On this page
Almost every "my friends can't connect" and "my server isn't in the list" report comes down to one of three UDP ports. This page covers what each one does, what specifically breaks when it is blocked, and how to tell a port problem apart from the config problems that look identical from the outside.
The three ports#
| Port | Protocol | Config field | Purpose |
|---|---|---|---|
| 2001 | UDP | bindPort | Game traffic. Players connect over this. |
| 17777 | UDP | a2s.port | Steam A2S queries. Server browsers and list sites poll this. |
| 19999 | UDP | rcon.port | BattlEye RCON. Remote administration only. |
What breaks when each one is blocked#
Symptoms are specific enough to diagnose from, which is why it is worth reading these before changing anything:
2001/UDP blocked — the server appears in the browser but joins time out or fail at the connecting stage. The listing works because that is a different port.
17777/UDP blocked — the server runs fine and players who already know the direct address can join, but it never shows up in the server browser and third-party list sites show it as offline. This is the one people misdiagnose as a game.visible problem.
19999/UDP blocked — gameplay is completely unaffected. Only RCON clients fail to connect. If you are not using RCON you will never notice.
Changing the ports#
Each port is a field in config.json. If you run more than one Reforger server on the same machine, every server needs its own set:
{
"bindPort": 2001,
"a2s": {
"port": 17777
},
"rcon": {
"port": 19999
}
}
For a second server on the same host, step all three: 2002, 17778, 19999 → 20000. Two servers sharing a port will not both start, and the one that fails does so with an unhelpful bind error.
publicPort also exists and defaults to 2001. Leave it empty or equal to bindPort — it exists for NAT setups where the externally visible port differs from the one the server binds. See config.json explained for why the address and public-port fields are usually best left alone.
Self-hosting on your own hardware#
If the server runs on a machine behind your own router, you need to forward all three ports as UDP to that machine's local IP, and allow them through the host firewall.
On Linux with ufw:
sudo ufw allow 2001/udp
sudo ufw allow 17777/udp
sudo ufw allow 19999/udp
On Windows, add inbound UDP rules for the same three ports. Then forward them in the router to the machine's LAN address.
Two things to watch for that are not really port problems but present as them:
- Testing from inside your own network. Many consumer routers do not support NAT hairpinning, so connecting to your own public IP from the same LAN fails even when everything is configured correctly. Test from a connection outside your network before concluding the ports are wrong.
- CGNAT. If your ISP puts you behind carrier-grade NAT, no amount of port forwarding will make the server reachable, because you do not control the public address. A rented server is the practical answer here.
Hosted servers#
On a rented server there is nothing to forward. The ports are already open and reachable, which is useful diagnostically: it removes the entire category from your list. If a hosted server is unreachable, the cause is almost always the config or a version mismatch, not the network.
Work through the server browser checklist instead.
Verify it worked#
- Confirm the server has finished loading its scenario. A loading server does not advertise on 17777 yet, so a check run too early looks like a blocked port.
- Search for the server by name in the in-game browser. Success here means 17777 is reachable.
- Join it from a connection outside your own network. Success here means 2001 is reachable.
- If you configured RCON, connect an RCON client. Success here means 19999 is reachable.
Steps 2 and 3 test different ports, so run both — passing one tells you nothing about the other.
Trusted references#
- Arma Reforger: Server Hosting — Bohemia Interactive's official hosting documentation
- Arma Reforger: Server Config
