How to Make a Team Fortress 2 Server: Step-by-Step Setup Guide

To make a Team Fortress 2 server, install Valve’s free dedicated-server files with SteamCMD (Steam app ID 232250), launch them with srcds.exe on Windows or srcds_run on Linux, configure tf/cfg/server.cfg, and forward UDP port 27015 to the host computer. A Game Server Login Token (GSLT) for TF2 App ID 440 is recommended for public browser visibility, although friends can still join directly by IP without one. The guide below covers self-hosting, managed hosting, firewall and router setup, testing, updates, and the fixes for the connection problems that most often stop friends from joining.

Which way should you host a TF2 server?

You have two practical choices: run the dedicated server on a computer you control, or rent managed hosting. Self-hosting costs no separate server license and gives you complete access to files and settings, but you must maintain SteamCMD, updates, firewall rules, router forwarding, restarts, and uptime. Managed hosting moves those jobs to a provider and is usually easier when you do not want a machine running at home.

Consideration	Self-hosted server	Managed hosting
Control	Full control of launch options, configuration files, maps, logs, and operating-system settings.	Control is limited to the provider’s panel, plan, and file access.
Recurring cost	No separate hosting bill; you supply the computer, connection, electricity, and maintenance.	A recurring provider charge applies; exact pricing depends on location, slots, storage, and support.
Port forwarding	You must forward the game port and permit it through the host firewall.	The provider normally supplies the public network path, so home-router forwarding is not required.
Updates and restarts	You run SteamCMD updates and create your own startup or restart automation.	Panels commonly provide update and restart controls, but the exact behavior varies.
Public discoverability	You configure a GSLT, networking, and server visibility yourself.	The host generally handles the network address, while token and game settings remain your responsibility.
Troubleshooting ownership	You diagnose the operating system, router, firewall, SteamCMD, and TF2 process.	You handle game configuration; the provider handles the underlying machine and service network.

Choose self-hosting if you want unrestricted access and are comfortable administering a PC or Linux machine. Choose managed hosting if reliable uptime and a ready-made control panel matter more than low overhead and maximum control.

What do I need before installing the server?

• A Windows or Linux computer that can remain powered on while people play.
• Administrative access to install SteamCMD, create files, and allow a program through the operating-system firewall.
• Router access, if the server is at home, so you can create a port-forwarding rule.
• The server’s local network address, preferably reserved in the router so the forwarding rule does not break after a reboot.
• A map name and a planned player-slot count. The slot count is a configuration value, not a guaranteed performance limit; actual capacity depends on the machine and connection.
• For a public community server, a Steam account able to create a TF2 Game Server Login Token.

Steam Support states that Steam dedicated servers use SteamCMD to download and update their files. The TF2 dedicated-server package is distributed under app ID 232250, separate from the ordinary game client.

How do I install the TF2 dedicated server with SteamCMD?

Install the current SteamCMD build for your operating system, open a SteamCMD prompt, and install the files into a directory reserved for the server. Use a quoted Windows path when it contains spaces.

1. Download and extract SteamCMD from Valve’s current distribution for Windows or Linux.
2. Start steamcmd (or the SteamCMD executable supplied by your operating system).
3. At the SteamCMD prompt, enter:

force_install_dir "/path/to/tf2-server"
login anonymous
app_update 232250 validate
quit

On Windows, replace the path with a location such as C:TF2Server. On Linux, use an absolute directory such as /srv/tf2-server and ensure the account running the service can read and write it. app_update 232250 downloads or updates the dedicated server; validate checks the installed files and replaces damaged or missing files. Run this command again whenever the server needs to catch up with a client update, then restart the server.

Keep the SteamCMD directory separate from the server directory. That makes it easier to update the files without confusing the updater with the game’s configuration and log files.

How do I start the server on Windows or Linux?

The executable and launch syntax differ slightly by operating system, but both commands need the TF2 game directory, a starting map, and a player-slot argument.

Operating system	Example command	What to change
Windows	srcds.exe -console -game tf +map cp_dustbowl +maxplayers 24	Run it from the server installation directory; replace the map and slot count as needed.
Linux	./srcds_run -game tf +map cp_dustbowl +maxplayers 24	Run it from the installation directory and make sure srcds_run is executable.

-console keeps the Windows process in a console window. -game tf selects Team Fortress 2, +map chooses the first map, and +maxplayers sets the advertised slot count for that launch. A successful start prints startup messages, loads the requested map, and leaves the server process running rather than returning immediately to the shell.

Do not close the console or terminal when people are playing. For unattended operation, launch the command from a Windows batch file or a Linux service manager so it can start after a reboot and be restarted after a crash.

