"Come in, come in, and know me better Man."

It's been a bit since I have posted. Life is always going and there is so much to learn. I have been learning more about AI and infrastructure surrounding it for work. I have been using it a bit more both there and at home. I have even played with coding some apps and my own agent harness and interface.

There are ups and downs. It is certainly an interesting (and often frustrating) process. There are some things it can be very helpful with though. One of them is planning and documentation. This walkthrough is a testament to that. I had to guide it and steer it, and double check it and I believe I got it to what I needed.

I am a gamer, and I have several I have always wanted to host in a more persistent way. With my homelab setup, I finally have a chance to do that. In this case 7 games I play semi regularly and a couple of demo hosts I am able to take advantage of that I destroy and rebuild n a regular basis. This wasn't all done at once for me, but I have enough documented steps now from various places to make it work. And I thought this would be a good chance to share a walkthrough here.

Prerequisites

• You need an OCI VPS (it can be small its just going to run a couple of things)
• You Need NGINX acting as a reverse Proxy for your on prem stuff
• You need some place to run your self hosted infrastructure (this can be in the cloud as well, but I am set up at home)
• You need a domain, and you need a DNS Provider. I use Cloudflare for these.

Steps

1. The first step is to follow Thomas Wildes guide here It's very thorough, and easy to follow. It was the first step for me in creating a way to securely serve internal apps to the outside world.
2. You may want to set up some vLANs on network segregation to keep your Game server(s) separated from the rest of your network. I am also using a Proxmox cluster and virtualization for even further separation.
3. You will want AMP server for this walkthrough. Yes I use this and paid for it. You will also see I have 4 instances of the amp server running. One runs in Hybrid mode and acts as the ADS(AMP Deployment Server) and as a game host, and the other three act as target hosts. This lets me control all of my game instances and hosts from a single AMP instance that can be passed through my tunnel.
4. I also use VSCode to do most of my editing. Particularly for my OCI VPS as it give me a nice visual picture of the file structure. But feel free to just SSH using a key and VIM or NANO if you are more comfortable there.

What is this?

Below is the outline and steps the LLM and I cam up with to ensure the games I wanted to run would work. You would of course modify this for whatever games you want to run, but the general idea is a good solid guide with all the right steps in place to show a clear picture of how to do this. When set up correctly you have security, multiple layers of segregation and isolation. A single management panel and TLS security for access to that. And a game or game cluster to share with your friends and family.

📋 HybridCloudHQ — Game Server Master Reference

1 — Cluster Hardware

2 — Node Role Map

3 — Master VM Table

4 — Master Port Reference

4.1 — Game Ports (Internet Exposed via Pangolin)

4.2 — Admin Ports (LAN/VPN Only — never through Pangolin)

5 — OCI VPS Setup

5.1 Security List Ingress Rules

Navigate: Networking → VCN → Security Lists → Default Security List Source CIDR: 0.0.0.0/0 for all game ports. Do not add SFTP or RCON ports.

• [ ] TCP 7777 — Conan game (TCP required alongside UDP)
• [ ] UDP 7777 — Conan game
• [ ] UDP 7778 — Conan pinger
• [ ] UDP 27015 — Conan Steam query
• [ ] TCP 15637 — Enshrouded query
• [ ] UDP 15637 — Enshrouded query
• [ ] UDP 2456 — Valheim game
• [ ] UDP 2457 — Valheim query
• [ ] UDP 9876 — V Rising game
• [ ] UDP 9877 — V Rising query
• [ ] UDP 7780 — Return to Moria game
• [ ] TCP 25565 — Minecraft Java
• [ ] UDP 25565 — Minecraft Java
• [ ] UDP 7779 — RuneScape: Dragonwilds
• [ ] TCP 443 — Pangolin HTTPS
• [ ] TCP 80 — Pangolin HTTP redirect

5.2 OCI VPS iptables

# TCP game ports
sudo iptables -I INPUT 6 -p tcp -m multiport \
  --dports 80,443,7777,15637,25565 -j ACCEPT

# UDP game ports
sudo iptables -I INPUT 6 -p udp -m multiport \
  --dports 7777,7778,7779, 7780,2456,2457,9876,9877,15637,25565,27015 -j ACCEPT

# Persist
sudo netfilter-persistent save

# Verify
sudo iptables -L INPUT -n -v --line-numbers

6 — Pangolin Setup

6.1 traefik_config.yml — Add Under entryPoints:

File: /opt/pangolin/config/traefik/traefik_config.yml

entryPoints:
  # Pangolin system — do not modify existing entries
  websecure:
    address: :443
  web:
    address: :80

  # Conan Exiles — TCP AND UDP 7777, no remapping ever
  tcp-7777:
    address: :7777/tcp
  udp-7777:
    address: :7777/udp
  udp-7778:
    address: :7778/udp
  udp-27015:
    address: :27015/udp

  # Enshrouded — query port TCP + UDP
  tcp-15637:
    address: :15637/tcp
  udp-15637:
    address: :15637/udp

  # Valheim
  udp-2456:
    address: :2456/udp
  udp-2457:
    address: :2457/udp

  # V Rising
  udp-9876:
    address: :9876/udp
  udp-9877:
    address: :9877/udp

  # Return to Moria — internal port also 7780 (changed in AMP)
  udp-7780:
    address: :7780/udp
  tcp-7780:
    address: :7780/tcp

