For a private Team Fortress 2 server, put persistent gameplay, security, voice, and download rules in tf/cfg/server.cfg. Put the initial map, player limit, port, and other startup controls on the launch command. A dependable friends setup uses a password, a long random RCON secret, sv_lan 0, sv_cheats 0, team auto-balance, a 30-minute map limit, explicit round limits, and deliberate choices for critical hits, voice, bots, and custom-file downloads.
TF2 runs at a fixed 66-tick server rate, so leave -tickrate out. The profile below is a transparent starting point rather than a Valve-mandated “best” configuration; adjust the policy settings to match how your group actually plays.
What belongs in server.cfg, and what belongs on the launch line?
The launch line is read once when the dedicated server starts. Use it for the game directory, console mode, port, first map, slot count, and any Steam account argument. server.cfg is read when a map loads and is run again after every map change, making it the right place for rules that must persist.
Create the file at tf/cfg/server.cfg if the installation did not include one. Lines beginning with // are comments. After saving edits, run exec server.cfg in the server console, or restart the server. If a hosting panel writes its own configuration after yours, put startup-only values in the panel’s launch settings instead of duplicating them in server.cfg.
Example Linux launch command
./srcds_run -game tf -console -usercon -port 27015 +maxplayers 12 +map cp_badlands+maxplayers and +map are startup examples, not universal requirements. Choose a slot count and first map that fit your group. The same principle applies on Windows or when a control panel presents these values as separate fields.
Why duplicate settings cause confusion
A value can appear correct in the file you edited and still be wrong in the running server if a launch script, provider template, or panel applies another value later. Keep one authoritative location for each startup setting. Put +maxplayers, the initial +map, the port, and account-related startup arguments in the launch configuration. Keep recurring rules in server.cfg. After a restart, read the console output and verify the effective values rather than assuming the last file you opened won.
What is a good baseline server.cfg for friends?
Use this as a vanilla-oriented starting point. Replace both password placeholders before the server is reachable from the internet.
hostname "Friends TF2 | EU | vanilla"
sv_password "replace-with-a-private-password"
rcon_password "replace-with-a-long-random-secret"
sv_lan 0
sv_cheats 0
sv_pure 1
mp_autoteambalance 1
mp_teams_unbalance_limit 1
mp_timelimit 30
mp_maxrounds 5
mp_winlimit 0
mp_friendlyfire 0
sv_alltalk 0
sv_voiceenable 1
sv_allowdownload 1
sv_allowupload 0
mapcyclefile "mapcycle.txt"
// Optional policy choices:
// tf_weapon_criticals 0
// tf_damage_disablespread 1
// tf_use_fixed_weaponspreads 1
// mp_disable_respawn_times 0
// tf_bot_quota 0
// sv_downloadurl "https://files.example.com/tf/"Keep the optional lines commented until you have decided on them. A comment is not an active setting; remove the two slashes to apply a command. Make a backup copy of a working file before experimenting, and change a few related variables at a time so you can identify which rule changed the experience.
Why these baseline values?
sv_password: A private password keeps random players out. Share it only with the group.rcon_password: RCON is full server administration. Use a long, unique random value and never reuse an account password.sv_lan 0: Allows internet connections. Set it to1only for a strictly local LAN server.sv_cheats 0: Prevents cheat-gated commands during normal play.sv_pure 1: Applies the full file rules with a whitelist, favoring consistent client files.mp_autoteambalance 1andmp_teams_unbalance_limit 1: Keeps teams from remaining uneven when players join or leave.mp_timelimit 30: Sets a 30-minute map limit; change it if your group prefers shorter or longer sessions.mp_maxrounds 5andmp_winlimit 0: Caps a map at five rounds without imposing a separate win-limit ending.mp_friendlyfire 0: Disables teammate damage for a relaxed group.sv_alltalk 0andsv_voiceenable 1: Enables voice while keeping communication team-only. All-talk is a separate social choice.sv_allowdownload 1: Lets clients receive files the server makes available.sv_allowupload 0: Refuses client uploads unless you have a specific reason to accept them.
