On this page
One table, for the moment you need to know which port to open. Every entry is the default: if you changed a port in your own configuration, open the one you set, not the one listed here.
Each game's own guide covers the rest of running it: FiveM, Minecraft, Rust, and Source and CS2.
The table
| Game | Protocol | Default port | What it carries |
|---|---|---|---|
| FiveM | TCP | 30120 | HTTP endpoint, server list registration, and client file downloads |
| FiveM | UDP | 30120 | Game traffic |
| FiveM (txAdmin) | TCP | 40120 | Web admin interface. Restrict this by source |
| Minecraft Java | TCP | 25565 | Game traffic and the status ping the client list uses |
| Minecraft Java | UDP | 25565 | Query, only when enable-query=true |
| Minecraft Java | TCP | 25575 | RCON, only when enable-rcon=true. Restrict this by source |
| Minecraft Bedrock | UDP | 19132 | Game traffic over IPv4 |
| Minecraft Bedrock | UDP | 19133 | Game traffic over IPv6 |
| Rust | UDP | 28015 | Game traffic, set with +server.port |
| Rust | UDP | whatever you set | Steam queries, set with +server.queryport |
| Rust | TCP | 28016 | RCON, set with +rcon.port. Restrict this by source |
| Rust | TCP | whatever you set | Rust+ companion app, set with +app.port, only if you use it |
| Source and CS2 | UDP | 27015 | Game traffic and Steam queries, on the same port |
| Source and CS2 | TCP | 27015 | RCON. Restrict this by source |
| Source and CS2 | UDP | 27020 | SourceTV, only when enabled |
| ARK | UDP | 7777 | Game traffic |
| ARK | UDP | 7778 | Raw socket traffic, Survival Evolved only, always the game port plus one |
| ARK | UDP | 27015 | Steam queries |
| ARK | TCP | 27020 | RCON. Restrict this by source |
| SA-MP and open.mp | UDP | 7777 | Game traffic and queries, on the same port |
| TeamSpeak 3 | UDP | 9987 | Voice |
| TeamSpeak 3 | TCP | 30033 | File transfers |
| TeamSpeak 3 | TCP | 10011 | ServerQuery, raw. Restrict this by source |
Notes on the awkward ones:
- Minecraft Java's query is off by default. Nothing listens on UDP 25565
until you set
enable-query=trueinserver.properties. Leave the port closed until you do. - ARK: Survival Evolved needs the game port plus one. Miss UDP 7778 and players get connection problems that look like nothing else on the list. Survival Ascended does not use that second port, so a fresh ASA server needs only the game port and the query port.
- Rust's query port has no fixed default. Set it yourself with
+server.queryportso you know which port to open. See Installing a Rust server on Linux. - Several games run more than one server per machine by incrementing these numbers. A second Source server on 27016, a second Rust on 28115, and so on. Each needs its own rules.
Check what your server is actually listening on
Before opening anything, ask the server. On Linux:
sudo ss -lntupThat lists every TCP and UDP socket in a listening state with the process that owns it. If your game is not in that output, the problem is the game server, not the firewall, and no rule will fix it.
How to open them
There are two firewalls between a player and your game server, and both have to allow the traffic.
At the network edge, add an inbound rule per port and protocol under Port rules. A rule is TCP or UDP, never both, so a service like FiveM that uses both on 30120 needs two rules. The rule is also where the packet-rate ceilings and protocol checks for that port live, see Rate limits.
Game presets opens the common set for a game in one action. That set is not everything in the table above. Most query ports, most RCON ports, SourceTV, txAdmin, and Rust+ are not part of a preset, so add those as rules of your own afterwards. Three presets go further: Rust's also opens RCON on TCP 28016, ARK's opens the query port on UDP 27015, and TeamSpeak 3's opens ServerQuery on TCP 10011 and file transfer on TCP 30033.
On the server itself, the operating system's own firewall has to allow it
too. On Debian and Ubuntu with ufw:
sudo ufw allow 30120/tcp
sudo ufw allow 30120/udp
sudo ufw statusOn RHEL, AlmaLinux, and Rocky with firewalld:
sudo firewall-cmd --permanent --add-port=30120/tcp
sudo firewall-cmd --permanent --add-port=30120/udp
sudo firewall-cmd --reloadA closed query port makes a server invisible
This one is worth recognising on sight, because it does not look like a firewall problem.
Most of these games answer two different kinds of traffic. The game port carries players. The query port answers the small status request that server browsers, listing sites, and Discord status bots send to ask who is online and what map is running. On Source, SA-MP, and Minecraft Java, that is the same port as the game. On Rust and ARK, it is a different one.
If the query port is closed and the game port is open, the server works and is unfindable. Players who already have the address connect normally and everything inside the server is fine, but nobody sees it in the browser, listing sites show it as offline, and any status bot reports it down. The symptom is a healthy server that gets no new players.
So if a server is reachable by direct connect and missing from the listings, check three things in this order:
- The query port is open, at the edge and on the host firewall.
- The query port your server is actually using matches the one you opened. Set it explicitly in the launch arguments rather than trusting a default.
- For Source engine games, that you applied a game server login token. Without one the server never registers with Valve's list, whatever your ports say. See Running a Source engine server.
If players cannot connect at all, that is a different problem, and When players cannot connect is the page for it.