How do I configure maps, passwords, and server settings?

What belongs in server.cfg?

Create a plain-text file at tf/cfg/server.cfg. TF2 executes this persistent command file during map startup, so settings placed there are reapplied as new maps load. A minimal starting file can look like this:

hostname "My TF2 Server"
sv_lan 0
sv_password ""
rcon_password "replace-this-with-a-long-random-secret"

Replace the hostname with a name your friends will recognize. Leave sv_password empty for an open server; set it to a private passphrase when only invited players should join. Set an rcon_password only if you intend to administer the server remotely, and use a long, unique value that is not shared with any other account. If you do not need RCON, do not configure or expose it.

sv_lan 0 is the internet setting. A LAN-only value can make the server visible to computers on the same home network while preventing normal internet connections. Keep comments in the file for unusual choices, but avoid placing secrets in scripts or public documentation.

Where do I set the map rotation?

Map rotation belongs in mapcycle.txt, normally in the TF2 installation directory, or in whichever map-cycle file you explicitly configure. Put one valid map name on each line. Do not try to maintain a long rotation by repeatedly adding +map arguments; that option selects the initial map only.

After editing the rotation, restart the server or change maps so the process reloads the file. If a map fails to load, check spelling, confirm that the map exists in the server’s map directory, and watch the console for the exact filename it attempted to use.

How do I open the server to internet players?

Internet play normally requires both a host-firewall rule and a router-forwarding rule. The default TF2 dedicated-server gameplay port is UDP 27015.

1. Find the server computer’s local IPv4 address, such as 192.168.1.50. Reserve that address in the router if possible.
2. In the operating-system firewall, allow the server executable to receive inbound UDP traffic on port 27015.
3. In the router’s port-forwarding page, create a rule for external UDP port 27015 to the server computer’s local IPv4 address and UDP port 27015.
4. Keep the server running while you test from a network that is not your home LAN.

Traffic	Port and protocol	Use	Exposure guidance
Gameplay	UDP 27015	Default dedicated-server player traffic.	Forward and permit it for internet play.
Source RCON	TCP 27015 by default	Remote administration when RCON is enabled.	Allow it only when deliberately configured; restrict access where your firewall supports it.
SourceTV	Additional UDP port	Broadcasting SourceTV when that feature is enabled.	Use the current TF2 server documentation for the selected port before forwarding it.

Do not forward every port listed in a general Steam client port guide. Forward only the ports required by the features you actually use. If your internet provider places your router behind carrier-grade NAT (CGNAT), inbound forwarding may not work even when the local rule is correct; ask the provider whether a public IPv4 address or another hosting arrangement is available.

Should I create a Game Server Login Token?

For a public server, yes. Create a Game Server Login Token (GSLT) through Steam’s game-server management page and select TF2 App ID 440. Supply the token when starting the server with +sv_setsteamaccount TOKEN, replacing TOKEN with the value issued for your server.

A token improves registration with the community-server system and browser discoverability. An anonymous server can still accept direct connections, but it is not normally listed in the browser in the same way as a token-registered server. Token policies and account requirements can change, so check Steam’s current management page if creation or registration behavior differs from these steps.

Operation mode	Browser visibility	Administration
Anonymous	Direct-IP joining can work, but normal browser discoverability is limited.	No token to manage; you still maintain the machine, network, and updates.
GSLT registered	Better suited to community-server registration and browser listing.	Store the token privately and include it in the launch configuration.

Do not post the token in screenshots, public configuration repositories, or chat. If it is exposed, treat it as compromised and follow Steam’s current token-management procedure.

How do I test the server before inviting friends?

Test on the host computer

1. Start the server and confirm that it reaches the requested map without a fatal error.
2. From the TF2 client on the same computer, open the developer console and use connect 127.0.0.1:27015.
3. Confirm that the hostname, password behavior, map, and slot count match the settings you intended.

If the local connection fails, solve the server-process or firewall problem before testing the router. Check the console for a missing file, invalid command, or port already in use.

Test from outside the LAN

Use a phone hotspot, a friend’s connection, or another internet connection. In the TF2 console, enter:

connect public-ip:27015

Replace public-ip with the home network’s public address. A successful outside connection proves that the process, firewall, router rule, and internet path work together. If the host can connect locally but an outside tester cannot, focus on forwarding, the host firewall, sv_lan 0, the selected local IP, and possible CGNAT.

How do I keep the server updated and running?

