Can’t open ports? Use a tunnel

When you can’t forward ports, a tunnel such as playit.gg gives your server an address players can reach. Step by step, with your own account.

Last updated 13 November 2026

If you can’t open ports, because your provider puts you behind CGNAT or the router isn’t yours to change, a tunnel still gives your server an address players can reach. A small program on your machine keeps a connection open to the tunnel’s network, and players connect to that network. Your home address stays private. The price is a detour: players’ traffic passes through one of the tunnel’s datacenters on its way to you, so ping is a little higher than with a direct connection.

You run the tunnel with your own account at the tunnel’s service. Aperture doesn’t install it, run it or see its sign-in. Your panel shows the tunnel’s address as the server’s join address and tests it from the internet like any other.

Set up playit.gg

playit.gg is the usual choice for game servers and has a free plan. Open your server in the panel, go to Settings, then Ports, and choose Set up a tunnel. The panel shows these steps with the exact values for that server:

Make a playit.gg account, or use the one you have. A new account opens on a setup screen that asks where playit will run. You can leave it there: the link in step 3 does the same job.
Install playit on your machine. In a terminal on the machine, run playit’s installer:
```
curl -fsSL https://packages.playit.gg/install.sh | bash
```
It covers Debian, Ubuntu, Fedora, openSUSE and Alpine, and shows each command before it runs it. Press Enter to accept each one, and once more when it asks whether to start playit. For another system, use playit’s Linux downloads. If Aperture runs as a Docker app (Unraid), use playit’s Docker setup with host networking.
Link it to your playit account. The terminal now shows a link under “Open this link to finish setting up playit”. Open it in a browser where you’re signed in to playit; any device will do. Choose Continue, give the machine a name and choose Add Agent. From then on playit runs in the background and starts with the machine. The terminal shows its status window: press q, then y, to close it, and run playit to see it again.
Create a tunnel. On playit’s page choose Create a tunnel (later you’ll find it under Tunnels, then New Tunnel). Give it any name and pick the Tunnel Type the panel names for your game. Leave Public Endpoint on Global Anycast, the free choice. Under Origin Config set Local IP to 127.0.0.1 and Local Port to the port the panel shows, then choose Create Tunnel.
Paste the tunnel’s address into the panel and choose Save and test. playit shows the address at the top of the tunnel’s page, under “The public address of your tunnel”.

From then on the panel shows that address wherever it showed the old one, and the server page says whether players can reach it through playit.

These steps were walked through on a fresh Debian 13 machine with playit 2.0.2 on 13 November 2026. playit changes its site and installer from time to time; if a screen looks different, tell us.

Minecraft Bedrock

playit’s Bedrock tunnel carries RakNet connections only, and a new Bedrock server uses NetherNet. On playit, pick the tunnel type Minecraft Bedrock (RakNet) and tick the box that confirms it.

You don’t have to change the server yourself. When you save the tunnel’s address in the panel, Aperture sets transport=raknet in the server’s server.properties and asks you to restart the server. If you stop using the tunnel, it puts the old setting back. Both changes show up in the server’s activity log. Players join with the tunnel’s address and the port playit gives it.

Free and Premium on playit

This is what playit.gg listed in November 2026. playit sets its own plans and can change them, so check its pricing before you count on a detail.

Free	Tunnels for the games playit lists, among them Minecraft Java and Bedrock, Palworld, Terraria, Factorio, Valheim, 7 Days to Die, Hytale, Project Zomboid, Left 4 Dead 2, Necesse and Garry’s Mod, and plain UDP tunnels for other games. Players come in through playit’s worldwide network, and each player’s internet provider decides which of its datacenters they reach.
Premium	Plain TCP and TCP+UDP tunnels, which some games need (the panel says when yours does), a region you choose for the tunnel, your own domain or a `.playit.plus` name, and more ports. playit marks Premium tunnel types with a heart.

On either plan, paste whichever address playit gives the tunnel. A free address, a .playit.plus name and your own domain all work the same way in the panel.

playit’s datacenters are in North America, Europe, India, Japan, Brazil, Chile and Australia. It has none in the Middle East or Africa, so players there come in through Europe or India and see a higher ping.

Another tunnel, or your own domain

Any service that gives a port on your machine a public address works, and so does a domain of your own that leads to your machine. In the same place in the panel choose Something else, have the tunnel send players to 127.0.0.1 and the server’s port, and paste the public address. Aperture needs an address the whole internet can reach and, except for a Minecraft Java name, its port.

Good to know

A tunnel works only while your machine, the tunnel’s program and the game server are all running.
The game sees players arrive from the tunnel’s program and not from their own addresses, so banning by IP address doesn’t work the usual way.
To go back, choose Stop using it in the same place. Players then use your machine’s own address again.
playit.gg is a separate service run by Developed Methods LLC. Aperture isn’t part of it or affiliated with it. Your playit account, your tunnels and any Premium plan are between you and playit, under playit’s terms.