Game server ports explained: query ports, RCON and firewalls

Most games need more than one port, and the second one is almost never the one people think about - right up until the server runs perfectly and refuses to appear in anybody's server browser. A game server typically opens a game port that players connect to, a query port that the server browser interrogates for a name and a player count, and sometimes a third for remote administration. They are separate numbers, often on different protocols, and each fails in its own way. This post lists the real numbers for the games people actually host, explains which ones must be open, and gives you the commands to prove it from outside.

The three kinds of port#

Almost every dedicated server you will ever run uses ports from three categories, and it helps to hold them apart in your head.

• The game port. What the client connects to when a player types an address. It is always allocated, always published, and if it is closed nobody gets in. This is the number that goes in a connection string or an SRV record.
• The query port. What server browsers, listing sites and monitoring bots ask for the hostname, map, player count and slots. It answers a tiny request with a tiny reply and has nothing to do with gameplay. If it is closed, your server works perfectly and is invisible.
• The administrative ports. RCON, SourceTV or GOTV, a web admin panel, a telnet console, a REST API. Every one of them is optional, every one of them is a way into your server, and none of them should be open to the world without a good reason.

The reason the query port exists at all is that a game protocol is busy. A server browser listing two thousand servers cannot afford to start a real game session with each one just to read a player count. So the server also speaks a cheap, stateless side protocol - the Steam A2S query protocol for most Source and Steam-listed games, Minecraft's own query and server-list-ping, the game's own HTTP endpoint for FiveM. A single UDP packet in, a single packet out, no handshake.

Sometimes the two live on the same number. Counter-Strike 2, Team Fortress 2 and Garry's Mod answer both game traffic and A2S queries on 27015/udp, which is why those games so rarely have the invisible-server problem. Sometimes they are adjacent: Valheim uses 2456 and 2457, and the query port is always the game port plus one. Sometimes they are unrelated numbers in different ranges: Palworld runs the game on 8211/udp and the query on 27015/udp. And occasionally they are the other way round from what you would guess - Unturned's Port setting is the query port, and the game runs on Port + 1.

Ports by game#

These are the defaults. Almost all of them are configurable, and on a panel the allocated number is shown on the server's page - copy it from there rather than from this table when you are writing a connection string.

Two patterns in that table are worth naming. First, the 27015-27020 block belongs to Steam, and a great many games reuse it for queries whatever their game port is - which is exactly why running two Steam games on one machine means moving one of them. Second, a surprising number of survival games want a small contiguous block rather than one number, because the engine binds the port you gave it plus one or two above. Arma 3 and DayZ reserve five; 7 Days to Die wants three; Squad wants two pairs. A plan that allocates one port cannot run those games, which is why the port count is on every plan page rather than buried in a specification sheet.

Games not in the table are not a mystery, just less common. The server prints what it bound to in the first twenty lines of its log, and that line is more authoritative than any documentation, including this one.

TCP, UDP, and the firewall rule that does nothing#

The single most common firewall mistake is opening the right number on the wrong protocol. It produces a server that is up, listening, correctly configured and completely unreachable, and the error the player sees is a generic timeout.

Most games use UDP for gameplay. A game does not want retransmission: a position update from 200 ms ago is worthless, and TCP would insist on delivering it before delivering the fresh one. So games send fire-and-forget datagrams and handle their own ordering and loss. Minecraft Java is the famous exception - it is TCP, because it is a turn-taking protocol where every packet matters. Terraria is TCP. RimWorld's multiplayer mod is TCP. Everything else in the table above is UDP for the part that carries players, and query protocols are almost universally UDP as well.

The practical consequences:

• A rule that allows tcp/2456 for Valheim does nothing at all. Both Valheim ports are UDP.
• A rule for udp/25565 on Minecraft Java allows the query protocol and not the game. Players still cannot join.
• Some games need both on the same number. BeamMP uses TCP for connection setup and mod transfer and UDP for vehicle state. Satisfactory uses UDP for the game and TCP for the management API on the same 7777. Open both.
• "Allow any protocol" on a home router usually means TCP and UDP, but not always. Check.

