Tutorials source | CS-Boost

---
title: "Which Ports to Open for a CS 1.6 Server (UDP 27015, 26900, 27020)"
excerpt: "The exact ports a CS 1.6 server uses — game, RCON, HLTV, and Steam master traffic — with copy-paste ufw and iptables rules and how to prove the port is really open."
category: "installation"
tags: "firewall, ports"
image: ""
read_time: "8 min read"
---
<p>CS 1.6 firewalling confuses people because many guides tell you to open TCP 27015 for RCON (GoldSrc RCON actually travels over UDP on the game port), and because "open the port" on a VPS means two different things — the host firewall and the provider's network filter. This is the complete, minimal port list, why each one exists, and how to confirm it is genuinely reachable from outside.</p>

<h2>The ports that matter</h2>
<table>
<thead><tr><th>Port</th><th>Protocol</th><th>Direction</th><th>Purpose</th></tr></thead>
<tbody>
<tr><td>27015</td><td>UDP</td><td>Inbound</td><td>Game traffic, Steam A2S queries and RCON. The one non-negotiable port.</td></tr>
<tr><td>27020</td><td>UDP</td><td>Inbound</td><td>HLTV / SourceTV, if you run a spectator proxy. Default; configurable.</td></tr>
<tr><td>26900</td><td>UDP</td><td>Inbound</td><td>Legacy client/query port range some setups use. Harmless to allow.</td></tr>
<tr><td>27011 / 27015-27016</td><td>UDP</td><td>Outbound</td><td>Heartbeats to the Steam master servers. Needs outbound UDP, not inbound.</td></tr>
</tbody>
</table>
<p>For a single default server, the honest minimum is <strong>UDP 27015 inbound</strong> (game, queries and RCON). Everything else is situational.</p>

<h2>1. UDP is the game; do not forget it</h2>
<p>All gameplay — movement, shooting, the A2S query that populates the server browser — is UDP 27015. If only TCP is open, the server browser shows nothing and no one connects. This is the mistake people make when they reuse a web-server firewall template that only thinks in TCP.</p>

<h2>2. RCON uses the same UDP port</h2>
<p>GoldSrc remote console is connectionless UDP on the game port: the tool asks the server for a challenge, then sends the password and command as UDP packets to 27015. HLDS does not listen on TCP at all, so a <code>27015/tcp</code> rule does nothing. If players connect fine but your RCON tool times out, the tool is probably speaking the Source-style TCP RCON protocol, which GoldSrc does not understand; see <a href="/tutorials/rcon-from-linux-cli">RCON from the Linux command line</a>.</p>

<h2>3. ufw (Ubuntu / Debian)</h2>
<pre>sudo ufw allow 27015/udp</pre>
<p>Running <a href="/tutorials/multiple-cs16-servers-one-vps">several servers</a>? Open the whole range:</p>
<pre>sudo ufw allow 27015:27020/udp</pre>
<p>Check the result:</p>
<pre>sudo ufw status numbered</pre>

<h2>4. iptables (no ufw)</h2>
<pre>sudo iptables -A INPUT -p udp --dport 27015 -j ACCEPT
# for a range of servers:
sudo iptables -A INPUT -p udp --dport 27015:27020 -j ACCEPT</pre>
<p>Persist the rules with <code>iptables-save</code> or your distro's <code>netfilter-persistent</code> so they survive a reboot — a firewall that forgets its rules on restart is a classic "it worked yesterday" report.</p>

<h2>5. Outbound must be allowed too</h2>
<p>To show up in the internet list the server heartbeats the Steam master servers, which is <strong>outbound</strong> UDP. Most firewalls allow outbound by default, but a locked-down egress policy will silently keep your server off the list even though clients can connect by direct IP. If direct <code>connect</code> works but the server never lists, check egress before you blame <code>sv_lan</code>. (Also confirm <code>sv_lan 0</code> — see <a href="/tutorials/hlds-command-line-parameters">the parameters guide</a>.)</p>

<h2>6. HLTV and extra query ports</h2>
<p>If you run an HLTV/SourceTV spectator proxy, it binds its own UDP port — 27020 by default — and that port needs to be open inbound for spectators to connect, exactly like the game port. It is a separate listener from the game server, so opening 27015 does nothing for it. If you moved HLTV to another port, open the number you actually configured, not the default.</p>

<h2>7. The provider firewall is separate</h2>
<p>On a cloud VPS there are often two firewalls: the OS (ufw/iptables) and the provider's security group / network filter in their control panel. Opening ufw does nothing if the provider still blocks inbound UDP. Some budget hosts block or rate-limit UDP by default specifically because of game-server abuse — check the provider panel, and if UDP is filtered, that is why nothing connects no matter what you do on the box.</p>

<h2>Common errors</h2>
<ul>
<li><strong>Server in list, but nobody can connect (or vice versa)</strong> — you opened TCP but not UDP. Gameplay and browser queries are UDP; open <code>27015/udp</code>.</li>
<li><strong>Players connect, RCON times out</strong> - not a closed port: RCON shares UDP 27015 with the game. The tool may speak Source-style TCP RCON, the password may be wrong, or the server banned your IP after failed attempts (<code>sv_rcon_maxfailures</code>). See <a href="/tutorials/rcon-from-linux-cli">RCON from the Linux command line</a>.</li>
<li><strong>Direct connect works, server never lists</strong> — outbound UDP to the master is blocked, or <code>sv_lan 1</code>. Allow egress and set <code>sv_lan 0</code>.</li>
<li><strong>Works until reboot</strong> — iptables rules were not persisted. Save them.</li>
<li><strong>ufw open, still unreachable</strong> — the provider's network firewall is blocking UDP. Fix it in their panel.</li>
</ul>

