Force Overwatch 2 matchmaking onto a single datacenter, anywhere in the world (Asia, Americas, Europe, Middle East) using scoped Windows Firewall rules. One small exe, dark UI with live ping, one click to lock or unlock.
Warning
Beta. This is an early version. Locking can break Battle.net login (Time out communicating with Battle.net services) if your account signs in through a server that sits inside a blocked region.
If that happens, see Login broken? below, or
open an issue with your account region and what you saw.
Overwatch 2 picks a datacenter from a latency probe before each match. In regions with several nearby datacenters (SEA, East Asia, North America, Europe, Middle East) you can end up on a server that is technically "close" but plays worse for you, and there is no in-game option to choose.
Overwatch Server Lock blocks every datacenter except the one you pick. The probes to the others time out, so matchmaking can only place you on the region you chose.
| Group | Regions |
|---|---|
| Asia / Pacific | Singapore, Japan, South Korea, Taiwan, Australia |
| Americas | NA West, NA Central, NA East, Brazil |
| Europe / Middle East | Europe (Netherlands, Finland), Middle East (Bahrain, Qatar, KSA) |
Each region is built from Google Cloud region families (NA West = every us-west* region, Europe =
every europe-* region, and so on) plus the Blizzard-owned datacenter blocks for that region. The full
table is $Regions at the top of src/ow-lock.ps1. Google regions that host no
Overwatch servers (India, Canada, Mexico, Africa, ...) are never blocked.
Each tile shows a live ping to a server in that region (green under 80 ms, amber under 160 ms, red above), refreshed every 10 seconds.
- Most Overwatch 2 servers run on Google Cloud. Their addresses come from Google's own published
list (cloud.json), grouped by cloud region, so they are
exact and current. Blizzard-owned datacenters (Korea, Taiwan, Sydney, Las Vegas, Chicago, Amsterdam)
use fixed ranges. Blizzard also relays game traffic through its own per-city edge points
(
137.221.x.0/24, e.g. a Sydney match runs through Equinix Sydney), so each region includes its edge sites as well. An edge can also relay to a datacenter in another city (a Japan lock once reached a Sydney match through the Tokyo edge), so edges with no region of their own are always blocked. The list is downloaded once and cached; Update IP lists re-downloads it only when Google has published a new version (one request), then re-applies the lock if it is on. - Subtracts the ranges of the region you keep, plus the Battle.net login and patch endpoints (resolved via DNS at lock time) so sign-in keeps working.
- Creates inbound and outbound Windows Firewall block rules for IPv4 and IPv6, scoped to
Overwatch.exeonly. Other apps that happen to use the same Google Cloud regions are not affected. - Registers a scheduled task (
OverwatchServerLock-Refresh, runs as SYSTEM every 2 minutes) that re-resolves the Battle.net login hosts. Their IPs rotate; when a new address block shows up, the rules are rebuilt from the cached lists so login keeps working. Previously seen login blocks stay open for 7 days.
No game files are touched, nothing is injected, and no drivers are installed. Unlock removes every rule and the scheduled task.
Tick Unlock automatically when this window closes for a temporary lock. Closing the window unlocks;
if the app is killed or the PC restarts instead, the refresh task sees the window is gone and unlocks
within 2 minutes. Settings, cached lists and refresh.log live in %ProgramData%\OverwatchServerLock
(writable by administrators only, since SYSTEM runs the script from there).
- Grab
OverwatchServerLock.exefrom the latest release. - Close Overwatch.
- Double-click the exe and accept the UAC prompt (firewall rules need admin). SmartScreen may warn because the exe is unsigned: More info then Run anyway.
- Pick a region (the tiles show your ping to each) and click Lock. Use Update IP lists now and then to pull Google's latest ranges.
- Start Overwatch and queue. In a match, press
Ctrl+Shift+Nto see the server IP and confirm. - Click Unlock when you are done. Playing with friends? See Playing in a group.
Rules and the login IP refresh persist across reboots until you unlock.
Everyone in the group needs to lock to the same region. The lock only blocks servers on your own PC; it cannot choose a server for the whole group. When you queue as a group, Overwatch picks one datacenter from everyone's latency. If a friend's PC can still reach a closer datacenter (for example Sydney), the game may pick it. Your friend gets in, and your connection times out because that datacenter is blocked for you.
When every player in the group locks to the same region, that region is the only one everyone can reach, so the matchmaker has to use it.
