Which Ports and Filters Your Server Needs in GlitchGuard

Finding Your Ports

Your server listens on specific ports. You need to allow each one your users connect to. There are four ways to find them.

From your game's documentation or launch settings

Every game server documents its default ports, and your start command or config file shows the ones you have set. Look for words like port, queryport, rconport, gameport, +port, -port, server.port, QueryPort, Port=.

From your game panel

If you run the server through a panel (Pterodactyl, WISP and similar), the server's Allocations or Network page lists every port assigned to it. Each one that players or tools connect to needs a row.

From the server itself (Linux)

This lists every port something is listening on. The left columns show tcp or udp and the port after the colon. Ignore anything bound to 127.0.0.1, which is local only and does not need a rule.

From the server itself (Windows)

In PowerShell:

Or netstat -ano in a command prompt.

If a port appears in those listings but nobody connects to it from outside (a database only your own web app uses, for example), you do not need to open it, and leaving it closed is safer.

Game Port Versus Query Port

Many Steam games use two ports: the game port that players connect to, and a query port that the Steam server browser and tools like Battlemetrics use to ask "what is this server, how many players". Sometimes they are the same number (Source engine, 27015). Often they differ (ARK: game 7777, query 27015; DayZ: game 2302, query 27016). You need both.

If the query port is missing or wrong, your server works for players who connect directly but does not appear in server lists.

Choosing a Filter for a UDP Port

• Your game is on the Source engine (CS2, CS:GO, Garry's Mod, TF2, Left 4 Dead 2 and other Valve games) and game and query share a port: Steam query + game.
• The port is a dedicated Steam query port (ARK 27015, DayZ 27016, Squad 27165, Valheim 2457, Arma 3 2303, Palworld 27015, Unturned 27016, 7 Days to Die 26901): Steam query only. Nothing except queries belongs on that port, so anything else is dropped.
• The game uses RakNet (Rust game port, Minecraft Bedrock, SA-MP's underlying transport): RakNet.
• SA-MP or open.mp game port: SA-MP query + game.
• A WireGuard endpoint: WireGuard only.
• An OpenVPN UDP endpoint: OpenVPN only.
• Anything else, or you are not sure: Rate limited. This passes all traffic on the port subject to flood limits and is always safe to choose.

TCP ports have one filter, SYN proxy, which is always right.

Quick Reference for Common Servers

Presets exist for all of these. The table is for checking your own ports against them, and for spotting the extra TCP rows (RCON, admin tools) that are easy to forget.

Limits and Good Practice

• Up to 32 rules per IP.
• Up to 64 UDP ports per IP can carry a protocol filter (Steam query, RakNet, SA-MP, WireGuard, OpenVPN). Ranges count port by port, so a 200-port range on Rate limited is fine but on Steam query only is not.
• Open only what you use. Every closed port is one that cannot be attacked.
• Prefer a protocol filter over Rate limited whenever your protocol is supported. It is stricter and catches attacks Rate limited lets through.
• Keep Ping on unless you have a reason to hide the server; uptime monitors need it.
• After any change, test every service you run, not just the one you changed.

Frequently Asked Questions

Next Steps

If you have not set the panel up yet, start with the GlitchGuard setup guide. Terms like SYN proxy and query cache are explained in the glossary, and if a service stopped responding after a change, the troubleshooting guide lists the usual causes.