Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Godlike.Host offers hosted Counter-Strike 2 servers with its own game panel, SFTP access and free DDoS protection, if you would rather not host it yourself.
To let players outside your home network join a Counter-Strike 2 dedicated server, forward the server’s listening port—27015 by default—to the computer running the server, permit that traffic through the computer’s firewall, and launch CS2 with -dedicated. For public Steam connectivity, create a Steam Game Server Login Token (GSLT) for app ID 730 and pass it with +sv_setsteamaccount. Then give friends your public IP address and port, such as connect YOUR_PUBLIC_IP:27015.
The exact port ranges and TCP/UDP combinations published by community guides are inconsistent. Treat 27015 as the starting point, and verify any additional ports against Valve’s current Source Dedicated Server (SRCDS) networking documentation before opening a wider range.
What port forwarding changes
A home router normally hides devices behind one public IPv4 address using Network Address Translation (NAT). Outbound connections work automatically, but an unsolicited connection from the internet has no rule telling the router which device should receive it. A port-forwarding rule supplies that destination: traffic arriving at your public address on a chosen port is sent to the server computer’s private IPv4 address.
For CS2, the router rule is only one part of the path. The operating-system firewall, any cloud firewall on a rented VPS, the server’s launch parameters, and Steam authentication must all agree. A correct router rule cannot make a stopped server reachable, and a running server cannot be reached if the router forwards to the wrong machine.
#1 Best Overall
- Blazing-fast WiFi 7 boosts tri-band throughput up to 12000 Mbps with 320 MHz channels of 6 GHz band, Multi-Link Operation (MLO) and 4K-QAM
- Powerful wired network capacity of up to 20G with one 2.5G WAN port and seven 2.5G LAN ports.
- High-performance quad-core 2.0GHz CPU with robust cooling, 2GB RAM and eight internal antennas providing up to 3000 sq. ft. of range.
- Smart Home Master makes it easy to set up functional subnetwork (up to 3 SSIDs) for IoT devices and VPNs
- ROG-exclusive Gaming Network streamlines Triple-Level Game Acceleration setup and connections through convenient SSIDs
Requirements and information to collect
- A CS2 dedicated-server installation that starts successfully on the host computer or VPS.
- Administrator access to the router (or gateway) and to the host operating system.
- The host’s private IPv4 address and the router’s default-gateway address.
- The server port you intend to use. CS2 commonly uses
27015unless you select another value with-port. - A public IPv4 address that accepts inbound traffic. Carrier-grade NAT (CGNAT) at the ISP can prevent forwarding even when your router is configured correctly.
- A Steam account that can create a Game Server Login Token for app ID 730 if the server must be listed or accept normal public Steam connections.
Step 1: Find the server computer’s private IP address
Windows
- Open Command Prompt.
- Run
ipconfig. - Under the adapter that is actually connected (Ethernet or Wi-Fi), record IPv4 Address and Default Gateway. For example, the host might be
192.168.1.42and the gateway192.168.1.1.
Use the address from the active adapter, not a disconnected virtual adapter, VPN adapter, or loopback address. The private address can change after a DHCP lease expires. In your router, create a DHCP reservation for the server’s MAC address, or configure a static address within the router’s documented range. A reservation is usually safer because it avoids accidentally choosing an address used by another device.
Linux
Run ip addr and identify the IPv4 address on the interface carrying your default route. The address commonly appears in a private range such as 192.168.x.x, 10.x.x.x, or 172.16.x.x–172.31.x.x. Use ip route to confirm the default gateway. Reserve that address in the router before creating the forwarding rule.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Step 2: Sign in to the router
- Enter the Default Gateway from
ipconfigorip routeinto a browser’s address bar, for examplehttp://192.168.1.1. Other common gateway addresses include192.168.0.1; your own gateway value is authoritative. - Sign in with the router administrator account. This is separate from the Wi-Fi password on many models.
- Look for a menu named Port Forwarding, Virtual Server, NAT, or Advanced NAT. Mesh systems may place it under an individual network or device profile.
If the gateway page does not load, confirm that you are connected to that router, disable a browser proxy or VPN temporarily, and check whether your ISP supplied a combined modem/router. If there are two routing devices, you may have a double-NAT layout; the second device must be addressed later.
