diff --git a/flake.nix b/flake.nix
index 6f08a88..9138cbf 100644
--- a/flake.nix
+++ b/flake.nix
@@ -130,7 +130,8 @@
     } // {
       inherit (pkgs)
         steamworks-sdk-redist
-        systemd-transparent-udp-forwarderd;
+        systemd-transparent-udp-forwarderd
+        force-bind;
     });
 
     apps = eachSystem (system: import ./lib/apps {
diff --git a/lib/pkgs/default.nix b/lib/pkgs/default.nix
index 2403e2e..aebf517 100644
--- a/lib/pkgs/default.nix
+++ b/lib/pkgs/default.nix
@@ -3,6 +3,7 @@ self: super: {
   mkSteamPackage = import ./mk-steam-package.nix self super;
   mkSteamWrapper = import ./mk-steam-wrapper.nix self super;
   systemd-transparent-udp-forwarderd = import ./systemd-transparent-udp-forwarderd.nix self super;
+  force-bind = import ./force-bind-seccomp.nix self super;
   steamworks-sdk-redist = import ./steamworks-sdk-redist.nix self super;
   palworld-server = import ./palworld-server.nix self super;
 }
diff --git a/lib/pkgs/force-bind-seccomp.nix b/lib/pkgs/force-bind-seccomp.nix
new file mode 100644
index 0000000..fd5951f
--- /dev/null
+++ b/lib/pkgs/force-bind-seccomp.nix
@@ -0,0 +1,55 @@
+self: pkgs @ {
+  stdenv,
+  autoPatchelfHook,
+  fetchFromGitHub,
+  writeText,
+  ...
+}:
+
+let
+  makefile = writeText "Makefile" ''
+    TARGETS = force-bind target-mkdir target-bind parent-socket-activate
+
+    all: $(TARGETS)
+
+    force-bind: main.c scm_functions.c
+    	$(CC) $(CFLAGS) -o $@ $^
+
+    parent-socket-activate: parent_soocket_activate.c
+    	$(CC) $(CFLAGS) -o $@ $^
+
+    target-mkdir: target_mkdir.c
+    	$(CC) $(CFLAGS) -o $@ $^
+
+    target-bind: target_bind.c
+    	$(CC) $(CFLAGS) -o $@ $^
+
+    .PHONY: all
+  '';
+in stdenv.mkDerivation rec {
+  pname = "force-bind";
+  version = "0.0.1-4867c53";
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = with self; [ stdenv.cc.cc.lib stdenv.cc.libc.linuxHeaders ];
+  buildPhase = "make";
+
+  src = fetchFromGitHub {
+    owner = "kitten";
+    repo = "force-bind-seccomp";
+    rev = "0df29fbbe20f5c191c3b76951af090ab60d533e8";
+    sha256 = "sha256-SWdPacxJ2WmB+8b8uVpxrnlLuH3wAvFIDyfBclh0a/4=";
+  };
+  postPatch = ''
+    cp ${makefile} Makefile;
+  '';
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 force-bind "$out/bin/$pname"
+    install -Dm755 target-bind "$out/bin/$pname-test-target-bind"
+    install -Dm755 parent-socket-activate "$out/bin/$pname-test-socket-activate"
+    runHook postInstall
+  '';
+
+  meta.mainProgram = pname;
+}
diff --git a/lib/pkgs/mk-steam-wrapper.nix b/lib/pkgs/mk-steam-wrapper.nix
index 5710d73..4664139 100644
--- a/lib/pkgs/mk-steam-wrapper.nix
+++ b/lib/pkgs/mk-steam-wrapper.nix
@@ -37,12 +37,7 @@ let
       runpaths = libs ++ optionals useBox64 nativeLibs;
       combinedEnv = optionalAttrs useBox64 {
         BOX64_LOG = logLevel;
-        BOX64_DYNAREC_STRONGMEM = 1;
-        BOX64_DYNAREC_BIGBLOCK = 1;
-        BOX64_DYNAREC_SAFEFLAGS = 1;
-        BOX64_DYNAREC_FASTROUND = 1;
-        BOX64_DYNAREC_FASTNAN = 1;
-        BOX64_DYNAREC_X87DOUBLE = 0;
+        BOX64_DYNAREC_STRONGMEM = 0;
       } // env;
     in bin:
       stdenv.mkDerivation rec {
diff --git a/lib/pkgs/systemd-transparent-udp-forwarderd.nix b/lib/pkgs/systemd-transparent-udp-forwarderd.nix
index 95a0b56..29819dd 100644
--- a/lib/pkgs/systemd-transparent-udp-forwarderd.nix
+++ b/lib/pkgs/systemd-transparent-udp-forwarderd.nix
@@ -1,4 +1,4 @@
-pkgs @ {
+self: pkgs @ {
   stdenv,
   cmake,
   pkg-config,
@@ -7,7 +7,7 @@ pkgs @ {
   ...
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "systemd-transparent-udp-forwarderd";
   version = "0.0.1-add-activity-timeout-shutdown";
   nativeBuildInputs = [ cmake pkg-config ];
@@ -24,4 +24,6 @@ stdenv.mkDerivation {
     install -Dm755 systemd-transparent-udp-forwarderd "$out/bin/$pname"
     runHook postInstall
   '';
+
+  meta.mainProgram = pname;
 }
diff --git a/machines/ramune/configuration.nix b/machines/ramune/configuration.nix
index f46c3e0..0829c53 100644
--- a/machines/ramune/configuration.nix
+++ b/machines/ramune/configuration.nix
@@ -61,6 +61,10 @@
           ServerName = "London Boroughs";
           AllowConnectPlatform = "Xbox";
           PalEggDefaultHatchingTime = 1;
+          GuildPlayerMaxNum = 10;
+          bShowPlayerList = true;
+          bEnableNonLoginPenalty = false;
+          bUseAuth = false;
         };
       };
     };
diff --git a/modules/games/palworld/default.nix b/modules/games/palworld/default.nix
index fe41b3d..bb2cb36 100644
--- a/modules/games/palworld/default.nix
+++ b/modules/games/palworld/default.nix
@@ -5,6 +5,7 @@ let
   isEnabled = config.modules.games.enable && config.modules.games.palworld.enable;
   baseCfg = config.modules.games;
   cfg = config.modules.games.palworld;
+  port = toString cfg.port;
 
