The Stoke tunnel

The Stoke tunnel is a private network that runs inside Stoke itself. Players come in through it by account, and reach your game servers’ ports and nothing else. You forward one UDP port, once, for every server you’ll ever make.

It’s built on WireGuard, the fast, modern VPN protocol, running entirely inside Stoke’s container. There’s nothing to install on the host, no kernel module, and no extra container rights.

Why use it

• One port for everything. No forwarding a new pair of ports for each server.
• Only your players get in. Each player is let in by their account, and the game ports stay closed to everyone else.
• Only the games are reachable. Players on the tunnel reach the game servers’ ports, not the panel’s machine or the rest of your network.
• Voice comes along too. Players on the tunnel need no separate port for voice chat.

Turning it on

1. In the panel, open Settings → Reaching Stoke and choose the Stoke tunnel for how players reach the game. Its checklist ticks itself as each step is done.

2. Publish its UDP port from the container (51820 unless you change it). In compose.yaml:

       ports:
         - "51820:51820/udp"

   then docker compose up -d.

3. Forward that one UDP port on your router to the machine running Stoke.

4. Let players in: a player gets on the tunnel once they have access to a server.

For players

• With the Stoke launcher (Valheim), there’s nothing to do: it connects through the tunnel by itself when you play.
• Joining by hand (Minecraft players today, or anyone not using the launcher): on your server’s page in the panel, Your connection gives each of your devices a config. Install the WireGuard app, add the config to it (or scan its QR code on a phone), turn it on, then join as the page says.

Every game, through the launcher. Today the launcher connects through the tunnel for Valheim. Minecraft is next, and from here on, every game Stoke adds gets it as standard: launch through Stoke, and you’re on the tunnel without setting anything up.

Caution

A device’s config holds its own key. Don’t share it: if one goes astray, make a new key for that device from Your connection.

Players at home

Players on the same network as the panel’s machine don’t need the tunnel. Set the machine’s address on your home network in Settings → Reaching Stoke, and Stoke gives them that address instead, so they join directly.

---

WireGuard is a registered trademark of Jason A. Donenfeld. The Stoke tunnel is built on WireGuard; it isn’t WireGuard, or made by its authors. See Notices for the licenses of what it uses.