Deploying a CS 1.6 Server on a Hetzner Cloud VPS

Hetzner Cloud is one of the cheapest reliable homes for a CS 1.6 server, but there is one decision that will make or break the deployment before you type a single command: the CPU architecture. HLDS is a 32-bit x86 binary, and Hetzner sells both x86 and ARM instances under confusingly similar names. Get that right and the rest is a standard Linux install.

1. Choose an x86 plan, not the ARM one

In the Hetzner Cloud Console at console.hetzner.cloud, create a project and add a server. The plan families matter:

• CX (Intel) and CPX (AMD) are x86-64 shared vCPU plans. HLDS runs natively on these.
• CAX (Ampere) is 64-bit ARM. HLDS will not run on it without box86/box64 emulation, which is fragile and costs you CPU. Avoid CAX for a game server.

The smallest CX or CPX plan comfortably runs a full 32-slot server; CS 1.6 is not demanding. Pick a location close to your players — ping is everything for a shooter — and see choosing a VPS for CS 1.6 if you are weighing providers.

2. Provision Ubuntu 24.04 with an SSH key

Select the Ubuntu 24.04 image and attach your SSH public key during creation rather than using a root password — Hetzner emails a root password otherwise, and password auth on a public IP is a magnet for brute-force bots. Once the server boots, connect:

ssh root@YOUR_SERVER_IP

3. Configure the Hetzner Cloud Firewall

Hetzner offers a stateful Cloud Firewall that runs outside the VM, so it protects the box even before the OS firewall is configured. In the Console, create a firewall and attach it to the server. CS 1.6 needs one inbound rule that most people get wrong — the query and game traffic is UDP, not TCP:

Inbound  UDP  27015   (game + A2S queries)
Inbound  TCP  22      (SSH, ideally from your IP only)

If you add RCON over a separate port or run HLTV, open those too. The full port list and the reasoning behind UDP is in CS 1.6 firewall ports.

4. Create an unprivileged user

Never run the game server as root. Create a dedicated user now:

adduser --disabled-password --gecos "" csserver
su - csserver

Everything from here happens as csserver. The full rationale and a systemd unit that enforces it live in installing HLDS without root.

5. Install the 32-bit libraries

A fresh 64-bit Ubuntu cannot load a 32-bit binary until you add the i386 architecture and its libraries. As root:

dpkg --add-architecture i386
apt update
apt install -y lib32gcc-s1 lib32stdc++6

Skipping this produces the classic No such file or directory on an executable that clearly exists — the loader is missing, not the file. See 32-bit libraries for CS 1.6 and the No such file fix.

6. Install SteamCMD and HLDS

Back as csserver, install SteamCMD and pull the dedicated server. This follows the same steps as any Linux box — nothing about Hetzner changes them:

mkdir -p ~/steamcmd ~/hlds
cd ~/steamcmd
curl -sqL "https://steamcdn-a.akamaihd.net/client/installer/steamcmd_linux.tar.gz" | tar zxf -
./steamcmd.sh +force_install_dir ~/hlds +login anonymous +app_update 90 validate +quit

App 90 is the Half-Life dedicated server; it will download the CS files. The complete walkthrough, including selecting Counter-Strike as the mod, is in the SteamCMD dedicated server guide and the Ubuntu-specific 24.04 guide.

7. Launch and keep it running

Start it once by hand to confirm it binds:

cd ~/hlds
./hlds_run -game cstrike +map de_dust2 +maxplayers 24 -port 27015

The -game cstrike and -port flags plus the rest are covered in HLDS command-line parameters. Once it works, wrap it in a systemd service so it survives reboots and crashes.

Troubleshooting

• Server not visible in the browser — the Cloud Firewall rule is TCP instead of UDP, or sv_lan is 1. Set sv_lan 0 in server.cfg and confirm the UDP rule.
• hlds_run: No such file or directory — the 32-bit loader is missing. Complete step 5.
• Chose a CAX server and nothing runs — that is ARM. Destroy it and recreate on CX or CPX; do not fight box86.
• SSH works but the game port is dead — the Hetzner Cloud Firewall and the OS firewall are two layers. Check both; Ubuntu's ufw may also be blocking.

Verification

From your own PC, open the console in CS 1.6 and run connect YOUR_SERVER_IP:27015. If you join, the network path is correct. Then query it externally — the server should appear in the internet tab within a minute of sv_lan 0 and a live master-list connection. If it connects directly but never lists, revisit the firewall and sv_lan before touching anything else.