching the router's admin page. It supports routers that speak UPnP or NAT-PMP.

Who needs this?

Only servers behind a consumer router (NAT). A datacenter node with a public IP finds no such router and does nothing. The feature is off by default.

What Gets Forwarded

Owner	Ports	When
Monitor	Its own HTTPS listener port.	Always, while UPnP is enabled.
Web	The panel's HTTP and HTTPS ports.	Master server only.
FTP	The control port and the whole passive port range.	Only when FTP is enabled.
SFTP	The SFTP listener port.	Only when SFTP is enabled.
Game server	Every port the server declares, TCP and UDP.	While the server is running.
Docker server	Every port the server declares, using that port's own protocol.	While the server is running.

A server's ports are forwarded when it starts and removed when it stops, so the router's table mirrors what is actually listening.

Turning It On

How you enable it depends on which server you are configuring.

Server	Where to enable it
Master server	In the monitor's appsettings.Production.json file only.
Remote server	In the same file on that server, or from the panel under Server Configuration.

In the Monitor's appsettings File

The file is config/monitor/appsettings.Production.json inside the TCAdmin install directory:

• Windows: C:\Program Files\TCAdmin3\config\monitor\appsettings.Production.json
• Linux: /opt/tcadmin3/config/monitor/appsettings.Production.json

New installs already have an Upnp block with Enabled set to false. Change it to true, or add the block if your file does not have one:

{
  "Logging": {
    "PrintConfigOnStartup": false
  },
  "TCAdmin": {
    "ServerId": 1,
    "IsMaster": true,
    "Type": "Monitor",
    "MonitorWeb": {
      "RandomPort": false,
      "Port": 50051,
      "SecurePort": 50052
    },
    "Ftp": {
      "ServerAddress": "0.0.0.0",
      "Port": 8821
    },
    "Sftp": {
      "ServerAddress": "0.0.0.0",
      "Port": 8822
    },
    "Upnp": {
      "Enabled": true
    }
  }
}

The other values are whatever the installer wrote for that server, so leave them as they are. A remote server's file is edited the same way.

From the Panel (Remote Servers Only)

Add a Server Configuration option with key TCAdmin:Upnp:Enabled and value true:

• One remote server: open the server's Configuration page and use the Advanced tab.
• Every remote server: use Settings > Global Server Configuration.

The master server is not covered

Server Configuration options are delivered to remote monitors only. The master server reads its UPnP settings from its own appsettings file, even when the option is set globally.

Restart the monitor

UPnP settings are read once when the monitor starts. Restart the monitor after changing them, whichever method you used.

Options

All options live under TCAdmin:Upnp, next to Enabled in the file above. Set them in the file or, on remote servers, as Server Configuration options such as TCAdmin:Upnp:VerifyIntervalSeconds.

Key	Default	What It Does
Enabled	false	The master switch; nothing happens while it is off.
DiscoveryTimeoutSeconds	15	How long startup waits for a router before logging that none was found.
VerifyIntervalSeconds	120	How often mappings are re-checked and recreated if the router dropped them.
RemoveMappingsOnStop	true	Whether entries are deleted when a server or the monitor stops; false leaves them.
ForwardServicePorts	true	Whether running servers are forwarded at all; false limits it to the panel's ports.

"Upnp": {
  "Enabled": true,
  "DiscoveryTimeoutSeconds": 15,
  "VerifyIntervalSeconds": 120,
  "RemoveMappingsOnStop": true,
  "ForwardServicePorts": true
}

Verifying It's Working

The monitor log reports the router it found and each mapping it applied:

UPnP gateway found at 192.168.1.1, external IP 203.0.113.7
UPnP mapping applied Tcp 31002 (TCAdmin #1 monitor)

If no router answers within DiscoveryTimeoutSeconds, the log shows only No UPnP gateway found within 15s.

To confirm from the router's side, open its admin page and look at the UPnP or port-forwarding table. Every entry TCAdmin creates has a description starting with TCAdmin and the server id, such as TCAdmin #1 monitor or TCAdmin #1 service 214. An entry another device already holds for the same port is left alone and reported in the monitor log.

Troubleshooting

• UPnP is off on the router. Most consumer routers have a separate "Enable UPnP" switch.
• Double NAT. When an ISP router sits in front of your own router, UPnP only reaches the inner one, so the outer router still needs manual forwarding.
• The router forgets mappings after a reboot. The periodic re-check recreates them within VerifyIntervalSeconds.
• A stopped server's ports vanish from the table. That is the default; set RemoveMappingsOnStop to false to keep them.
• This does not replace the host firewall. Windows Firewall or iptables/nftables rules on the host are separate and still apply.