Recommended Free Tools
For a default Arma 3 dedicated server, forward UDP ports 2302–2306 from your router to the server computer’s fixed private IPv4 address, then allow the same range through the computer’s firewall. Port 2302 carries game and voice traffic, 2303 handles Steam queries, 2304 handles Steam master/reporting traffic, 2305 is the server’s allocated VON port, and 2306 is used by BattlEye. Home-router forwarding is primarily inbound UDP; BattlEye may also require specific outbound destinations when your network uses restrictive egress rules.
Godlike.Host offers hosted Arma 3 servers with its own game panel, SFTP access and free DDoS protection, if you would rather not host it yourself.
The default Arma 3 port block
Arma 3 does not normally use one isolated port. Its dedicated server reserves a five-port UDP block beginning with the configured game port. With the default base port of 2302, the block is 2302 through 2306.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Port | Protocol | Function |
|---|---|---|
| 2302 | UDP | Main Arma 3 game traffic. Voice-over-network (VON) traffic is associated with the main game port because of NAT behavior. |
| 2303 | UDP | Steam query service used for server information and browser discovery. |
| 2304 | UDP | Steam master and “to-master” reporting traffic. |
| 2305 | UDP | VON port allocated by the server. The official note currently identifies it as allocated rather than actively used in every configuration. |
| 2306 | UDP | BattlEye traffic. |
These are configuration values from Bohemia Interactive’s dedicated-server documentation, not measured performance or usage statistics. If you have changed the base port, the numbers move with it rather than remaining at 2302.
Do you need TCP, UDP, or both?
Forward the server block as UDP. The game, Steam query/master functions, VON allocation, and BattlEye server traffic in the default block are assigned UDP ports. Creating broad TCP rules “just in case” does not make the server more discoverable and unnecessarily increases the exposed surface.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
BattlEye’s official network notes also identify outbound destinations at UDP and TCP 2344 and TCP 2345 for arma31.battleye.com. These are egress allowances for a restrictive firewall policy, not extra inbound ports that a typical home router must forward. If your router or host firewall permits normal outbound traffic, no special port-forward rule is usually needed for those destinations.
Requirements before you create a rule
Use a stable private IPv4 address
Port forwarding points to an address on your local network. If the server receives a different DHCP address after a reboot, the router can continue forwarding to the old machine or to nothing at all. Create a DHCP reservation in the router for the server’s network adapter, or configure a static address on the machine that is outside the router’s automatic DHCP pool. Record the address, subnet, gateway, and DNS settings before changing a static configuration.
Know which device is actually on the public internet
The forwarding rule must exist on the router that owns your public IPv4 address. If an ISP modem, mesh gateway, or second router is also performing NAT, you have a double-NAT layout. Either place the downstream router in the upstream device’s bridge or passthrough mode, or forward the same ports through each NAT layer. A server can be configured correctly and still remain unreachable if the rule is made on the wrong device.
Confirm the server is listening
Start the dedicated server and verify that it is configured for the base port you intend to use. A router cannot deliver traffic to a process that is stopped, bound only to another interface, or using a different port. Keep the server’s launch parameters and router rules consistent.
How to forward UDP 2302–2306
- Reserve the server address. In the router’s LAN, DHCP, or Address Reservation section, bind the server’s MAC address to a fixed private IPv4 address. Reconnect or restart the server if the router requires it.
- Open the NAT page. Depending on the router, the menu may be called Port Forwarding, Virtual Server, NAT Rules, or Applications and Gaming. Choose a new custom rule rather than a preset for a different game.
- Select UDP. Set the protocol to UDP. If the interface offers TCP/UDP as one combined choice, use the combined option only when the router cannot create a UDP-only rule; do not add a separate TCP rule without a reason.
- Enter the port range. Use external port 2302 through 2306 and map it to internal port 2302 through 2306. A single range rule is equivalent to five individual rules when the router preserves each port number.
- Choose the destination. Enter the reserved private IPv4 address of the server, not the router’s address and not a public address returned by an internet “what is my IP” page.
- Keep port translation equal. Leave external and internal ports identical unless you deliberately changed the server’s configured base port and understand the resulting mapping. The simplest reliable arrangement is 2302→2302, 2303→2303, through 2306→2306.
- Save and apply. Some routers reload their firewall after applying a rule. Wait for that process to finish, then confirm that the rule is enabled rather than merely saved as a draft.
- Allow the host firewall. Permit inbound UDP 2302–2306 on the network profile used by the server and allow the dedicated-server executable when the firewall asks for an application exception.
- Test from outside the LAN. Use a friend’s connection, a phone hotspot, or another external network. Testing the public address from inside the same home network can fail when the router lacks NAT loopback (also called hairpin NAT), even though outside players can connect.
Do not test by opening a web browser to a UDP port. Browser requests are TCP/HTTP and cannot prove that an Arma UDP listener is reachable. Use an actual Arma client, the server browser, or a UDP-aware diagnostic method.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Host-firewall configuration
Router forwarding and the operating-system firewall are separate controls. The router decides where an internet packet goes; the host firewall decides whether the server computer accepts it. Both must permit the traffic.
Windows
Open Windows Defender Firewall with Advanced Security, create an inbound rule for UDP local ports 2302–2306, and apply it to the network profile that the server uses. If you prefer an application rule, allow the dedicated-server executable and verify that the rule covers private or public profiles as appropriate. Avoid leaving the entire firewall disabled as a troubleshooting shortcut; a narrow port and program rule is easier to audit.
