Game server ports and firewalls: what to open and why

The Cfx.re documentation keeps a page of common FiveM server problems, and the first one on it is a server that does not show up in the server list. Its diagnosis is short: most of the time a router forward or a firewall is in the way.¹ The failure looks the same in every game: the server starts, it prints that it is listening, and the players' packets never reach it.

The opposite mistake is quieter and worse. A server that everyone can join is often answering on more ports than it needs, including the remote console that controls it. Every open port is a promise to answer anyone on the internet who knocks. The cure for both is the same habit: know which ports your game really uses, who each one is for, and open exactly those.

A port is a number and a protocol

An IP address gets a packet to the right machine. The port number gets it to the right program on that machine. Port numbers run from 0 to 65,535, and IANA divides them into three ranges: well-known ports up to 1023, registered ports from 1024 to 49151, and dynamic or ephemeral ports from 49152 up.²

A program that wants traffic asks the operating system to listen on a port for one transport protocol, TCP or UDP, and it is the pair that matters. UDP 27015 and TCP 27015 are unrelated doors: separate sockets, often separate jobs, and a firewall rule for one does nothing for the other. On a Source (SRCDS) server that exact pair carries the players on one side and the remote console on the other, which is why this guide always writes the protocol next to the number.

A listener also picks which of the machine's addresses to listen on. FiveM's example configuration binds its TCP and UDP endpoints to 0.0.0.0:30120, meaning every address the machine has, and its comment says to change only the port unless the server has several network interfaces.³ A program bound to 127.0.0.1, the loopback address, can only be reached by other programs on the same machine. Where a game lets you do that for an admin port, it is safer than any firewall rule, because no firewall mistake can publish it.

TCP and UDP: why one game uses both

TCP gives a program a reliable, in-order stream of bytes. It numbers what it sends, detects losses through those sequence numbers and corrects them by sending again.⁵ Before any data moves, the two ends exchange a three-packet handshake, and after a loss the receiving program reads nothing past the gap until it is filled. UDP makes the opposite trade. RFC 768 describes it as sending messages with a minimum of protocol mechanism, says delivery and duplicate protection are not guaranteed, and points anything that needs ordered, reliable delivery at TCP.⁶

For the movement of players and objects, UDP's trade is the right one. A position update is stale the moment the next one is sent. If tick 2 is lost, tick 3 already says where everyone is, and waiting for 2 to be resent would only freeze the picture until it arrived. For a file download, a web page or a console command the wait is exactly what you want, because one missing byte breaks the whole thing.

So many games use both, and the split tells you which firewall rules to write. FiveM listens on TCP and UDP 30120 in its example configuration.³ Cfx.re's own description of a connection shows the split: the client first talks HTTP to the server's port, fetching /info.json, asking to connect and downloading files from /files/, and only then sends a UDP handshake and plays over UDP.⁴Minecraft picked one protocol per edition: Java Edition's server listens on TCP, and Bedrock Dedicated Server uses UDP.⁸

The ports each game really uses

These are the defaults, each from the game's own documentation, sorted by who the port is for. A default is only where the server starts. If you set another port in its configuration, the firewall has to allow that one, not the number in this table.

Read the table by column rather than by row. The second column is the only one every game needs open to the whole internet. The third is optional in the sense that the server runs without it, but it is how new players find you. The fourth is a set of doors that exist for one person, you, and nothing about a working game depends on the internet being able to reach them. TeamSpeak's own table makes the point for you: two ports marked required, and every administrative one marked optional.¹⁵

Query ports: how a server browser finds you

Players who already have your address need only the game port. Everyone else finds servers through the in-game browser, a listing site or a Discord status bot, and each of those asks every server a small question: what are you called, which map, how many players. On most games that question arrives on a query port.

On Source it arrives on the game port itself. Valve's server-query protocol sends queries as UDP packets to the server's listen port,¹¹ and the CS2 documentation describes -port as setting the game and query port in one go.¹² One UDP rule covers both.

Rust splits them, with arithmetic worth doing before you write a rule. server.queryport is what puts the server in the in-game browser. If you do not set it, it defaults to one more than the greater of server.port and rcon.port; the game and query ports are both UDP, both must be open, and they cannot be the same number.¹⁴ With Facepunch's example values, game 28015 and RCON 28016, the greater is 28016, so the query port is UDP 28017. Now leave RCON unset. The same page says rcon.port then defaults to the game port, so RCON becomes TCP 28015, the greater number is 28015, and the query port quietly moves to UDP 28016.¹⁴ A firewall written for the example is now one port off. Set all three ports explicitly and the arithmetic cannot surprise you.

Minecraft Java's query is off by default. Turn on enable-query and it listens on UDP, on query.port, whose default is 25565: the game's number, the other protocol.¹⁰Until then nothing listens on UDP 25565, and there is nothing to open. The Java client's own server list does not use query at all: it asks the game port, over TCP, and enable-status, which is on by default, is what lets the server answer.¹⁰

Open query ports on purpose rather than by habit. Valve's documentation notes that a query reply is larger than the request, which made servers usable in reflection amplification attacks, and that a challenge step was added in December 2020 to close that off.¹¹ Why attackers pick on game servers at all is its own story, told in why game servers get DDoS attacks.