UDP being connectionless also changes what "closed" looks like. A closed TCP port refuses immediately and you get a fast, clear error. A closed or filtered UDP port usually produces nothing at all, and the client just waits, then gives up. That is why UDP problems feel slower and vaguer to diagnose than TCP ones, and why a port scanner reports UDP ports as open|filtered - it genuinely cannot tell the difference without a reply. TCP vs UDP for game servers goes further into what that means for proxies and filtering. If you are writing the rules yourself, firewall rules that matter covers the default-deny shape that leaves the smallest surface.

Why a running server does not appear in the browser#

Three completely different causes look identical from the outside: your server runs, the console looks healthy, and no browser lists it.

The query port is not reachable. Either it was never allocated, or the firewall rule covers only the game port, or the game is configured to answer queries on a port nothing is forwarding. Confirm by connecting directly by IP and port. If the direct connection works and the listing does not, you have found it.

The game wants a login token you have not supplied. Counter-Strike 2, Team Fortress 2, Garry's Mod, Unturned, Insurgency: Sandstorm and Euro Truck Simulator 2 all want a Steam game-server login token - a GSLT, free from Valve, issued per server to a person with a game licence. Without one, some of these run anonymously with restricted listing and some do not list at all. Nobody can create one on your behalf: a random string that satisfies the field validator is rejected by Steam, which turns a clear failure into a server that starts and is never seen. Where a game will not run without a token, a sensible host holds the installation until you supply it rather than handing you a broken server. Steam game server tokens covers creating one and what a ban against a token means.

The game lists through its own service, not Steam. FiveM registers with Cfx.re over its HTTP endpoint on 30120/tcp. Minecraft has no central list at all - the multiplayer screen pings addresses your players typed. BeamMP registers with the BeamMP backend using your auth key. In each case the thing to check is outbound reachability and the key, not an inbound query port.

There is a fourth, duller cause worth mentioning because it wastes hours: the list is just slow. Valheim's community browser can take ten minutes to show a new server and its in-game filter is weak. Before you rebuild your firewall, search for an unusual word from the server name, and give it a coffee's worth of patience.

Testing a port from outside#

Testing from the server itself proves nothing. The loopback interface is always open; you are checking the one path no player will ever take. Every test below runs from another machine, ideally on another network.

# TCP: does something accept a connection?$ nc -vz node.example.com 25565Connection to node.example.com 25565 port [tcp/*] succeeded!# UDP with a real Steam query, which is the only honest UDP test$ nmap -sU -p 27015 -sV --script=discovery node.example.com# What is the server actually listening on, run on the server$ ss -lntup | grep -E '2456|2457'

On Windows, Test-NetConnection node.example.com -Port 25565 does the TCP case in PowerShell. For UDP there is no equivalent one-liner, because a correct UDP test means speaking the game's own protocol and seeing a reply - which is exactly what the public server-status sites do. A2S query checkers for Steam games, and the Minecraft status sites for Java servers, are the fastest honest answer you will get for a UDP port.

ss -lntup is the command that settles arguments. It lists what is bound, on which protocol, on which address, by which process. Two things in its output matter. If the address column shows 127.0.0.1:27015 rather than 0.0.0.0:27015 or *:27015, the server is bound to loopback only and no firewall change on earth will help - fix the bind address in the game's config. And if the process is not the one you expected, you have two servers fighting over one port, which the loser reports as "address already in use" somewhere in a log you have not read yet.

Changing or adding a port#

Changing a port is two edits that must agree, and the failure mode when they do not is a server listening on a port the firewall does not allow, or a firewall allowing a port nothing is listening on.

1. Allocate the port. On a panel this is the Network tab; on your own machine it is a firewall rule and, at home, a port forward.
2. Set the game's own port variable to the same number. This lives on the Startup tab of a panel, or in the config file or launch arguments otherwise. It is -port for Valheim, server-port in server.properties for Minecraft, Port in ServerConfig.toml for BeamMP, -Port= for several Unreal games.
3. Restart and read the first twenty lines of the console. The server prints what it bound to. If it prints the old number, you edited the wrong file or the game rewrote your config on shutdown - several of them do.
4. Test from outside before telling anyone.

On RE:NODE every plan states its allocations and ports are added and removed on the Network tab, with query and RCON included in the count. The panel's Startup tab holds the game variables, so both halves of the change are two tabs apart, and the console shows the result immediately - reading the console is worth skimming if the startup output is unfamiliar. Changing a plan does not rebuild the server, so a move to a tier with more ports keeps the world and the configuration you already have.