  # Minecraft
  udp-25565:
    address: :25565/udp

  # RuneScape: Dragonwilds — internal port also 7785 (AMP launch flag)
  udp-7779:
    address: :7779/udp

  # SFTP ports — NOT added here (LAN/VPN access only)
  # Dune: Awakening — NOT added here (PTC server-list discovery only)

6.2 docker-compose.yml — Add Under services: gerbil: ports:

File: /opt/pangolin/docker-compose.yml

    ports:

      - 443:443
      - 80:80
      # Conan Exiles — both TCP and UDP 7777 required
      - 7777:7777/tcp
      - 7777:7777/udp
      - 7778:7778/udp
      - 27015:27015/udp
      # Enshrouded
      - 15637:15637/tcp
      - 15637:15637/udp
      # Valheim
      - 2456:2456/udp
      - 2457:2457/udp
      # V Rising
      - 9876:9876/udp
      - 9877:9877/udp
      # Return to Moria
      - 7780:7780/udp
      - 7780:7780/tcp
      # Minecraft
      - 25565:25565/udp
      # RuneScape: Dragonwilds
      - 7779:7779/udp
      # SFTP NOT mapped here — LAN/VPN only
      # Dune: Awakening NOT mapped here — server-list only

This is what I mean by easy for me to visualize the editing here

6.3 Apply and Verify

cd /opt/pangolin
docker compose up -d
docker compose restart traefik

# Check UDP listeners
ss -lunp | grep -E '7777|7778|7779|7780|2456|2457|9876|9877|15637|25565|27015'

# Check TCP listeners — 7777 and 15637 are both TCP now
ss -ltnp | grep -E '7777|15637|443|80'

# Check Traefik — no crash loops, no "address already in use"
docker ps
docker logs traefik --tail=50

6.4 Pangolin Raw TCP/UDP Resources

Create one resource per row. Do not create resources for SFTP or RCON ports.

7 — AMP Installation & Configuration

7.1 AMP Install Command (all AMP VMs)

sudo su
bash <(wget -qO- getamp.sh)
# Prompts:
#   Username / password → set strong credentials
#   Docker isolation    → YES  ← critical
#   HTTPS               → No  (NGINX handles TLS)

Apply licence key in the web UI at http://<vm-ip>:xxxx → restart when prompted.

7.2 AMP Instance Registry

7.3 Critical AMP Port Configurations

Return to Moria — Must Remap From Default 7777

AMP → Moria01 → Configuration → Network:

ListenPort    = 7780
AdvertisePort = 7780

Restart instance after saving. Verify in instance logs that it reports binding to 7780.

There was also a challenge here getting everything to apply 100% correctly so I edited the MoriaServerConfig.ini directly and imported the config to AMP to ensure it grabbed all of the settings (advertise address and advertise port were the most important here as it was hitting my home internet public IP and I needed it to hit the IP of the AMP host.)

[Host]
ListenAddress=0.0.0.0
ListenPort=7780
AdvertiseAddress=[your.host.ip.address]
AdvertisePort=7780
InitialConnectionRetryTime=60
AfterDisconnectionRetryTime=600

If the instance ever resets to defaults: re-apply the above and restart.

RuneScape: Dragonwilds — Must Remap From Default 7777

AMP → Dragonwilds01 → GenericModule → Launch Parameters, add:

-port=7779

Restart instance after saving.

If the instance ever resets to defaults: re-apply the above and restart.

Minecraft Java — JVM Heap & GC Flags

AMP → Minecraft01 → Java Settings → Memory: Min 4 GB / Max 10 GB

JVM Arguments:

-XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+DisableExplicitGC -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1

8 — Demo & Conditional VMs (PVE2)

VMID 300 — openshift-sno (Ephemeral)

qm start 300    # verify 107 and 301 are stopped first
qm shutdown 300

VMID 301 — azure-local-demo (Ephemeral)

qm start 301    # verify 107 and 300 are stopped first
qm shutdown 301

VMID 107 — dune-awakening (Conditional)

qm start 107    # verify 300 and 301 are stopped first
# Stop the instance in AMP first for graceful world save, then:
qm shutdown 107

9 — Operational Gotchas & Tips

ssh <vm-ip> 'vmstat -s | grep swap'

10 — Quick Reference Commands

Verify Game Ports (OCI VPS)

# UDP game ports
ss -lunp | grep -E '7777|7778|7779|7780|2456|2457|9876|9877|15637|25565|27015'

# TCP game ports — 7777 and 15637 are both TCP
ss -ltnp | grep -E '7777|15637|25565|443|80'

Pangolin

cd /opt/pangolin
docker compose up -d
docker compose restart traefik
docker logs traefik --tail=50    # Check for errors
ss -lunp | grep <port>           # Verify a specific port

VM Lifecycle

qm start <VMID>
qm shutdown <VMID>
qm status <VMID>
qm migrate <VMID> <target-node> --online
qm snapshot <VMID> <name> "<description>"
qm listsnapshot <VMID>
qm rollback <VMID> <snapname>

AMP

ampinstmgr status
ampinstmgr startall
ampinstmgr stopall
journalctl -u ampinstmgr -f

11 — Game Server Status Summary

Here is what you wind up with. I think it's fantastic.

Anyway, I hope it help someone, and as always wishing you all the best.