The reliable way to make a Vintage Story server private is to combine four controls: leave whitelist protection enabled, add every permitted account, optionally require a password, and turn off public server advertisement. Then expose only the network path your friends need: a LAN address for people in the same home network, or TCP and UDP port 42420 for remote players. A LAN-opened single-player world and a persistent dedicated server use different privacy and networking steps.
Playing with friends? Godlike.Host runs hosted Vintage Story servers from 10 data-center locations, with free DDoS protection.
Choose the right hosting mode first
Your privacy setup depends on whether you are opening one world for a short session or operating a server that remains available. Decide this before changing router or firewall settings.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
Open a single-player world to LAN
Opening a world to LAN is the simplest option for people playing on the same home or office network. The world is reachable only from that local network unless you deliberately use the game’s internet-opening feature or add network forwarding yourself. This is appropriate for a temporary session or same-household play, and it normally requires little or no router administration.
LAN-opened worlds do not receive the dedicated-server whitelist behavior that applies by default from game version 1.20 onward. Do not assume that a LAN session has the same account-level controls as a dedicated server; treat the local network boundary as its primary restriction and check the available in-game settings before inviting anyone.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Run a dedicated self-hosted server
A dedicated server is the better fit for a persistent or 24/7 world. It can accept connections from the local network and, when configured, from the wider internet. From version 1.20 onward, dedicated servers use whitelisting by default, giving you an account-level gate in addition to any network controls.
Self-hosting gives you control over the server configuration, player access and advertisement setting, but you are responsible for the host computer, operating-system firewall and (for remote players) router forwarding.
Use managed hosting when you cannot administer the network
Paid monthly hosting is an alternative noted in the official dedicated-server guidance. A host generally handles the always-on machine and much of the network administration, while you still configure Vintage Story’s whitelist, password and advertisement settings in its control panel or server files. Availability, limits and pricing vary, so select a service only after checking its current terms; no provider is required to follow the privacy procedure in this guide.
Privacy options compared
| Option | Reach | Privacy controls | Network work | Best for |
|---|---|---|---|---|
| Open to LAN | Players on the same local network | LAN-world behavior; dedicated-server whitelist defaults do not automatically apply | Little or none | Temporary, same-household sessions |
| Dedicated self-hosted server | LAN or internet | Whitelist, optional password and advertisement control | Firewall rules and, for remote play, TCP/UDP 42420 forwarding | Owners who want configuration control |
| Managed hosting | Internet, usually continuously available | Provider panel plus the same Vintage Story settings | Provider handles most infrastructure | Players who want uptime without router administration |
Make a dedicated server private: the complete setup
The following sequence keeps the strongest access control in place before you make the server reachable. Perform it on the machine running the dedicated server, using its console or configuration file as indicated.
1. Confirm the installed game version
Version matters because the whitelist setting name changed. On version 1.20 and later, use WhitelistMode and the player whitelist command described below. On versions before 1.20, the older OnlyWhitelisted setting is used. The official guide identifies OnlyWhitelisted as obsolete on 1.20 and later, so do not copy a pre-1.20 configuration name into a current server and expect it to control access.
2. Leave whitelist protection enabled
A dedicated server running version 1.20 or later uses whitelisting by default. Keep that protection enabled; do not switch it off simply because you also plan to use a password. The official dedicated-server guide describes disabling whitelist mode as risky and says whitelist protection is significantly more secure than relying on a password alone.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAdd each permitted player explicitly from the server console. Replace username with the exact in-game account name:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
/player username whitelist onAdd the host account as well if the host will play through the same server. The server does not need to restart after adding an individual player, so you can invite friends once their entries have been accepted.
- Use the player’s exact in-game username, including capitalization where the account system distinguishes it.
- Add only people who should be able to join; being able to discover the address is not enough to bypass the whitelist.
- Keep the whitelist enabled after testing. Turning it off changes the server from an account-approved group to a password- or address-dependent service.
3. Add a second barrier with a password
A password is optional but useful when you want two independent checks. Edit serverconfig.json and set the Password value, for example:
"Password": "use-a-unique-secret",You can also set it from the server console with:
/serverconfig password <password>Give the password only to the people on your whitelist, and use a secret that is not reused for another service. Friends enter it in the password field of their server entry. A password does not replace the whitelist: retain both controls when the goal is a closed friend server.
4. Turn off public advertisement
Prevent the server from being placed in the public server listing by disabling advertisement:
/serverconfig advertise 0Use the equivalent advertisement value in the configuration file if you manage settings there. With advertisement disabled, friends should add the server manually rather than selecting it from a public list. Give them the direct host address and port through a private channel.
Advertisement control reduces casual discovery; it is not an access-control mechanism. Someone who learns the address can still attempt to connect, which is why the whitelist and, if desired, password must remain active.
5. Decide whether each player is local or remote
Players on the same home network can connect through the host computer’s LAN address after the world or dedicated server is available. They do not need the public internet address, and they normally do not require router port forwarding.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Players outside that network need an internet path. Vintage Story can attempt to open the server to the internet through UPnP, depending on the router and network. If that attempt fails or is unavailable, configure forwarding manually. The official guidance identifies the default game port as 42420 and calls for both TCP and UDP forwarding.
