How to Set Up a Firewall for a Game Server

A game server needs a very specific set of ports open — the game's own port, maybe a query port — and nothing else. Leaving other ports exposed is an open invitation. This guide sets up a firewall that lets players in, keeps RCON and admin ports private, and shuts everything else, using UFW on Ubuntu.

The principle: default-deny, then open exactly what the game needs

Start by denying all inbound traffic and allowing only what's required. First — always — allow SSH so you don't lock yourself out:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable

If you followed harden SSH and moved to a custom port, allow that port instead. Our full UFW guide has the details.

Know your protocol: TCP vs UDP

This trips people up constantly. Many games use UDP, not TCP, for gameplay. If you open the wrong protocol, players can't connect. Common examples:

• Minecraft (Java): TCP 25565
• Minecraft (Bedrock): UDP 19132
• Rust: UDP 28015 (game), TCP 28016 (RCON)
• Valheim: UDP 2456–2458
• CS2 / Source games: UDP 27015 (plus TCP 27015 for RCON)
• 7 Days to Die: UDP 26900–26903, TCP 26900

Check your specific game's docs — our game setup guides like set up a Minecraft server list the exact ports.

Open the game ports

For Minecraft Java:

sudo ufw allow 25565/tcp

For a Valheim server (UDP range):

sudo ufw allow 2456:2458/udp

For Rust:

sudo ufw allow 28015/udp

{{SCREENSHOT}}

Lock down RCON — do not expose it publicly

RCON is remote admin access to your server. If it's reachable from the internet with a weak password, someone can take over your game. Never open RCON to everyone. Restrict it to your own IP only:

sudo ufw allow from 203.0.113.7 to any port 28016 proto tcp

Better still, don't open it at all and access RCON over an SSH tunnel. The same logic applies to any admin/query port.

Rate-limit and add bans

Game ports attract scanning and abuse. Rate-limit SSH and add fail2ban to ban persistent offenders:

sudo ufw limit OpenSSH

Understand the DDoS limit

A firewall shuts unused doors, but it can't stop a volumetric flood that saturates your network link — that needs upstream protection. This is a bigger issue for game servers, which are common DDoS targets. Read DDoS protection for game servers and the general DDoS protection basics for what you can and can't do yourself.

Whitelisting a home connection with a changing IP

Restricting admin ports to your own IP is great until your home IP changes, as most residential connections do. A few practical options:

• Use a small cloud jump host with a static IP, allow only that IP to your admin ports, and SSH through it. Clean and stable.
• Update the rule with a script when your IP changes — a dynamic DNS hostname plus a cron job that resolves it and refreshes the UFW rule.
• Reach admin ports over an SSH tunnel instead of opening them at all: ssh -L 28016:localhost:28016 deploy@server forwards RCON to your local machine with nothing exposed publicly. This is the most secure option and needs no firewall changes when your IP moves.

For most people running a game server, the SSH tunnel approach is both the safest and the least hassle — the admin port simply never faces the internet.

Per-region and community considerations

If you run a community server, you may want to think about *who* connects, not just which ports. You generally shouldn't geo-block your game port (you'll shut out legitimate players), but you can absolutely restrict *administrative* access to known locations. Keep the player-facing port open to everyone and lock everything else down tight. And remember that a firewall protects the host, not the game's own permission system — set up in-game admin roles, whitelists, and RCON passwords properly too, since those are separate layers. The firewall decides what's reachable; the game decides what's allowed once connected. Both matter, and a strong password on RCON is non-negotiable even when the port is IP-restricted.

Verify players can connect

After configuring, test from outside — have a friend connect, or use a port checker for the specific protocol. Remember a UDP port won't respond to a TCP check, so use the right tool. List your rules any time with:

sudo ufw status numbered

FAQ

My players can't connect after enabling the firewall — why?

Almost always a protocol mismatch. Many games use UDP; if you opened TCP only, connections fail. Double-check your game's exact port and protocol.

Should I open RCON to the internet?

No. RCON is admin access — restrict it to your own IP or use an SSH tunnel. An exposed RCON port with a weak password is a full server takeover risk.

Can a firewall stop DDoS on my game server?

It stops unwanted ports and small floods, but not a large volumetric attack that fills your uplink. That requires network-level mitigation from your host.

How do I find my game's ports?

Check the game's dedicated-server documentation, or our per-game setup guides which list the exact TCP/UDP ports to open.

Game server firewall checklist

The pattern is the same whatever game you run:

• Allow SSH first, then ufw enable — never lock yourself out.
• Open only the game's exact ports, and get the protocol right (many games are UDP, not TCP).
• Never expose RCON or query ports publicly — restrict them to your IP or reach them over an SSH tunnel.
• Rate-limit SSH and add fail2ban for persistent offenders.
• Understand the limit: a firewall shuts unused doors but can't stop a volumetric DDoS — that needs upstream mitigation.
• Verify from outside with the correct protocol, and don't forget the game's own admin passwords and whitelists.

The single most common failure is a protocol mismatch — players can't connect because you opened TCP when the game uses UDP. Check your game's dedicated-server docs (or our per-game setup guides) for the exact ports and protocol, open precisely those, and keep everything else denied. That combination — open to players, closed to everyone else, with admin access tunnelled rather than exposed — is what keeps a game server both playable and safe.

A tight firewall keeps your game server open to players and closed to everyone else. Host on infrastructure built for low-latency play — see game server hosting and our security page.