## Fix: players keep getting kicked mid-game (auth cache TTL)
**Root cause**: the auth cache (`AuthCacheService`) has a 10-min TTL but `CreatedAt` was only set when the token was created — never refreshed while the player was actually connected. After ~12 min, the cleanup timer would expire the port entry, fire `OnPortExpired` → return the port to the pool → stop the delta UDP listener → the active player got force-disconnected ("Server shutting down" in the logs).
**What I changed**:
- `AuthCacheService`: added a `_confirmedPorts` set + `ConfirmPort()`. Cleanup now **skips confirmed (actively connected) ports** — as long as the player is connected, the port lease is never cleared.
- `ClientManager`: calls `_authCache.ConfirmPort(deltaPort)` right after `_portPool.ConfirmPort()` when the port matches, so an active session is marked confirmed.
- Port is still properly released on disconnect (existing `RemoveByPort` path untouched).
---
## Change: hide the default UDP port, use last delta port as default
**Why**: the well-known default port (my config: 22023) was getting flooded with garbage UDP. So now the server reserves the **last port** of the delta range as the main listener, so the default game socket is never the obvious 22023, and even if the pool is fully allocated, the server still runs.
**What I changed**:
- `ServerConfig`: new option `ReserveLastDeltaPortAsDefault` (default true).
- `PortPoolService`: `DefaultPort` = last delta port (`DeltaPortEnd`) when enabled; pool excludes it.
- `MatchmakerService`: main UDP listener binds to `DefaultPort` instead of `ListenPort`.
- `GamesController`: fallback port in `GetDeltaPort()` uses `DefaultPort`.
---
## Change: Filtaur-style line-speed UDP packet filter
**What I changed**: new `UdpPacketFilter` in Hazel + hooked into `UdpConnectionListener.ProcessData`. It drops junk at line speed before it reaches the game server:
- size check (min/max length),
- send-option byte check (layer-7),
- per-IP connection burst limit + temporary blacklist (default 30 burst / 60s blacklist).
Only applies to **unknown endpoints** (new connection attempts); established connections are never filtered, so in-game traffic is unaffected. This is the "filtaur" idea — force spammers through overhead and drop bad packets fast so they can't overload the server and drop everyone.
---
## Config (config.json)
Added `"ReserveLastDeltaPortAsDefault": true` under `Server`.
▎
▎ On HTTP authentication (POST /api/user), the server allocates a unique UDP port from a configurable pool
▎ (DeltaPortStart–DeltaPortEnd). The port acts as a nonce — when the client connects via UDP to that specific port,
▎ the server matches the connection to the authenticated PUID and FriendCode. This replaces unreliable IP-based
▎ matching, especially for players behind NAT/CGNAT.
▎
▎ - PortPoolService — thread-safe port pool with 5-minute auto-recycle if no connection arrives
▎ - IDeltaListenerManager — starts/stops UDP listeners on allocated ports (implemented by Matchmaker)
▎ - IFirewallService — UFW / firewalld / noop backends that automatically open/close firewall rules for allocated
▎ ports
▎ - Falls back to IP-based matching when the pool is exhausted or the feature is disabled (DeltaPortStart: 0)
▎ - TokenController returns both Port and Hash (matchmakerToken) to the client in the auth response
linmeideli