Choosing map and round limits deliberately
mp_timelimit limits how long a map can remain active, while mp_maxrounds limits the number of rounds. A 30-minute, five-round baseline works for a small group that wants a clear endpoint without an unusually long session. mp_winlimit 0 leaves a win-limit ending disabled, so the round cap and time limit remain the predictable boundaries. If your group prefers best-of formats, change the round and win settings together and test them on the maps you actually play.
Which gameplay settings should your group choose?
There is no single best rule set. The following choices describe the practical difference between a casual-friendly server and a more competitive-feeling one.
| Gameplay axis | Casual-friendly choice | Competitive-feeling choice |
|---|---|---|
| Random critical hits | Leave tf_weapon_criticals 1 |
Set tf_weapon_criticals 0 |
| Damage variation | Default spread | tf_damage_disablespread 1 |
| Shotgun pellet spread | Default spread | tf_use_fixed_weaponspreads 1 |
| Respawns | Use map-default wave times | Consider mp_disable_respawn_times 1 only for a mode that wants instant returns |
| Team balance | mp_autoteambalance 1 |
Keep it on unless the group is deliberately scrimming |
| Voice | sv_alltalk 0 for team communications |
sv_alltalk 1 for a social cross-team room |
| Bots | tf_bot_quota 0 when friends fill the slots |
Add a quota only when filling empty slots is intentional |
Random critical hits, damage spread, and fixed weapon spread
Random crits add surprise swings to ordinary matches. Leaving tf_weapon_criticals at 1 preserves the familiar public-server feel; setting it to 0 removes random critical hits for a more predictable match.
tf_damage_disablespread 1 removes random damage variation. tf_use_fixed_weaponspreads 1 makes pellet patterns deterministic for weapons that use spread. These settings reward repeatable aim and timing, but can feel less forgiving in a purely social game.
Do not treat these three commands as a single “competitive switch.” You can disable random crits while retaining ordinary damage spread, or use fixed pellet patterns without changing crits. Record the choices in a comment in your configuration so returning players know why the server feels different.
Respawn times, auto-balance, and bots
Leave mp_disable_respawn_times 0 to retain each map’s normal respawn-wave behavior. Setting it to 1 creates instant returns and should be reserved for a mode that specifically wants that pace.
Auto-balance is usually less disruptive than manually moving players. Keep mp_autoteambalance 1 for mixed-skill groups; disable it only when everyone has agreed to a scrim-style arrangement. A bot quota is useful when people are missing, but tf_bot_quota 0 avoids filling a private server unexpectedly. If bots are appearing when nobody invited them, check both this value and any panel or plugin that may apply a separate quota.
Voice and all-talk
sv_voiceenable 1 permits in-game voice. With sv_alltalk 0, players hear their own team, which is useful for coordinated matches. Set sv_alltalk 1 when the priority is conversation between both teams rather than tactical secrecy. Voice policy is independent of the password: a private server can still use team-only voice, all-talk, or voice disabled entirely.
How do you set map rotation and custom-map downloads?
Put one map name per line in mapcycle.txt. The baseline’s mapcyclefile "mapcycle.txt" tells the server which rotation file to use. Keep the file in the location expected by your server installation and use exact map names, such as cp_badlands. Avoid adding comments or extra punctuation to a line intended to be a map name, and test every entry manually.
Serving custom maps
Clients need a reachable source for every required map and asset. Keep sv_allowdownload 1 enabled when clients must receive server files. For faster delivery, set sv_downloadurl to a web endpoint containing the matching directory structure and files, then test that URL from outside the server machine before inviting players.
The endpoint must be available without authentication and must return the actual files, not an HTML directory page. A failed FastDL setup commonly appears as a download that stalls, a missing-map error, or clients being disconnected while joining. Check the URL, file names, and permissions before changing gameplay settings. The path on the web host must mirror the game-relative path requested by the client; a map stored in the wrong subdirectory can produce the same symptom as a broken URL.