Step 3: Create the CS2 forwarding rule
Create a rule that points the selected external port to the same port on the server host. A typical entry looks like this:
| Router field | Value for a default server | Why it matters |
|---|---|---|
| Service or description | CS2 server | A label only; use a name you will recognize. |
| Destination device or internal IP | The reserved host address, such as 192.168.1.42 |
This is where the router sends matching packets. |
| External/start port | 27015 |
The port friends use with your public IP. |
| Internal/end port | 27015 |
The port on which CS2 listens. |
| Protocol | UDP, or TCP and UDP if your router requires a combined rule | Published community instructions disagree; see the port guidance below. |
| Enabled | On | Disabled rules have no effect even when saved. |
Some routers require separate entries for TCP and UDP. Do not assume that selecting “both” proves the server needs both protocols; it may simply be the router’s convenience option. Start with the protocol required by Valve’s current documentation for your server build. If that documentation is unavailable, UDP 27015 is the commonly cited starting point, while some guides recommend forwarding both TCP and UDP.
Save or apply the rule, then reboot the router only if its interface requires a restart. Rebooting can briefly disconnect every device, so do it after the server host has its reserved address.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- Beyond-fast WiFi 7 (802.11be) with new 320MHz channels in the 6 GHz band and 4096-QAM significantly increases network capacity and throughput, with speeds of up to 30 Gbps
- Multi-link Operation links to multiple bands at the same time to ensure stable internet connections and efficient data transfers
- Cutting-edge external dual-feeding antennas boost coverage by providing high efficiency and significantly enhanced signal strength
- Maximized wired connectivity and flexibility with dual 10G ports and quad 2.5G ports
- Triple-Level Game Acceleration - The GT-BE98 Pro boosts your PC gaming traffic every step of the way, from your PC gaming port all the way to the game server.
Step 4: Allow the traffic through the host firewall
Windows Defender Firewall
- Start the server once so Windows can register its executable, then open Windows Defender Firewall with Advanced Security.
- Select Inbound Rules and choose New Rule.
- Choose Program if you want to allow only the CS2 server executable (commonly
cs2.exe), or Port if you need an explicit port rule. - For a port rule, select the protocol and local port matching the router rule, choose Allow the connection, and limit the network profiles to those you actually use.
- Give the rule a clear name such as
CS2 Dedicated UDP 27015. Create a separate TCP rule only when your selected server documentation requires it.
Windows may classify a new network as Public. Do not broadly disable the firewall to test; instead, verify the executable path, protocol, local port, and active profile. A rule that allows UDP does not automatically allow TCP.
Linux with UFW
On a host using UFW, allow the required port and protocol, for example:
sudo ufw allow 27015/udp
sudo ufw status verboseAdd a TCP rule only if your configuration needs it:
sudo ufw allow 27015/tcpOther distributions may use firewalld, nftables, or iptables. Add an equivalent inbound rule, confirm that the firewall is enabled, and ensure that no higher-priority deny rule overrides it.
Cloud or VPS firewalls
A VPS can have a provider-level security group or cloud firewall in addition to the operating-system firewall. Add the same inbound port and protocol there. Opening the OS firewall while leaving the cloud rule closed produces the same timeout as a missing router rule.
Step 5: Launch the dedicated server with the correct parameters
Valve’s CS2 Dedicated Servers documentation identifies -dedicated, -port, -ip, and -maxplayers as relevant launch parameters. The -dedicated flag is essential: without it, you are not starting the dedicated-server mode that listens for remote players.
Rank #3
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐑𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 𝟕 - Designed with the latest Wi-Fi 7 technology, featuring Multi-Link Operation (MLO), Multi-RUs, and 4K-QAM. Achieve optimized performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra.
- 𝟔-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝐰𝐢𝐭𝐡 𝟔.𝟓 𝐆𝐛𝐩𝐬 𝐓𝐨𝐭𝐚𝐥 𝐁𝐚𝐧𝐝𝐰𝐢𝐝𝐭𝐡 - Achieve full speeds of up to 5764 Mbps on the 5GHz band and 688 Mbps on the 2.4 GHz band with 6 streams. Enjoy seamless 4K/8K streaming, AR/VR gaming, and incredibly fast downloads/uploads.
- 𝐖𝐢𝐝𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐒𝐭𝐫𝐨𝐧𝐠 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐨𝐧 - Get up to 2,400 sq. ft. max coverage for up to 90 devices at a time. 6x high performance antennas and Beamforming technology, ensures reliable connections for remote workers, gamers, students, and more.
