Port reference
Port 27015 (UDP/TCP) – Source / Steam game server
Default port for Source engine and Steam dedicated game servers, carrying game traffic, A2S server queries, and SourceTV/RCON.
Quick facts
- Transport
- udp, tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on Source engine and Steam dedicated servers (CS:GO, TF2, Garry's Mod). Commonly exposed directly to the internet for public play.
What is port 27015 used for?
Port 27015 is the default for Source engine and Steam dedicated game servers — games like Counter-Strike (CS:GO/CS2), Team Fortress 2, Garry's Mod, and Half-Life. Over UDP it carries the live game traffic and the A2S query that lets server browsers show the map, player count, and ping. TCP on the same port is typically used for RCON remote administration and SourceTV spectating.
When would you open it?
You forward this port when you run your own dedicated game server and want friends or the public to connect over the internet. Set up a port forward (UDP, and TCP if you use RCON) on your router to the host machine, and only while the server is running. If you rent a server from a game host, this is handled for you.
Is it safe to open?
The A2S query can be abused to amplify denial-of-service traffic, so rate-limit queries and protect RCON with a strong password. See the security notes below.
How to check if this port is open
ss -tulpn | grep :27015
nmap -p 27015 <target>netstat -ano | findstr :27015
Test-NetConnection <host> -Port 27015lsof -i :27015
nmap -p 27015 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 27015 to your device's local IP, internal port 27015, protocol TCP/UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 27015/tcpsudo firewall-cmd --permanent --add-port=27015/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 27015 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 27015" -Direction Inbound -Protocol TCP -LocalPort 27015 -Action AllowSecurity & risks
Common attacks
- A2S query reflection/amplification DDoS using spoofed source IPs
- Volumetric DDoS to knock game servers offline
- RCON brute force and abuse for server takeover
- Malformed query/packet flooding causing crashes
Hardening
- Rate-limit and filter A2S queries to blunt reflection abuse
- Set a strong RCON password and restrict RCON source IPs
- Front the server with DDoS scrubbing and connection rate limits
- Keep the game server software patched against query parser bugs
- Disable unused query/SourceTV ports and run as an unprivileged user
How to block this port
sudo ufw deny 27015/tcpsudo firewall-cmd --permanent --remove-port=27015/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 27015 -j DROPNew-NetFirewallRule -DisplayName "Block 27015" -Direction Inbound -Protocol TCP -LocalPort 27015 -Action Blocknmap snippet
nmap -sU -p27015 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why is port 27015 used in DDoS reflection?
- Source servers answer A2S queries (A2S_INFO/A2S_PLAYER) with responses larger than the request. An attacker spoofs the victim's IP, sends queries to many servers, and the amplified replies flood the victim — a UDP reflection/amplification attack.
- Does port 27015 use TCP or UDP?
- Primarily UDP for game traffic and A2S queries, with TCP used for RCON and some services. The UDP query interface is what makes it abusable for amplification, so rate-limit it.