Leave sv_allowupload 0 unless your group has a clear reason to accept uploads. Uploads increase the amount of untrusted content the server receives and are unnecessary for the normal custom-map download flow. Keep the web endpoint limited to the files players need, and test it with a separate client rather than relying only on a browser on the server machine.
How should you handle file consistency with sv_pure?
The documented modes are:
-1: Unrestricted client files.0: Minimal file rules.1: Full rules plus a whitelist.2: Official Steam content only.
sv_pure 1 is a sensible friends-server default when everyone should see consistent materials and sounds. Choose sv_pure 0 when the group intentionally allows more client customization. The stricter official-content mode can reject custom content, so do not select it while planning a custom-map rotation without checking the mode’s compatibility first.
Changing sv_pure is a policy decision, not a performance tweak. Tell players what to expect before they join: a consistency-oriented setup may block a favorite custom material, while a permissive setup can make visual or audio differences part of the match. If a custom map fails only after changing purity, revert to the last known working mode and test the map and required assets together.
Do you need a GSLT for a private TF2 server?
The answer depends on how you intend to expose the server, and current guidance is not perfectly consistent. One Valve statement reproduced in a 2026 hosting guide says a login token is not required to run a game server, but helps Steam users keep the server in their Favorites if its IP changes. Another current guide describes a token as effectively mandatory for public browser listing.
Treat the token as a policy question rather than a setting to paste blindly into server.cfg. Check the current Steam or Valve requirements for your intended listing method before launch. A password-protected friends server can remain private even when you choose not to advertise it publicly. If you later switch from private invitations to a public listing, recheck the policy instead of assuming the original setup still qualifies.
How do RCON, SourceMod, and MetaMod fit together?
RCON is the built-in remote console. The basic flow is to set rcon_password yourpassword and then issue commands with rcon <command>. Anyone who obtains that password can administer the server, so restrict access and rotate the secret if it leaks. Do not paste the secret into public chat, screenshots, issue trackers, or a shared configuration repository.
For a group with several administrators, SourceMod adds menus, per-admin permissions, bans, and player-facing commands. The standard installation uses MetaMod as SourceMod’s prerequisite. Install both only when you need those administration features; a small vanilla server has no requirement for them. Plugins also add configuration files and possible conflicts, so introduce them one at a time and confirm that the base server still starts cleanly.
What hardware and networking capacity does a friends server need?
TF2’s server tick rate is fixed at 66. Valve’s Source networking documentation says the -tickrate option is disabled for TF2, so higher unsupported values are not a sound baseline. Adjust rate limits only when you understand the bandwidth and client effects. A higher number in a launch script does not turn TF2 into a faster-tick game and can create misleading troubleshooting.
| Server profile | Planning estimate | Qualification |
|---|---|---|
| 12–16 slots, vanilla | 1–2 GB RAM and one CPU core | Provider estimate, not a Valve requirement |
| 24 slots, SourceMod and several plugins | 2–3 GB RAM and roughly 1–1.5 CPU cores | Provider estimate, not a measured benchmark or Valve requirement |
These figures are capacity-planning estimates. Actual use changes with plugins, map, tick workload, operating system, and other services sharing the machine. Leave headroom for the operating system, logs, backups, and any web service used for custom files. A small friends server does not need a large machine by default, but it does need enough spare capacity to avoid competing with unrelated workloads.
What should you check before inviting players?
- Confirm the file path: Verify that the active file is
tf/cfg/server.cfg, not a similarly named panel template. - Replace secrets: Set a private
sv_passwordand a unique, longrcon_password. - Verify startup values: Put
+maxplayersand+mapon the launch line or in the panel’s startup fields. - Reload the rules: Run
exec server.cfg, then inspect the console for errors. - Test a map change: Change maps and confirm the password, voice, balance, time, and round rules return.