The symptom of a closed or mismatched query port is easy to misread. The server works, people who have the address join normally, and nobody new ever finds it. The Cfx.re test for a FiveM server missing from the list is to connect directly from the client's F8 console with connect IP:Port;¹ if that works, the game port is fine and the problem is on the listing side.

RCON and admin ports: doors only you should use

RCON, the remote console, lets you type server commands from somewhere other than the server's own console. Valve describes the Source version as a TCP-based protocol whose most common use is letting owners control their servers without direct access to the machine.¹³ Whatever you can type in the console, anyone holding the RCON password can type too: kick and ban, change the map, run scripts, stop the server. RCON, TeamSpeak's ServerQuery and web panels such as txAdmin each hand over the whole server, and in most setups a single password is the only thing guarding them.⁷

The games' own documentation is plain about how far to trust that password. The Minecraft Wiki advises against using RCON over untrusted networks such as the internet because it is not encrypted: everything sent, the password included, can be intercepted, and ideally you connect only from localhost.¹⁰ FiveM ships with RCON off: its example configuration enables it only when you uncomment rcon_password and set one.³ txAdmin, its web panel, is the one to watch: by default it listens on TCP 40120 on every address the machine has, 0.0.0.0, so it is public unless a firewall says otherwise.⁹

The same number, two doors

Source makes the risk easy to miss. SRCDS listens for RCON on TCP 27015 by default, and if you move the server with -port, RCON moves with it.¹³ Players and queries use UDP 27015. One number, two audiences, and a firewall that does not tell them apart hands both to everyone. ufw's own manual shows how easily that happens: its example rule for port 53, written without a protocol, allows TCP and UDP alike.¹⁶

Three ways to keep the console yours

Leave it off if you do not use it. Minecraft Java and FiveM both ship with RCON disabled. A console that is not running cannot be guessed at.

Keep the port closed and come in over SSH. You already have an encrypted, key-protected way into the server. Carry RCON through it:

$ ssh -L 28016:127.0.0.1:28016 admin@203.0.113.10

Leave that session open and point your RCON tool at 127.0.0.1:28016 on your own machine. ssh forwards connections to a local TCP port through the encrypted session, and the onward connection is made from the server itself,¹⁷ so RCON sees a visitor from inside the machine and the firewall never needs a rule for it. The password stops crossing the internet in the clear as a bonus. Hardening SSH itself, with keys and no password logins, is covered in securing a new Linux server.

If something must connect directly, allow one address. An admin bot hosted elsewhere cannot use your SSH session. ufw rules can name a source address as well as a port and protocol,¹⁶ so the rule opens the door for that machine alone:

$ sudo ufw allow proto tcp from 198.51.100.7 to any port 28016

Many home connections change address from time to time, so an allow rule for your house needs revisiting. An SSH tunnel does not.

Port forwarding at home, a public address on a server

At home, your internet provider gives the router one public address, and every device behind it gets a private one such as 192.168.1.20. Outgoing traffic works without any setup. Incoming traffic does not: a packet for your public address on UDP 28015 reaches the router, and the router has no idea which device should get it. A port forward tells it. Facepunch describes the router sending traffic for a specific port to the correct LAN address, and advises making that address static rather than leaving it to DHCP.¹⁴ The Minecraft Wiki says the same of the Java server's port: it must be forwarded when the server sits behind NAT.¹⁰

Two details matter more than they look. The forward must match the protocol, and where a router offers "both" or "all", Facepunch says to avoid it.¹⁴ And a forward only gets the packet as far as the PC. The PC's own firewall still has to allow the port, and when a forward seems not to work, that is the next place to look.

Sometimes no forward can work. Some internet providers put their customers behind carrier-grade NAT, a second layer of address sharing run by the ISP, and RFC 6598 reserved a block for it: shared address space for carrier-grade NAT devices, the /10 that starts at 100.64.¹⁸ A /10 fixes the first ten bits of the address, which leaves 64 values for the second number, so the block runs from 100.64 to 100.127. If your router's status page shows its internet-side (WAN) address in that range, the public address belongs to your ISP's NAT, not to your router, and a player's packet stops there. Only the ISP can change that.

A hosted server removes the forwarding problem. On a typical VPS the public address sits on the machine's own network interface (some clouds translate it one-to-one further upstream), and either way every port reaches the machine without a forward rule. What many providers add is a firewall at their network edge. Where there is one, it and the operating system's firewall both have to allow the traffic; on Clouduxe that edge firewall is the port rules.⁷

Whichever you run, test from where the players are. A connection from inside your own network, or from the server to itself, proves only that the program is listening: it never crosses the router or the edge filter. Ask someone outside to join, or use the game's direct connect from a machine on a different network.