If your friends can't run the lock:
- Custom games: set Data Center Preference in the lobby settings.
- Otherwise: click Unlock while you play together, and accept their datacenter and your higher ping. Tick Unlock automatically when this window closes next time so the lock comes back for solo queue.
Keeping two regions (-Keep 'Singapore|Australia') works the same as unlocking here. The game is still
free to pick the farther datacenter.
The exe is a thin launcher around two PowerShell scripts in src/. You can use the core script directly:
.\src\ow-lock.ps1 -On # lock to Singapore (default)
.\src\ow-lock.ps1 -On -Keep Japan # lock to another region (regex on region names)
.\src\ow-lock.ps1 -On -Keep 'NA West|NA Central' # keep several regions
.\src\ow-lock.ps1 -On -OwnerPid $PID # temporary: unlock once this PowerShell exits
.\src\ow-lock.ps1 -Update # pull Google's latest ranges, re-apply the lock if on
.\src\ow-lock.ps1 -On -DryRun -Verbose # preview the ranges, change nothing
.\src\ow-lock.ps1 -On -NoAutoRefresh # lock without the login IP refresh task
.\src\ow-lock.ps1 -Status
.\src\ow-lock.ps1 -Off # remove rules and refresh taskRegions: Singapore, Japan, South Korea, Taiwan, Australia, NA West, NA Central, NA East,
Brazil, Europe, Middle East.
-GamePath overrides auto-detection of Overwatch.exe (Steam and Battle.net installs are found automatically).
Battle.net login servers live inside the same cloud ranges as game servers. The lock keeps the known ones
reachable (us/eu/kr.actual.battle.net, version/patch servers), but your region may use another host.
These login hosts also rotate IPs. The auto-refresh task follows them, but it runs every 2 minutes, so
right after a rotation login can fail briefly: wait a couple of minutes and retry, or click Lock again.
Quick workaround: click Unlock, log in, click Lock again, then queue. Already-open connections are not cut, so you stay signed in.
Permanent fix: keep the login host for your region reachable:
.\src\ow-lock.ps1 -On -AllowHost 'kr.actual.battle.net', 'some.other.host'-AllowHost hosts are re-resolved by the refresh task too. Or add it to $ServiceHosts at the top of src/ow-lock.ps1 and rebuild the exe.
To find which host is failing: unlock, start Overwatch, and while it logs in run
Get-NetTCPConnection -OwningProcess (Get-Process Overwatch).Id | Select RemoteAddress, RemotePortthen check those IPs against the blocked ranges with -DryRun -Verbose. Please
open an issue with the host so it can be added for everyone.
- New datacenters. Google's list stays current, but if Blizzard opens a datacenter in a Google region
that is not mapped yet, or a new Blizzard-owned block, the
$Regionstable needs an update. If you land on the wrong region, please open an issue with the server IP (Ctrl+Shift+N). - Ping is approximate. It is an ICMP ping to one server in the region; in-game latency can differ a little.
- Longer queues are possible, since you only match with players on one datacenter.
- Groups: every player needs to lock to the same region, or the game may pick a datacenter you have blocked and you will fail to connect. See Playing in a group.
- VPNs: normal full-tunnel VPNs and WireSock-based split tunnels (e.g. TunnlTo) keep the lock working. Some gaming accelerators that proxy traffic through their own process can bypass it.
- Use at your own risk. This only uses the built-in Windows Firewall and does not modify the game, but it is not endorsed by Blizzard.
Requires only Windows (uses the .NET Framework C# compiler that ships with it):
build.cmdOutput: dist\OverwatchServerLock.exe. The icon is generated by assets/make-icon.ps1.
src/ow-lock.ps1 core: region table, fetch Google ranges, compute ranges, manage firewall rules
src/ow-gui.ps1 WinForms dark UI, runs the core on a background runspace
src/launcher.cs exe that unpacks the scripts to %TEMP% and starts the UI
src/app.manifest requests admin on launch
- Google Cloud IP ranges: cloud.json, published by Google.
- Blizzard datacenter ranges and the region mapping approach: stowmyy/dropship, a great server selector with more options.
- Earlier versions used the community lists from foryVERX/Overwatch-Server-Selector.
MIT. Overwatch and Battle.net are trademarks of Blizzard Entertainment, Inc. This project is not affiliated with or endorsed by Blizzard.