6. Forward TCP and UDP 42420 when manual networking is required
In the router’s port-forwarding page, create a rule that sends external port 42420 to port 42420 on the host computer’s local address. Create rules for both protocols:
| Protocol | External port | Destination port | Destination |
|---|---|---|---|
| TCP | 42420 | 42420 | The dedicated-server host’s LAN address |
| UDP | 42420 | 42420 | The dedicated-server host’s LAN address |
Router interfaces use different labels, so consult the documentation for your particular model for the exact menu path. Reserve or otherwise keep the host’s local address stable if your router supports that feature; otherwise a later address change can leave the forwarding rule pointing at the wrong computer.
Forward only the required game port. Do not expose administrative services or unrelated ports just to make the game connect.
7. Allow the same port through the host firewall
The operating system can block inbound traffic even when the router rule is correct. Allow inbound TCP 42420 and UDP 42420 in the firewall on the computer running the server. The dedicated-server guide provides examples for firewalld, iptables and ufw; use the commands appropriate to your operating system and firewall rather than combining rules from different systems.
- Permit TCP 42420.
- Permit UDP 42420.
- Apply the rule to the network profile used by the host.
- Leave other inbound services closed unless you have a separate, specific reason to expose them.
If the host firewall has a prompt for the dedicated-server executable, allowing that application may be necessary in addition to explicit port rules. After changing firewall settings, restart or reload the firewall according to the operating system’s normal procedure.
8. Give friends the correct connection details
For a LAN player, provide the host’s local-network address and the server port. For a remote player, provide the internet-facing address and port 42420. Have everyone add the server manually because advertisement is disabled. Share the address and password only with the intended group; hiding the listing does not make the address harmless if it is posted publicly.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
9. Test in layers instead of changing everything at once
- Join from the host or the same local network with a whitelisted account.
- Test a second whitelisted account on the same network.
- Test a remote account only after the local test succeeds and forwarding and firewall rules are active.
- Confirm that a non-whitelisted account is refused, which verifies that the principal privacy control is actually working.
- Confirm that the server is not appearing in the public listing after advertisement has been disabled.
Testing in this order tells you whether a failure is an account setting, a local firewall issue or an internet-routing problem.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How the privacy controls work together
Whitelist: identity-based admission
The whitelist answers “which accounts may join?” It is the primary control for a private friend server because it remains effective even if the address becomes known. On current dedicated servers, each permitted account must be added explicitly.
Password: shared-secret verification
The password answers “does the connecting player know the shared secret?” It is useful as a second barrier, but everyone who receives it can share it onward. That is why it should supplement, not replace, the whitelist.
Advertisement: discovery reduction
Advertisement answers “should this server be shown in the public listing?” Turning it off removes an easy discovery route but does not reject connection attempts. Treat the direct address as private information.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Network boundaries: who can reach the service
LAN-only play restricts reach to the local network. Internet play requires an open path through UPnP or manual forwarding and firewall rules. Network reachability and account authorization are separate decisions: a server can be reachable from the internet while still refusing every account that is not whitelisted.
Common problems and precise fixes
The server appears in the public list
Check the advertisement setting and set it to off with /serverconfig advertise 0. Allow time for the listing state to update, then have friends add the server manually. Do not respond by disabling the whitelist; advertisement and admission are separate settings.
A friend receives a whitelist or authorization error
Verify that the exact in-game username was added with /player username whitelist on. Check that the command was issued on the intended server, not a different console or test instance. If the server predates version 1.20, use its older OnlyWhitelisted configuration model rather than assuming the current setting names apply.
LAN players connect, but remote players cannot
This pattern usually means the game itself is running but the internet path is incomplete. Check, in order:
- Whether UPnP or the game’s internet-opening attempt succeeded.
- Whether the router forwards both TCP and UDP 42420 to the correct host address.
- Whether the host firewall permits both protocols on port 42420.
- Whether the remote player is using the internet-facing address rather than the host’s LAN address.
Router forwarding cannot correct a blocked host firewall, and a firewall rule cannot correct a forwarding rule aimed at the wrong computer.
The password is rejected
Check the value in serverconfig.json or reset it from the console with /serverconfig password <password>. Ensure friends enter the current value in the server entry’s password field and that no extra spaces were included when sharing it. Changing a password is a separate action from changing the whitelist; existing account entries are not a substitute for the new secret.
The host can connect, but no one else can
Confirm that the dedicated server is listening on the expected port and that the host firewall permits inbound traffic. Then verify the router’s destination address. A local test from the host does not prove that remote forwarding works, so perform a test from outside the home network after the local checks pass.
The configuration seems ignored after an upgrade
Review the installed version and configuration names. OnlyWhitelisted belongs to pre-1.20 servers; current servers use WhitelistMode and the player whitelist command. Do not leave an obsolete setting in place and assume it still governs a 1.20-or-later server.
Recommended Free Tools
Operational practices for a private server
- Keep a private record of the approved usernames so you can audit who should have access.
- Share the server address and password only with the intended group.
- Open only TCP and UDP 42420 on the router and host firewall.
- Review whitelist entries when the group changes instead of handing out a new password to everyone.
- Recheck the version-specific configuration after an update, especially when moving across the 1.20 boundary.
- Do not treat an unlisted server as anonymous; an exposed address can still be scanned or attempted.
When managed hosting is the better choice
Self-hosting is practical when you control the router and can keep the server computer available. Managed hosting becomes attractive when the world needs continuous uptime, the host is behind a restrictive network, or nobody in the group wants to maintain firewall and port-forwarding rules. The privacy model does not change: configure the Vintage Story whitelist, add the optional password, disable public advertisement, and distribute the connection details privately. Confirm what access the hosting provider’s panel gives you before committing, because provider interfaces and network capabilities differ.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
