Port forwarding for a Counter-Strike 2 server
Counter-Strike 2 does what every Source-engine server does: one port number, both protocols. UDP handles play and queries, and TCP on the same number forms part of the Steam handshake.
Your setup
Choose the firmware family rather than your exact model — every router in a family shares the same menus.
Out of the box it is 27015. If you changed that, use whatever you set in -port.
The local address of the computer that runs the server. Find it with ipconfig on Windows or ip addr on Linux; it will begin with 192.168, 10. or 172.
Open these
Your firmware takes ranges, so each line here is one rule.
- 27015 TCP
- 27015 UDP
27015UDPGame trafficAll CS2 gameplay and queries.27015TCPSteam handshakeSame number, TCP. Forward both protocols or the server intermittently fails to register.
Only if you want them
The server runs fine without these. Each open port is one more door for strangers to try, so leave out what you do not need.
- 27020 UDP
27020UDPSourceTVDemo relay. Optional.
Do not open these
Good news: this game has no remote-admin port that could be exposed by mistake. Forward the ports on the left and stop there.
Step by step: your router
- 1
Give the server a fixed local IP
A forwarding rule targets a single local address. If the server comes back from a reboot with a new one, the rule quietly points at an empty address — which is how forwards seem to "break by themselves".
On this router:look for DHCP Reservation, Address Reservation, Static Lease or Manually Assigned IP
- 2
Open the router admin page
From a device on the same network, open one of these in a browser:
- 192.168.0.1
- 192.168.1.1
- 192.168.2.1
- 10.0.0.1
Almost always printed on a sticker on the router itself.
- 3
Find the port forwarding page
Port Forwarding, Virtual Server, NAT, Applications & Gaming, or Port Mapping
Vendors use at least six names for the same feature. Whatever it is called, the page you want is the one asking for a port, a protocol and a device on your network. If the external and internal port fields both exist, set them to the same number.
- 4
Create one rule per line
a description field, if there is one External / WAN / Public / Service port Internal / LAN / Private port Protocol Internal IP / Device / Server IP Counter-Strike 2 27015 27015 TCP your server’s local IP Counter-Strike 2 27015 27015 UDP your server’s local IP Use the same number for the external and internal port. You can make the external one different, but then every player has to connect on that new number, so keep them identical unless you have a specific reason not to.
- 5
Let the server through its own firewall
The router is now sending traffic to the right computer, but that computer can still turn it away. Windows Defender Firewall is the usual offender: it blocks a newly installed dedicated server by default, and from outside that is indistinguishable from a broken forward.
Take it with you
Counter-Strike 2 — port forwarding rules ---------------------------------------- 27015 TCP -> <server local IP> 27015 UDP -> <server local IP>
Check whether it worked
Always test from outside your network. A connection from another device in the house proves nothing: that traffic stays on your LAN and never passes through the rule you just created.
Advertisement
The usual mistake
RCON on a Source server travels over the TCP side of the game port, not a port of its own, so leaving it unforwarded is not an option. Give it a strong password and guard it like any other credential — whoever has your RCON password can rewrite every setting and load whatever content they like.
Advertisement
Skipping port forwarding
Competitive players notice latency jitter immediately, and a server sharing the household connection with everyone else in the house will produce plenty. For this genre, where you host is really a question about how the game plays.