- Test the rotation: Check every name in
mapcycle.txtmanually before sharing the address. - Test downloads externally: Join from a separate client and confirm custom files arrive from the game server or
sv_downloadurlendpoint. - Check administration: Test RCON from an allowed remote client, and verify SourceMod permissions if installed.
- Record the policy: Tell players whether random crits, damage spread, all-talk, bots, and custom files are enabled.
- Keep a rollback: Save the last working configuration so a plugin, map, or purity change can be undone quickly.
Common failures and fixes
- The map or slot count keeps reverting: A panel or launch script is overriding
server.cfg. Move the value to the startup configuration and remove conflicting copies. - Players cannot connect from the internet: Confirm
sv_lan 0, the listening port, firewall rules, and any router forwarding. - Custom maps fail to download: Check that
sv_allowdownload 1is active, the FastDL URL is reachable, and file names match the map exactly. - RCON does not work: Reload the file, confirm the client is using the current password, and rotate it immediately if it may have been exposed.
- Teams feel unfair: Keep auto-balance enabled, review
mp_teams_unbalance_limit, and decide whether a bot quota is filling slots unexpectedly. - Players see inconsistent materials or sounds: Review
sv_pureand test whether the chosen mode permits the custom content you intend to use. - Rules vanish after a map change: Confirm the commands are in
server.cfg, not only in a one-time console session, then runexec server.cfgand change maps again.
Frequently Asked Questions
How do I reload TF2 server settings without restarting?
Open the server console and run exec server.cfg. Changing maps also causes TF2 to run the file again, so test both a manual reload and a map change after major edits.
Where should I set the maximum player count on a hosted TF2 server?
Set +maxplayers in the launch command or the host’s startup-parameter field. Panel-managed startup values can override a duplicate command in server.cfg.
Can friends use custom HUDs and sounds with sv_pure 1?
sv_pure 1 favors consistent files by applying full rules and a whitelist. If your group deliberately wants broader client customization, consider sv_pure 0 and test the exact content you plan to allow.
What should I do if a FastDL link works in a browser but TF2 still cannot download the map?
Verify that the endpoint exposes the exact game-relative path and file name the client requests, without authentication or an HTML wrapper. Test from a machine outside the server network and check the server console for the requested path.
Should I turn off random critical hits for a friends server?
Leave tf_weapon_criticals 1 for the familiar casual experience. Set it to 0 when your group wants more predictable damage; this choice is independent of damage spread and fixed pellet spread.
What does sv_alltalk change?
With sv_alltalk 0, voice remains team-only. Set sv_alltalk 1 for a social room where both teams can talk. sv_voiceenable 1 must still permit voice overall.
Do I need SourceMod and MetaMod on a small private server?
No. A vanilla server can run without them. Install MetaMod and SourceMod when you need multiple administrators, permission groups, menus, persistent bans, or player-facing commands.
Is a higher TF2 tickrate worth adding to the launch command?
No. TF2 uses a fixed 66-tick server rate, and the -tickrate option is disabled for TF2. Leave it out and focus on capacity, plugins, and network stability.
How many resources should a friends server have?
A provider estimate is 1–2 GB RAM and one CPU core for a 12–16-slot vanilla server. A 24-slot server with SourceMod and several plugins is estimated at 2–3 GB RAM and roughly 1–1.5 cores. Leave additional headroom for the operating system and other services.
Do I need a GSLT for a password-protected server?
Guidance differs by listing goal. A Valve statement reproduced in a 2026 hosting guide says a token is not required to run a server but helps Favorites survive an IP change, while another current guide calls it effectively mandatory for public browser listing. Check current Valve or Steam policy for your intended exposure.
The Bottom Line
For most friend groups, start with a password-protected, 66-tick vanilla server: keep recurring rules in tf/cfg/server.cfg, put +maxplayers and +map on the launch line, use a long RCON secret, and test a full map change before inviting everyone. Then choose crits, spread, voice, bots, purity, plugins, and custom downloads as explicit group policies rather than unexplained defaults.