- 𝐔𝐥𝐭𝐫𝐚-𝐅𝐚𝐬𝐭 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐖𝐢𝐫𝐞𝐝 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 - 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port and 3x 1 Gbps LAN ports offer high-speed data transmissions.³ Integrate with a multi-gig modem for gigplus internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Windows example
cs2.exe -dedicated -port 27015 +map de_dust2Run the command from the directory containing the executable, or use its full path. If the host has several network interfaces, -ip can bind the server to the intended private address. For example:
cs2.exe -dedicated -ip 192.168.1.42 -port 27015 -maxplayers 10 +map de_dust2Linux example
./cs2 -dedicated +map de_dust2 -port 27015Keep the port in the command, router rule, firewall rule, and connection instructions identical. If you change it to 27016, update every one of those locations and have players connect to PUBLIC_IP:27016.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Watch the startup console for bind errors, map-loading failures, or messages indicating that another process already owns the port. On Linux, ss -lunpt can show listening sockets; on Windows, netstat -ano can help identify a process using the port.
Step 6: Create and apply a Steam Game Server Login Token
A GSLT associates the server with your Steam account and the game application. Valve’s CS2 server instructions use game ID 730. Create the token at steamcommunity.com/dev/managegameservers, enter app ID 730, and copy the generated token.
- Open the token-management page while signed in to Steam.
- Enter
730as the game ID and create a token with a descriptive memo. - Keep the token private. Anyone who obtains it may be able to impersonate or disrupt your server registration.
- Pass it to the server at launch with
+sv_setsteamaccount <TOKEN>.
cs2.exe -dedicated -port 27015 +sv_setsteamaccount YOUR_TOKEN +map de_dust2On Linux, append the same parameter to the executable command. Replace YOUR_TOKEN with the actual token and do not include angle brackets. One community guide describes a server without a token as effectively operating in LAN mode for public connections; treat the token as required for a normal public Steam listing rather than assuming router forwarding alone is sufficient.
If you publish launch scripts, environment files, or service definitions, restrict their permissions so the token is not exposed in a public repository or shared screenshot. Revoke and replace a token if it has been disclosed.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Tri-band 2.4GHz + 5GHz + 6GHz; latest WiFi 6E supports 8-streams on tri-band simultaneously, up to 6.6Gbps speed
- AI QoS; satisfies all users' needs by automatically prioritizing data packets
- Powerful processor; 1.8 GHz quad core processor delivers ultra fast and reliable connections
- Mystic light; sync RGB light effects with mystic light compatible products
- Game accelerator; provides an uninterrupted WiFi connection for immersive gaming experiences
Step 7: Test from inside and outside the network
Test on the host first
Confirm that the server process remains running, loads the intended map, and reports the selected port. A local client on the same network can try the host’s private address, such as connect 192.168.1.42:27015. This test proves that the server is listening, but it does not prove that internet forwarding works.
Test from another network
Use a friend’s connection or a phone hotspot rather than another device on the same Wi-Fi. Give the tester your current public IPv4 address and the port:
connect YOUR_PUBLIC_IP:27015Some routers do not support NAT loopback (also called hairpin NAT). In that case, connecting to your public address from inside your own LAN can fail even though outside players can join. An external test is therefore decisive.
Check the public address
Compare the router’s WAN/Internet IPv4 address with the address shown by a reputable “what is my IP” service. If the router displays a private or shared address instead of the public address, inbound forwarding may be blocked by another upstream router or by ISP CGNAT.
Which CS2 ports should you open?
Port information for CS2 dedicated servers is not consistently documented across community guides. The following table separates the commonly cited default from optional or disputed entries. Do not open every range automatically; each additional port increases the exposed surface and may not be needed for a private server.
| Port or range | Protocol cited | How to interpret it |
|---|---|---|
27015 |
UDP commonly; some guides say TCP and UDP | Default game port and the first rule to configure. It changes when you use another -port value. |
27020 |
UDP | Often associated with SourceTV. Optional unless you intentionally run that feature. |
3478 |
UDP | Listed by some guides for NAT traversal; not universally required for a private server. |
4379–4380 |
UDP | Listed by some guides for matchmaking-related traffic; verify before opening. |
27000–27030 |
UDP | A broad range appears in one SteamCMD-oriented guide, but it is not proof that every CS2 server needs the whole range. |
27014–27050 |
TCP | Also listed by one guide; treat as a source-specific recommendation, not a universal requirement. |
27015 for RCON |
TCP in an older discussion | The discussion is roughly 3,400 days old and should not be used as current authoritative guidance. |
Valve’s CS2 page points administrators to broader SRCDS networking documentation, but that material is flagged as needing an update. Because the retrieved port lists conflict, use the smallest set that your current Valve documentation and enabled features require. For a basic private server, begin with the configured game port, then add a specific optional port only when a feature fails and authoritative documentation calls for it.
