Add Online Security

2026-09-01 13:05:28 +00:00 · 2026-09-01 13:05:28 +00:00 · 8aebb972da
commit 8aebb972da
parent c45eaa032e
1 changed files with 122 additions and 0 deletions
--- a/Online-Security.md
+++ b/Online-Security.md
@ -0,0 +1,122 @@
 # Online safety and IP address privacy
 Straywild supports online play through player-hosted rooms, dedicated servers, and direct connections. This guide explains what your IP address reveals, when another player may be able to see it, and what you can do to protect yourself.
 ## The short version
 - Treat any room that is not explicitly marked **relayed** as a direct connection.
 - In a direct connection, the host and joining players exchange network traffic directly. A technically knowledgeable participant can inspect that traffic and determine the other connection's public IP address.
 - A VPN can replace the residential IP address visible to other players, provided it handles both IPv4 and IPv6 correctly.
 - A dedicated server keeps the server operator's home address out of the connection, but the dedicated server can still observe connecting players' IP addresses.
 - Never publish your direct-connect address in a public message, screenshot, stream, or server listing.
 ## What an IP address can reveal
 A public IP address normally does **not** reveal an exact home address. It may reveal:
 - an approximate city or region;
 - an internet service provider;
 - whether several sessions appear to come from the same connection;
 - a destination that could be targeted with unwanted traffic or denial-of-service attempts.
 Location databases are frequently inaccurate, but an IP address should still be treated as private network information.
 ## Direct rooms
 Direct Connect and direct player-hosted rooms use peer-to-peer UDP networking. This has an unavoidable consequence: the operating system must know where to send the packets.
 Even when Straywild does not display or save an address, a person who controls their own computer may use network-inspection tools to identify the remote endpoint. Encoding or hiding the address in the interface cannot prevent this.
 When joining a direct room:
 - the host may be able to determine your public IP address;
 - you may be able to determine the host's public IP address;
 - other players normally connect through the host rather than directly to every participant, but you should not rely on this as an anonymity guarantee.
 Only join direct rooms hosted by people you trust.
 ## Public discovery rooms
 Room discovery and gameplay transport are separate systems. Discovery can help you find a room without making that room relayed.
 Before joining, check the connection notice:
 - **Relayed** means gameplay is routed through Straywild relay infrastructure. Other players should see the relay endpoint rather than your residential endpoint.
 - **Direct** means the host and client exchange traffic directly and can potentially determine one another's public IP addresses.
 - If no relay status is shown, assume the connection is direct.
 Never assume that selecting a room from a public list automatically provides IP privacy.
 ## Dedicated servers
 Joining a dedicated server does not expose the server operator's residential IP address because players connect to the server installation instead, granted **you are not hosting the dedicated server directly out of your home**. The server and its network provider can still observe the source address of each connection.
 Dedicated servers are generally the safer choice when you do not know the room host personally. Server operators should disclose their privacy and logging practices.
 Straywild does not require player-hosted rooms to retain chat history. Dedicated-server chat logging should be considered an explicit opt-in feature and must be disclosed to players when enabled.
 ## Using a VPN
 A reputable VPN is the most practical step a player can take to conceal a residential IP address during a direct session. Other participants will generally see the VPN server's address instead.
 Before relying on a VPN:
 1. Confirm that the VPN handles both IPv4 and IPv6. If it does not support IPv6, configure it to block IPv6 while connected.
 2. Enable the VPN's kill switch so the game does not silently return to the residential connection if the VPN disconnects.
 3. Connect the VPN **before** opening or joining an online room.
 4. Verify that your visible public IPv4 and IPv6 addresses belong to the VPN provider.
 5. Restart Straywild after changing VPN connections so old network sessions and NAT mappings are not reused.
 Avoid unknown free VPN services. A VPN provider can observe connection metadata, so using one transfers trust from your internet provider to the VPN provider rather than eliminating trust.
 ### Hosting through a VPN
 Hosting is more complicated than joining. The VPN must support:
 - inbound UDP connectivity;
 - port forwarding for the selected Straywild port;
 - stable forwarding for the duration of the room.
 Many consumer VPNs do not offer inbound port forwarding. If they do not, guests may be unable to connect. Do not disable your firewall or expose unrelated ports to work around this.
 ## Router and firewall precautions
 - Keep the router firmware and operating system updated.
 - Leave the operating-system firewall enabled.
 - Allow only the Straywild executable and required UDP port when hosting.
 - Do not place a gaming computer in a router DMZ.
 - Do not forward broad port ranges.
 - Remove manual forwarding rules when they are no longer needed.
 - Disable router remote administration from the internet unless you explicitly require and securely manage it.
 - Use a strong, unique router administration password.
 UPnP can create a temporary port mapping for a hosted room. It improves convenience, but it does not hide the host's public address. Review your router's UPnP settings if you do not want applications creating mappings automatically.
 ## Streaming and screenshots
 Before streaming or sharing screenshots:
 - hide the Direct Connect address field;
 - avoid showing saved-server details;
 - do not display router, VPN, terminal, or server-administration windows;
 - inspect logs before posting them publicly;
 - redact IPv4 addresses, IPv6 addresses, hostnames, join tokens, and authentication tokens.
 An IPv6 address can be much longer than an IPv4 address and may contain several groups separated by colons. Redact the entire value, not only the final group.
 ## If someone exposes or threatens your IP address
 1. Leave the room and close the game session.
 2. Save relevant chat messages or screenshots without reposting the exposed address publicly.
 3. Block the player and report the incident through the appropriate community channel.
 4. Restart your modem or router if your internet provider assigns a new address after reconnecting. This does not work with every provider.
 5. Contact your internet provider if you experience sustained unwanted traffic or loss of service.
 6. Do not retaliate, probe the other person's network, or publish their information.
 ## What Straywild can and cannot promise
 Straywild can minimize address exposure by keeping endpoints out of room lists, interfaces, saved data, and ordinary logs. Short-lived join tickets and relayed sessions can further reduce exposure.
 Straywild cannot make a direct network connection anonymous. If another player's machine sends packets directly to yours, both operating systems necessarily know the remote network endpoint. Real peer privacy requires a relay, VPN, or separately hosted server between the players.
 Connection behavior may evolve as online systems are improved. Always read the in-game connection notice and assume a connection is direct unless it is explicitly identified as relayed.