Linux and other Unix-like hosts
Permit inbound UDP 2302–2306 in the active firewall framework, such as UFW, firewalld, nftables, or a distribution-specific front end. The exact command depends on the distribution and existing policy. Check that the rule is attached to the interface and zone through which internet traffic arrives, and that a default-deny policy is not blocking the server process after the port rule is added.
Outbound restrictions
If your organization blocks outbound traffic by default, allow the BattlEye destinations identified in the official documentation: UDP and TCP 2344, plus TCP 2345, for arma31.battleye.com. These allowances are destination-specific egress rules. They do not replace the inbound UDP block used by players.
How the base-port setting changes the numbers
Bohemia’s documentation defines the initial game port with the command-line argument -port=<base>. Its wording is: “To define the Arma 3 Game port used, state -port= **** in your command line arguments (Where **** is the new initial Arma 3 Game, e.g. 2302).”
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
When you choose a new base, Steam-related ports follow fixed offsets. The query port is base +1 and the to-master/reporting port is base +2; the remaining reserved positions continue through base +4.
| Base-port example | Reserved UDP block | Role offsets |
|---|---|---|
| 2302 | 2302–2306 | Game/VON +0; query +1; master/reporting +2; allocated VON position +3; BattlEye +4 |
| 2402 | 2402–2406 | Game/VON +0; query +1; master/reporting +2; allocated VON position +3; BattlEye +4 |
To move a server to base port 2402, change its launch parameter to -port=2402, then change the router and host-firewall rules to UDP 2402–2406. Leaving 2302–2306 forwarded while the process listens on 2402 will not create a working path.
Running more than one Arma 3 server
Each instance needs its own five-port UDP block. Bohemia’s example uses 2302–2306 for the first instance and 2402–2406 for the second. The documentation recommends leaving at least 100 ports between instances and suggests an offset of +200 or +1000 for maximum safety. Wider spacing reduces the chance that Steam query reporting collides with another server’s range or causes information to be associated with the wrong instance.
| Instance | Base port | Forwarded UDP range | Launch parameter |
|---|---|---|---|
| First | 2302 | 2302–2306 | -port=2302 |
| Second | 2402 | 2402–2406 | -port=2402 |
Give each process a distinct configuration and ensure every forwarding rule targets the correct host and internal range. Do not assign overlapping blocks, and do not place an RCON listener inside any instance’s five reserved ports.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBattlEye and RCON port selection
BattlEye occupies the +4 position in the server block, which is 2306 when the base is 2302. RCON is separate. BattlEye’s guidance requires RconPort to avoid the reserved Arma 3 range from gameport +0 through gameport +4. For the default instance, that means keeping RCON outside 2302–2306; for a server based at 2402, keep it outside 2402–2406 as well.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
With multiple instances, choose an RCON port that is outside every reserved block and not already used by another service. Apply a firewall rule for the RCON port only to the administrators or management network that needs it. Do not expose a broad RCON range simply because the game ports are already forwarded.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why a server may not appear in the browser
The router rule points to the wrong address
Compare the forwarding destination with the server’s current private IPv4 address. DHCP changes, Wi-Fi reconnects, and replacing a network adapter can invalidate a rule that used to work. A reservation prevents this recurring failure.
Only the game port was opened
Opening 2302 alone may allow some direct traffic but prevents Steam query or reporting functions from working correctly. The complete five-port block is the supported default arrangement.
The protocol is TCP
Replace TCP-only rules with UDP rules for the server block. A TCP port checker can report “closed” even when the UDP service is correctly reachable, so use an Arma connection or UDP-specific test.
The host firewall still blocks the process
Temporarily inspect the firewall’s blocked-event log rather than turning protection off permanently. Confirm both the UDP port rule and the executable permission, then restore the narrow policy after testing.
The server is listening on another base port
Read the launch command or server log, identify the actual -port value, and calculate the five-port range from that value. Update every layer—router, host firewall, query expectations, and any documentation for players.
Testing is occurring from inside the same network
NAT loopback support varies by router. A failed connection to the public address from a device on the same LAN is not conclusive. Test from a separate internet connection, and have an external player search for the server.
Another NAT layer or carrier-grade NAT is present
Check the router’s WAN address against the public address shown by an independent internet service. If the router has a private WAN address or the ISP places customers behind carrier-grade NAT, ordinary inbound forwarding may not be possible. You may need an ISP-provided public address, bridge mode, or a managed hosting arrangement instead of additional local rules.
Steam reporting is delayed or inconsistent
Query visibility depends on the query and master/reporting ports as well as the game listener. After changing ports, restart the server, allow time for the listing to refresh, and verify the full block rather than repeatedly changing unrelated settings.
Quick Recap
Safer operating practices
- Forward only the UDP range required by the configured instance; do not expose large “all ports” ranges.
- Keep the server software, operating system, and BattlEye components updated according to their normal maintenance schedules.
- Use a fixed address reservation and document which instance owns each five-port block.
- Keep RCON outside all reserved blocks and restrict it to trusted administration networks.
- Review router and host-firewall logs after changes so unexpected traffic is visible.
- When retiring an instance, remove its forwarding rules and firewall exceptions rather than leaving unused ports exposed.
Quick configuration checklist
- Choose the base port and confirm the server launch parameter.
- Calculate base through base +4.
- Reserve a private IPv4 address for the host.
- Create matching UDP forwarding rules on the correct NAT device.
- Allow the same UDP range in the host firewall.
- Permit BattlEye’s outbound destinations only if egress filtering requires it.
- Keep RCON outside every five-port block.
- Test from an external network with an Arma client or server browser.
- For additional instances, leave at least 100 ports between bases; wider +200 or +1000 spacing is safer.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