   name = "palworld-server";
   scripts = (import ../lib/scripts.nix) args;
@@ -59,11 +60,6 @@ in
       description = "Whether to enable Community Server mode";
     };
 
-    autostart = mkOption {
-      default = false;
-      type = types.bool;
-    };
-
     datadir = mkOption {
       type = types.path;
       default = "${baseCfg.datadir}/palworld";
@@ -81,7 +77,7 @@ in
 
     threads = mkOption {
       type = types.int;
-      default = 4;
+      default = 5;
     };
 
     maxPlayers = mkOption {
@@ -110,6 +106,16 @@ in
       "d ${cfg.datadir} 0755 ${baseCfg.user} ${baseCfg.group} - -"
     ];
 
+    systemd.sockets."${name}" = {
+      wantedBy = [ "sockets.target" ];
+      partOf = [ "${name}.service" ];
+      listenDatagrams = [ "0.0.0.0:${port}" ];
+      socketConfig = {
+        SocketUser = "${baseCfg.user}";
+        SocketGroup = "${baseCfg.group}";
+      };
+    };
+
     systemd.services."${name}" = let
       dirs = {
         Pal = "${cfg.package}/Pal";
@@ -129,7 +135,8 @@ in
       script = let
         args = [
           "Pal"
-          "-port=${toString cfg.port}"
+          "-port=${port}"
+          "-publicport=${port}"
           "-useperfthreads"
           "-NoAsyncLoadingThread"
           "-UseMultithreadForDS"
@@ -139,10 +146,11 @@ in
           ++ optionals (cfg.ip != null) [ "-publicip=${cfg.ip}" ]
           ++ optionals cfg.public [ "-publiclobby" ];
         bin = getExe (pkgs.mkSteamWrapper "${cfg.datadir}/Pal/Binaries/Linux/PalServer-Linux-Shipping");
-      in "${bin} ${concatStringsSep " " args}";
+        forceBind = "${getExe pkgs.force-bind} -m '0.0.0.0:${port}=sd=0'";
+      in "${forceBind} ${bin} ${concatStringsSep " " args}";
     in {
-      wantedBy = mkIf cfg.autostart [ "multi-user.target" ];
-      after = [ "network.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
       path = with pkgs; [ xdg-user-dirs util-linux ];
 
       inherit script;
@@ -160,9 +168,10 @@ in
         Group = "${baseCfg.group}";
         WorkingDirectory = "${cfg.datadir}";
 
-        CPUWeight = 80;
+        CPUWeight = 90;
         CPUQuota = "${toString ((cfg.threads + 1) * 100)}%";
 
+        /*
         PrivateDevices = true;
         PrivateTmp = true;
         PrivateUsers = true;
@@ -172,7 +181,11 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         RestrictRealtime = true;
-        LockPersonality = true;
+        */
+
+        # force-bind needs to stay unlocked and needs to be able to ptrace
+        LockPersonality = false;
+        CapabilityBoundingSet = [ "CAP_SYS_PTRACE" ];
 
         # Palworld needs namespaces and system calls
         RestrictNamespaces = false;
diff --git a/modules/router/kernel.nix b/modules/router/kernel.nix
index ca0d799..4a38afa 100644
--- a/modules/router/kernel.nix
+++ b/modules/router/kernel.nix
@@ -65,7 +65,6 @@ in {
       "kernel.sysrq" = 4;
       "kernel.unprivileged_bpf_disabled" = true;
       "kernel.perf_event_paranoid" = 3;
-      "kernel.yama.ptrace_scope" = 2;
       "kernel.kexec_load_disabled" = true;
       "net.core.bpf_jit_harden" = 2;
       "dev.tty.ldisc_autoload" = false;