Default deny, step by step: a Rust server

Here is the whole method on one server: Rust on a Debian or Ubuntu VPS at 203.0.113.10, started with Facepunch's example ports (game 28015, RCON 28016) and no query port set. The firewall is ufw, a program for managing the Linux firewall through a simpler interface.¹⁶The idea is to start from "nothing gets in" and add back only what has a reason.

First, ask the server what it is actually listening on. Every firewall decision after this is about these lines.

$ sudo ss -lntupNetid State  Recv-Q Send-Q Local Address:Port  Peer Address:Port Processudp   UNCONN 0      0            0.0.0.0:28015      0.0.0.0:*     users:(("RustDedicated",pid=4121,fd=112))udp   UNCONN 0      0            0.0.0.0:28017      0.0.0.0:*     users:(("RustDedicated",pid=4121,fd=118))tcp   LISTEN 0      128          0.0.0.0:22         0.0.0.0:*     users:(("sshd",pid=812,fd=3))tcp   LISTEN 0      512          0.0.0.0:28016      0.0.0.0:*     users:(("RustDedicated",pid=4121,fd=121))

-l limits the list to listening sockets and -p names the process that owns each one;¹⁹ -t and -u pick TCP and UDP, and -n prints numbers rather than service names. A program missing from this list is not running, or is bound somewhere else, and a firewall rule cannot bring it back.⁷ Here it is, on four sockets, and each one has an audience. UDP 28015 is for players and UDP 28017 for server browsers, so both open to everyone. TCP 28016 is RCON, for you alone. TCP 22 is SSH, your own way in.

1. 1

   Allow SSH before anything else

   Add the rule for the port you administer the server on while the firewall is still off, so turning it on cannot cut off the session you are typing in.

2. 2

   Deny incoming by default, allow outgoing

   Anything that matches no rule is dropped without a reply. The server can still reach out to update itself, fetch mods and talk to master servers.

3. 3

   Open what players and browsers need, with the protocol

   One rule per port, each naming UDP or TCP. Here that is UDP 28015 and UDP 28017, and nothing else.

4. 4

   Give RCON nothing

   No rule for TCP 28016. You reach it through the SSH tunnel, or you add one rule for one address.

5. 5

   Turn it on and read it back

   Enable the firewall, list the rules it is enforcing, and compare them with what ss showed.

$ sudo ufw allow 22/tcp$ sudo ufw default deny incoming$ sudo ufw default allow outgoing$ sudo ufw allow 28015/udp$ sudo ufw allow 28017/udp$ sudo ufw enableCommand may disrupt existing ssh connections. Proceed with operation (y|n)? yFirewall is active and enabled on system startup$ sudo ufw status verboseStatus: activeLogging: on (low)Default: deny (incoming), allow (outgoing), deny (routed)New profiles: skipTo                         Action      From--                         ------      ----22/tcp                     ALLOW IN    Anywhere28015/udp                  ALLOW IN    Anywhere28017/udp                  ALLOW IN    Anywhere22/tcp (v6)                ALLOW IN    Anywhere (v6)28015/udp (v6)             ALLOW IN    Anywhere (v6)28017/udp (v6)             ALLOW IN    Anywhere (v6)

The order is not fussiness. Turning ufw on flushes its rules and may drop existing connections, SSH included, and its manual's advice is to add the SSH rule before enabling.¹⁶ The default policy can be deny, which ignores the packet, or reject, which tells the sender it was refused;¹⁶ for a public server, silence gives a stranger less to work with. Outgoing stays allowed because game servers call out too. A TeamSpeak 3 server, for one, connects to TeamSpeak's own accounting and server-list services,¹⁵ and a default deny on outgoing traffic would quietly break that. Replies to the connections the server opens itself still get in, because the firewall tracks each outgoing connection and treats its return traffic as part of it rather than as a new incoming packet. The (v6) lines in the output are the same rules for IPv6, which ufw writes alongside the IPv4 ones.

Notice what is missing: TCP 28016. RCON still runs, and through the SSH tunnel it still works, but to the internet it has become one more port that does not answer. To check the result from the server's side, sudo ufw show listening lists every listening TCP and open UDP port with the process behind it and the rules that apply to it.¹⁶ A listening port with no rule under it is either closed on purpose, like RCON here, or a mistake.

sockets listening, as ss showed them

4

reachable from the internet after this walk-through: UDP 28015, UDP 28017 and TCP 22

3

the Rust query port here: 1 + the greater of 28015 and 28016

28017

Default deny changes what happens next, not only now. Install a database, a web panel or a second game tomorrow, and if it listens on every address, as txAdmin does by default, it is still unreachable until you write a rule for it. Without default deny it would be public the moment it started. On a host with an edge firewall, finish by writing the same short list there: the same three ports, each with its protocol, and nothing for RCON.

Mistakes that open too much, or too little

When a player cannot connect, work from the inside out. Is the game listening on the port and protocol you expect? Does the server's own firewall allow it? Does the edge? And if the server is joinable but invisible, is the query port the one you opened? Each question rules out one layer, and in that order you never loosen a firewall to fix a program that was not running.