Best Value
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Troubleshoot by symptom
Players on the internet time out, but LAN players can join
- Confirm the router forwards to the host’s current private IPv4 address, not an old DHCP address.
- Verify the external port equals the internal port and matches the
-portargument. - Check the host firewall and, for a VPS, the cloud firewall.
- Test from a genuinely external network; NAT loopback failures can mislead an in-house test.
- Compare the router WAN address with your public address to detect CGNAT or double NAT.
The server works until the computer restarts
The host probably received a different private address. Create a DHCP reservation, update the forwarding destination, and restart the server with the intended launch command. A reservation prevents this recurring failure.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThere are two routers or a modem/router plus your own router
Forward the port on the outer device to the WAN address of the inner router, then forward it again on the inner router to the server’s private address. Alternatively, place one device in bridge or access-point mode if your ISP and hardware support it. Forwarding on only the inner router leaves the outer NAT with no destination.
The ISP uses carrier-grade NAT
CGNAT places multiple subscribers behind an ISP-controlled address, so your router has no independently reachable public IPv4 address. Port forwarding on your equipment cannot bypass that layer. Ask the ISP for a public IPv4 address or a plan that permits inbound connections. If the ISP cannot provide one, a directly reachable hosted server or a private overlay network are different architectures, not fixes to the home-router rule.
The server starts but is not listed publicly
- Check that
+sv_setsteamaccountis present and the GSLT was created for app ID 730. - Generate a replacement token if the existing token was revoked, mistyped, or exposed.
- Read the startup console for Steam authentication errors.
- Confirm that the server is not intentionally bound only to a LAN interface and that
-ip, if used, names the correct interface.
Opening both protocols did not help
TCP and UDP are separate transports. A combined router rule may still be blocked by the host firewall, an upstream firewall, or CGNAT. Test one documented protocol at a time, inspect the server’s listening socket, and avoid expanding to large port ranges simply because a connection failed.
Security and maintenance after it works
- Forward only the required port to the dedicated host; do not place the whole computer in a DMZ.
- Keep the operating system, Steam client files, and CS2 server files updated.
- Use a reserved private IP so the router rule remains stable.
- Restrict RCON or administration interfaces to trusted addresses and credentials; do not expose an administrative port merely because the game port is open.
- Record the chosen port, protocol, host address, launch options, and token memo so you can reproduce the setup after a router reset.
- Recheck the WAN address when friends report a sudden outage; residential public IPv4 addresses can change.
Quick configuration checklist
- Reserve the server computer’s private IPv4 address.
- Record the router gateway and sign in.
- Forward the configured game port (27015 by default) to that private address.
- Allow the same port and protocol through the host firewall and any cloud firewall.
- Launch with
-dedicated, the chosen-port, and optional-ip/-maxplayersvalues. - Create a GSLT for app ID 730 and pass it with
+sv_setsteamaccountwhen public Steam access is needed. - Test locally, then test from another network using
connect PUBLIC_IP:PORT. - If outside access still fails, check double NAT, CGNAT, firewall logs, and the host’s listening socket before opening additional ports.
Frequently asked questions
Can two CS2 servers share one public port?
No. A router cannot send the same address-and-port combination to two different private hosts. Assign each server a distinct port with separate -port, forwarding, firewall, and connection settings.
Does IPv6 eliminate the need for port forwarding?
Not necessarily. IPv6 addressing and inbound filtering depend on your ISP and router, and many players still connect over IPv4. Configure and test the address family your players will use rather than assuming IPv6 is enabled end to end.
Will changing the map or max-player count require a new router rule?
No. +map and -maxplayers affect the server session, not the listening address. A new rule is needed only when the listening port or host address changes.
Why can a port-check website report “closed” while the server is running?
Many generic checkers test TCP only, while a CS2 rule may use UDP. They can also report closed when the server is not listening at the moment of the test. Have an external CS2 client attempt the connection while the server is running and use firewall or socket diagnostics for protocol-specific evidence.
Is a GSLT the same thing as my Steam password?
No. It is a server credential tied to the game application. Store it like a secret, never publish it with a launch script, and revoke it if exposed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