If you would rather players did not have to type a port at all, that is a DNS job rather than a networking one. A plain A record gives them a name and the same port; an SRV record can hide a non-standard port entirely for Minecraft Java. Connecting a domain to a game server is the simple version and SRV records for Minecraft is the one that hides the number.

RCON and the ports you should not expose#

RCON is a remote console: you authenticate with a password and then send commands as if you were sitting at the server. It is genuinely useful for Discord bridges, status bots and scheduled tasks. It is also, in most implementations, a plaintext protocol with a single shared password and no rate limiting, which makes an exposed RCON port one of the better ways to lose a server.

The things worth knowing before you enable it:

• Source RCON is TCP on the game port number, enabled with -usercon and a rcon_password. Because it shares the number with UDP game traffic, people open tcp/27015 without realising they have exposed the console.
• GoldSrc - Counter-Strike 1.6 and its relatives - runs RCON over UDP on the game port, so it cannot be firewalled separately from gameplay at all. The password is the only protection there is.
• Minecraft RCON is 25575/tcp and off unless enable-rcon=true. Rust exposes it as a websocket on 28016/tcp. Palworld has both RCON on 25575/tcp and a REST API on 8212/tcp, each with its own password.
• Web admin panels - Killing Floor 2 on 8080, 7 Days to Die's dashboard on 8080 and telnet on 8081 - are HTTP, unencrypted by default, and frequently protected by a password sitting in a config file in plain text.

The rule that keeps you out of trouble is simple: expose the game port and the query port to the world, and nothing else. If you need RCON from outside, restrict the rule to the addresses you administer from, use a password that is not the admin password, and change it whenever anyone leaves the staff team. RCON safely has the longer version, and what to do when your server is hacked is the post you want to have read beforehand rather than afterwards.

Port forwarding at home, NAT and CGNAT#

Hosting from your own connection makes ports harder rather than easier, because there is a translation layer between the internet and your machine. Your router has one public address, your server has a private one, and a forward tells the router that traffic arriving on a given port belongs to a given internal machine.

Three things break this in practice:

• The internal address moves. Your server picks up a new DHCP lease, the forward still points at the old address, and everything stops. Give the machine a DHCP reservation or a static local address before you forward anything.
• The public address moves. Most residential connections get a dynamic address that changes on reconnection. A dynamic DNS record papers over it, at the cost of a propagation delay every time it changes. Static IP addresses: when you need one works through what a stable address does and does not buy you.
• Carrier-grade NAT. If your router's WAN address is in 100.64.0.0/10, you share a public address with other customers and no port forward is possible at all, because the port is not yours to forward. Many ISPs will move you off CGNAT on request; some will not, and some charge for it. IPv6 is a genuine way out if your players also have it, which is the catch - see IPv6 and game servers.

There is also the part nobody writes down: a forwarded port on a home connection is a permanent inbound hole into the network your bank details live on, running game server software with a patching record that is nobody's idea of excellent. Self-hosting a game server at home versus renting compares the two honestly, including the cases where home hosting is the right answer.

FAQ#

What is a query port and do I need it open?

It is the port a server browser asks for your server's name, map and player count. Gameplay does not use it. You need it open only if you want the server listed or monitored; players who connect by direct address will get in without it.

Why does my server work for me but not for anyone else?

You are testing from inside the network, where the firewall and NAT are not in the path. Test from a mobile connection or ask someone outside to try. If they fail and you succeed, the problem is the firewall, the forward or the bind address, not the game.

Can two game servers share one port?

No. One process can bind one port on one protocol at a time, and the second one fails with "address already in use". They can share a number across protocols - one on TCP, one on UDP - but that is rarely what people are asking. Give each server its own port and its own query port.

Do I need to open outbound ports as well?

Almost never. Outbound connections are allowed by default on virtually every firewall and router, and the return traffic is permitted by connection tracking. Server listing, Steam authentication and update downloads are all outbound and generally need no rule.

Is a non-standard port safer than the default?

Marginally, and not in a way you should rely on. It removes your server from the crudest mass scans, which is worth something for an administrative port, but anything that scans a range finds it anyway. Use it as a convenience, never as a control.

How many ports does my plan need?

Count the game port, the query port if it is a separate number, and any administrative port you actually intend to use. Valheim needs two. Minecraft Java needs one unless you want RCON. Arma 3 and DayZ need a block of five and three. The per-game table above covers the rest.