Hosting Over The Internet

On a home network, players join by typing your local address and it simply works. Over the internet you have to let traffic in, and the whole job is one port, a second if you want secure connections, and a firewall.

The ports

One port does it. A console page and the live game connection it opens both arrive on 1864, so a forward that lets the page load also lets the console come alive. Older releases put the live connection on separate ports, 1865 and 1867. Nothing listens on those any more, and the port numbers on the <websockets> line in config.xml no longer do anything.

Port 1866 uses a self‑signed certificate that ships with the game, so a browser warns about it the first time. That warning is expected; accept it to go on.

The server also answers a discovery broadcast on UDP port 1864, so a dedicated client machine on the same local network can find it without being told the address. It has no use over the internet, and there is nothing to forward for it.

1. Forward the ports on your router

Every router's interface differs, but the setting is called Port Forwarding, sometimes under a "virtual servers" or "NAT" heading. Add one entry:

• External port: 1864
• Internal port: 1864
• Protocol: TCP
• Internal address: the local IP of the machine running Horizons

Add a second entry for 1866 the same way if anyone will connect securely.

The server shows its local address when it starts — that is the one to use. Give that machine a static or reserved address in your router's DHCP settings while you are in there; otherwise it will get a different one eventually and the forward will quietly point at nothing.

2. Let the host machine's own firewall through

The router forward gets traffic to the machine. The machine's firewall still has to accept it. On Windows, allow Horizons through Windows Defender Firewall on both private and public networks, or add inbound TCP rules for 1864 and 1866.

Third‑party security software is the usual culprit when the router is right and it still does not work — some suites silently block unrecognized listening programs. Check any antivirus or "network protection" feature separately from the Windows firewall.

3. Find your public address

Your local address means nothing to someone outside your network. Visit whatismyip.com and note the IPv4 address it reports. The game window shows it too: its settings, under Network, list the public address the server looked up when it started.

Most home connections change this address from time to time, so check it again before each session rather than reusing last week's link. If you host often, a dynamic DNS name saves you the trouble.

4. Share the link

http://203.0.113.45:1864/

The :1864 is not optional — without it the browser tries port 80 and gets nothing. Players see the same station selection page as everyone else.

Checking it from outside

Testing your public address from inside your own network is unreliable: many routers will not route a connection back to themselves, so it can fail while working perfectly for everyone else. Ask someone outside your network to try it, or use a phone on mobile data with Wi‑Fi turned off.

Things that catch people out

• Two routers. A router behind an ISP modem‑router means two sets of forwards. Forward on both, or put one in bridge mode.
• Carrier‑grade NAT. Some ISPs, especially mobile and some fiber providers, do not give you a real public address at all — port forwarding cannot work and no amount of configuration will change it. If your router's WAN address is in the 100.64–100.127 range, this is your situation. A VPN between players, or hosting elsewhere, is the way round it.
• Upstream bandwidth. Consoles are lightweight, but the host is serving every one of them. A weak upload will show as consoles lagging behind the simulation rather than as a failure to connect.
• Handing out an admin station. Anyone who reaches your server can choose any visible station, including Game Master. Over the internet, that is a stranger with your session controls. There is no per‑station password: treat the link as the credential and only share it with your players. The same goes for Hydra Studio, which edits your modules' content.