Stop the server cleanly before updating its files. From SteamCMD, run:

force_install_dir "/path/to/tf2-server"
login anonymous
app_update 232250 validate
quit

Start the server again with the same launch options and watch the console for errors. Clients that report an older server version normally need the server updated and restarted before they can join.

For Windows, save the launch command in a .bat file in the installation directory. For Linux, use a shell script or a service manager such as systemd to start the process after boot, restart it when it exits, and write logs to a known location. Keep a backup of server.cfg, mapcycle.txt, and any custom configuration before running validation or replacing server files.

Schedule maintenance for times when nobody is playing. Updates can change files or behavior, and a restart is required for the running process to load the new version.

What is different about Windows and Linux hosting?

Area	Windows	Linux
Launch file	srcds.exe	srcds_run
Ease of first setup	Familiar graphical file and firewall tools for many home administrators.	Efficient for a headless machine, but requires comfort with a terminal, permissions, and service management.
Automation	Batch files and Windows startup or task tools can launch and restart the server.	Shell scripts and service managers can handle boot startup, restarts, and log collection.
Current dependency check	Use the dependencies supplied by the current Windows server package.	A native 64-bit Linux executable was introduced in 2024; current files may require libcurl-gnutls (the package name differs by distribution, including Ubuntu 24.04). Verify the executable and dependency requirements before standardizing a script.

The choice is mostly administrative. Pick the operating system you can patch, secure, and troubleshoot reliably rather than assuming one has a universal performance advantage; no authoritative performance figures establish a fixed player capacity for either platform.

Why can’t my friends see or join my TF2 server?

The server starts, but nobody outside the house can connect

• Confirm the router forwards UDP 27015, not only TCP.
• Confirm the forwarding destination is the server’s current local IP address.
• Allow the server executable or UDP 27015 through the host firewall.
• Check that sv_lan 0 is in tf/cfg/server.cfg and that the server was restarted after editing it.
• Test from a genuinely external connection rather than another device on the same LAN.
• Check for CGNAT or a second router. A port-forward on the inner router cannot receive traffic that never reaches the home network.

The server appears only in the LAN list

Treat forwarding and LAN mode as the first checks. A missing GSLT can also explain poor browser discoverability for an otherwise reachable public server; use direct-IP testing to separate registration problems from basic connectivity.

Players report that the server is out of date

Stop the process, run app_update 232250 validate in SteamCMD, and restart the server. Updating files while the old process is still running does not update the code already loaded in memory.

RCON does not work

• Set a deliberate rcon_password in tf/cfg/server.cfg and restart or reload the map.
• Permit TCP 27015 in the host firewall if you are using the default RCON port.
• Check that the RCON client is pointed at the correct public address and port.
• Do not expose RCON to the internet when you do not need it; remove the rule or restrict it to trusted addresses.

The Linux 64-bit executable will not launch

Check the current server files and the distribution’s package manager for the libcurl-gnutls dependency noted for the newer native 64-bit build. Dependency names and package versions vary by distribution, so verify the requirement against the files you actually downloaded rather than copying a package name from an older guide.

What security and reliability checks should I make?

• Use a unique, long RCON password and never publish it with your launch script.
• Use sv_password for private sessions instead of relying on an obscure hostname.
• Forward only the game port and any feature-specific port you intentionally use.
• Keep SteamCMD and the dedicated-server files updated, then restart after updates.
• Back up configuration and map-cycle files before editing or validating the installation.
• Reserve the server’s local IP so a reboot does not silently invalidate the router rule.
• Record the launch options, token location, firewall rules, and router destination so another administrator can recover the service.

These practices do not guarantee uptime or a particular player count, but they remove the configuration mistakes that most often make a correctly installed server unreachable or difficult to administer.

Frequently Asked Questions

Can I run a TF2 server without a Game Server Login Token?

Yes. An anonymous server can accept direct connections when its network path is working, but it generally will not have the same community-browser discoverability as a token-registered server. A GSLT is therefore optional for private testing and much more useful for a public community.

Do I need to forward TCP 27015 for ordinary gameplay?

No. Ordinary dedicated-server gameplay uses UDP 27015. TCP 27015 is the default Source RCON port, so forward or allow it only when you have intentionally enabled remote administration.

What should I do if my router has two port-forwarding pages?

Identify which device actually owns the public internet address. If an ISP modem and a separate home router both perform routing, the traffic may need forwarding through both devices, or the modem may need bridge mode; otherwise the inner router never receives the connection.

Where should I store the server token and RCON password?

Keep both in files readable only by the account that runs the server, and do not paste them into public repositories, screenshots, or support posts. If either secret is exposed, replace it through the relevant Steam or server-administration procedure before continuing to host.