<h2>Verification</h2>
<p>First confirm the server is actually bound locally:</p>
<pre>ss -lunp | grep 27015</pre>
<p>Then test reachability from <em>outside</em> the box — a firewall test from the server itself proves nothing. From another machine, probe UDP 27015:</p>
<pre>nmap -sU -p 27015 YOUR_SERVER_IP</pre>
<p>An <code>open</code> or <code>open|filtered</code> result with a valid A2S response means the port is reachable. The definitive test is still a client: <code>connect YOUR_IP:27015</code>. If that works and the server also appears in the internet list, every port that matters is open. Next, lock the launch and ports into a <a href="/tutorials/hlds-systemd-service">systemd service</a>.</p>

title, excerpt, category, tags, image, read_time

title	excerpt	category	tags	image	read_time
Which Ports to Open for a CS 1.6 Server (UDP 27015, 26900, 27020)	The exact ports a CS 1.6 server uses — game, RCON, HLTV, and Steam master traffic — with copy-paste ufw and iptables rules and how to prove the port is really open.	installation	firewall, ports		8 min read

CS 1.6 firewalling confuses people because many guides tell you to open TCP 27015 for RCON (GoldSrc RCON actually travels over UDP on the game port), and because "open the port" on a VPS means two different things — the host firewall and the provider's network filter. This is the complete, minimal port list, why each one exists, and how to confirm it is genuinely reachable from outside.

The ports that matter

Port	Protocol	Direction	Purpose
27015	UDP	Inbound	Game traffic, Steam A2S queries and RCON. The one non-negotiable port.
27020	UDP	Inbound	HLTV / SourceTV, if you run a spectator proxy. Default; configurable.
26900	UDP	Inbound	Legacy client/query port range some setups use. Harmless to allow.
27011 / 27015-27016	UDP	Outbound	Heartbeats to the Steam master servers. Needs outbound UDP, not inbound.

For a single default server, the honest minimum is UDP 27015 inbound (game, queries and RCON). Everything else is situational.

1. UDP is the game; do not forget it

All gameplay — movement, shooting, the A2S query that populates the server browser — is UDP 27015. If only TCP is open, the server browser shows nothing and no one connects. This is the mistake people make when they reuse a web-server firewall template that only thinks in TCP.

2. RCON uses the same UDP port

GoldSrc remote console is connectionless UDP on the game port: the tool asks the server for a challenge, then sends the password and command as UDP packets to 27015. HLDS does not listen on TCP at all, so a 27015/tcp rule does nothing. If players connect fine but your RCON tool times out, the tool is probably speaking the Source-style TCP RCON protocol, which GoldSrc does not understand; see RCON from the Linux command line.

3. ufw (Ubuntu / Debian)

sudo ufw allow 27015/udp

Running several servers? Open the whole range:

sudo ufw allow 27015:27020/udp

Check the result:

sudo ufw status numbered

4. iptables (no ufw)

sudo iptables -A INPUT -p udp --dport 27015 -j ACCEPT
# for a range of servers:
sudo iptables -A INPUT -p udp --dport 27015:27020 -j ACCEPT

Persist the rules with iptables-save or your distro's netfilter-persistent so they survive a reboot — a firewall that forgets its rules on restart is a classic "it worked yesterday" report.

5. Outbound must be allowed too

To show up in the internet list the server heartbeats the Steam master servers, which is outbound UDP. Most firewalls allow outbound by default, but a locked-down egress policy will silently keep your server off the list even though clients can connect by direct IP. If direct connect works but the server never lists, check egress before you blame sv_lan. (Also confirm sv_lan 0 — see the parameters guide.)

6. HLTV and extra query ports

If you run an HLTV/SourceTV spectator proxy, it binds its own UDP port — 27020 by default — and that port needs to be open inbound for spectators to connect, exactly like the game port. It is a separate listener from the game server, so opening 27015 does nothing for it. If you moved HLTV to another port, open the number you actually configured, not the default.

7. The provider firewall is separate

On a cloud VPS there are often two firewalls: the OS (ufw/iptables) and the provider's security group / network filter in their control panel. Opening ufw does nothing if the provider still blocks inbound UDP. Some budget hosts block or rate-limit UDP by default specifically because of game-server abuse — check the provider panel, and if UDP is filtered, that is why nothing connects no matter what you do on the box.

Common errors

Server in list, but nobody can connect (or vice versa) — you opened TCP but not UDP. Gameplay and browser queries are UDP; open 27015/udp.
Players connect, RCON times out - not a closed port: RCON shares UDP 27015 with the game. The tool may speak Source-style TCP RCON, the password may be wrong, or the server banned your IP after failed attempts (sv_rcon_maxfailures). See RCON from the Linux command line.
Direct connect works, server never lists — outbound UDP to the master is blocked, or sv_lan 1. Allow egress and set sv_lan 0.
Works until reboot — iptables rules were not persisted. Save them.
ufw open, still unreachable — the provider's network firewall is blocking UDP. Fix it in their panel.

Verification

First confirm the server is actually bound locally:

ss -lunp | grep 27015

Then test reachability from outside the box — a firewall test from the server itself proves nothing. From another machine, probe UDP 27015:

nmap -sU -p 27015 YOUR_SERVER_IP

An open or open|filtered result with a valid A2S response means the port is reachable. The definitive test is still a client: connect YOUR_IP:27015. If that works and the server also appears in the internet list, every port that matters is open. Next, lock the launch and ports into a systemd service.