Which Ports to Open for a CS 1.6 Server (UDP 27015, 26900, 27020)

CS 1.6 firewalling confuses people because the game is UDP but RCON is TCP on the same port number, and because "open the port" on a VPS means two different things — the host firewall and the provider's network filter. This is the complete, minimal port list, why each one exists, and how to confirm it is genuinely reachable from outside.

The ports that matter

For a single default server, the honest minimum is UDP 27015 inbound (game) and TCP 27015 inbound (RCON). Everything else is situational.

1. UDP is the game; do not forget it

All gameplay — movement, shooting, the A2S query that populates the server browser — is UDP 27015. If only TCP is open, the server browser shows nothing and no one connects. This is the mistake people make when they reuse a web-server firewall template that only thinks in TCP.

2. RCON is TCP on the same number

Remote console uses a TCP connection to the same port number as the game. So a fully working server needs both 27015/udp and 27015/tcp open. If players connect fine but your web-based RCON tool times out, TCP 27015 is closed.

3. ufw (Ubuntu / Debian)

sudo ufw allow 27015/udp
sudo ufw allow 27015/tcp

Running several servers? Open the whole range:

sudo ufw allow 27015:27020/udp
sudo ufw allow 27015:27020/tcp

Check the result:

sudo ufw status numbered

4. iptables (no ufw)

sudo iptables -A INPUT -p udp --dport 27015 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 27015 -j ACCEPT
# for a range of servers:
sudo iptables -A INPUT -p udp --dport 27015:27020 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 27015:27020 -j ACCEPT

Persist the rules with iptables-save or your distro's netfilter-persistent so they survive a reboot — a firewall that forgets its rules on restart is a classic "it worked yesterday" report.

5. Outbound must be allowed too

To show up in the internet list the server heartbeats the Steam master servers, which is outbound UDP. Most firewalls allow outbound by default, but a locked-down egress policy will silently keep your server off the list even though clients can connect by direct IP. If direct connect works but the server never lists, check egress before you blame sv_lan. (Also confirm sv_lan 0 — see the parameters guide.)

6. HLTV and extra query ports

If you run an HLTV/SourceTV spectator proxy, it binds its own UDP port — 27020 by default — and that port needs to be open inbound for spectators to connect, exactly like the game port. It is a separate listener from the game server, so opening 27015 does nothing for it. If you moved HLTV to another port, open the number you actually configured, not the default.

7. The provider firewall is separate

On a cloud VPS there are often two firewalls: the OS (ufw/iptables) and the provider's security group / network filter in their control panel. Opening ufw does nothing if the provider still blocks inbound UDP. Some budget hosts block or rate-limit UDP by default specifically because of game-server abuse — check the provider panel, and if UDP is filtered, that is why nothing connects no matter what you do on the box.

Common errors

• Server in list, but nobody can connect (or vice versa) — you opened TCP but not UDP. Gameplay and browser queries are UDP; open 27015/udp.
• Players connect, RCON times out — TCP 27015 is closed. Open it.
• Direct connect works, server never lists — outbound UDP to the master is blocked, or sv_lan 1. Allow egress and set sv_lan 0.
• Works until reboot — iptables rules were not persisted. Save them.
• ufw open, still unreachable — the provider's network firewall is blocking UDP. Fix it in their panel.

Verification

First confirm the server is actually bound locally:

ss -lunp | grep 27015

Then test reachability from outside the box — a firewall test from the server itself proves nothing. From another machine, probe UDP 27015:

nmap -sU -p 27015 YOUR_SERVER_IP

An open or open|filtered result with a valid A2S response means the port is reachable. The definitive test is still a client: connect YOUR_IP:27015. If that works and the server also appears in the internet list, every port that matters is open. Next, lock the launch and ports into a systemd service.