Load Balancing Security Concern
Options
JPGOrdon
✭
After reading the docs, I have a potential security concern regarding how game servers register them selves. It seems like the master server automatically accepts all game servers who attempt to register them selves, and, there is no way to authenticate this action.
If I am able to launch additional game servers with my master server running, then can't any other person with my master server IP able to do the same? Am I not understanding how the game servers register themselves?
If I am able to launch additional game servers with my master server running, then can't any other person with my master server IP able to do the same? Am I not understanding how the game servers register themselves?
0
Comments
-
hey, hey @JPGOrdon
yes, the concern is correct. That is why we setup listener in such a way that it listens only on internal IP. External is not accessible. Also you could implement something like IP 'white' list. Another options is token auth between game servers and master. The idea is that GS and Master share one secret key and GS sends something encrypted using that secret key. If master able to decrypt request it allows GS to connect. that is it
best,
ilya0 -
hey, hey @JPGOrdon
yes, the concern is correct. That is why we setup listener in such a way that it listens only on internal IP. External is not accessible. Also you could implement something like IP 'white' list. Another options is token auth between game servers and master. The idea is that GS and Master share one secret key and GS sends something encrypted using that secret key. If master able to decrypt request it allows GS to connect. that is it
best,
ilya
I understand that both the master server and game server are listening to only internal IP addresses in the load balancing setup, given that they are running on the same machine. In a real-world scenario involving a master server and GS with separate IPs, I would change the MS listeners to listen specifically for my game server(s). Would I have to change the listener on my game server, too, to handle connections properly? Why does the game server also have a wild-card IP?
Also, is there a way to list multiple acceptable IP addresses for the IPAddress value? The documentation neglects this.0 -
in every data center you machine has internal and external interface. If you are not going to use different data centers than you are fine.
no there is not way to have multiple IPAddresses.
best,
ilya0
