Driver FixRecommendedSound, Wi-Fi or graphics acting up? Check drivers firstFind missing or outdated drivers fast.Check DriversHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PC×
FREEDOM251

Freedom251 › Blog › Dedicated Server

How to Make a Sons of the Forest Server Private

By Freedom251 Team · · 9 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For a self-hosted Sons of the Forest dedicated server, stop the server, open dedicatedserver.cfg, set "Password" to a non-empty shared secret, save the file, and restart. Players must enter that password before they can join. If everyone is on the same local network, also set "LanOnly": true to keep the server out of the public listing.

A rented or managed server exposes the same control in its provider panel. A password protects access; LAN-only mode controls visibility. Neither setting removes the networking requirements for players connecting over the internet.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What “private” means in Sons of the Forest

The dedicated server has two separate controls that are often confused:

  • Password protection: The Password field requires a connecting player to enter a shared secret before proceeding. This is the access-control setting for a private server.
  • LAN-only visibility: The LanOnly field limits visibility to the local network. It is useful for a household, classroom, or office LAN, but it is not a substitute for a password when players outside that network must be excluded.

The Steam Community Dedicated Server Configuration Guide, updated January 15, 2025, describes the password as being requested “before the client can proceed.” A blank password leaves the server without password protection, even if its name is obscure.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Configuration fields that affect privacy and access

Field Value and limit What it controls
Password Any string up to 40 characters Prompts clients for a password before they join. A non-empty value is required for password protection.
LanOnly true or false Restricts server visibility to the local network when set to true.
MaxPlayers Integer from 1 to 8 Sets the maximum number of connected players; it does not make the server private.
GamePort UDP port; default 8766 Game traffic. Use the configured value when creating firewall and router rules.
QueryPort UDP port; default 27016 Server-query traffic used for discovery and status.
BlobSyncPort UDP port; default 9700 Blob synchronization traffic. It must be reachable when required by the server.
SaveMode new or continue Chooses how a save is initialized; it has no privacy function.

The port numbers above are the documented defaults in the 2025 Steam Community configuration guide. If you changed them, use your actual values instead of the defaults.

Before you edit the server

Install or update the dedicated server

Install the Dedicated Server tool through Steam, or install/update it with SteamCMD using app ID 2465200. The supplied Windows server package is started with StartSOTFDedicated.bat. Do not edit the configuration while the process is running; the server can overwrite changes during shutdown or startup.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Launch once to create the files

Run StartSOTFDedicated.bat one time and allow the server to complete its initial startup. This first launch creates the user-data directory and the default configuration file. Stop the server cleanly before making changes.

Find the correct user-data directory

Unless you selected a custom -userdatapath, the normal Windows location is:

C:Users<user>AppDataLocalLowEndnightSonsOfTheForestDS

Replace <user> with the Windows account that runs the dedicated server. If the startup command includes -userdatapath, use that custom directory instead; changing the default folder will have no effect on a server pointed elsewhere.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

Make a self-hosted server password-protected

  1. Stop the server. Close the dedicated-server process and wait until it has fully exited. Editing a live file risks losing the change.
  2. Back up the configuration. In the SonsOfTheForestDS user-data directory, copy dedicatedserver.cfg to a safe location. A dated copy lets you restore the previous settings if a JSON edit fails.
  3. Open the file as text. Use a plain-text editor. The file is JSON, so quotation marks, commas, braces, and the capitalization of field names matter.
  4. Set a non-empty password. Add or replace the Password value. For example:
{
  "Password": "a-long-random-shared-secret",
  "LanOnly": false,
  "MaxPlayers": 8,
  "GamePort": 8766,
  "QueryPort": 27016,
  "BlobSyncPort": 9700,
  "SaveMode": "continue"
}

Keep the quotation marks around the password and retain commas between properties. The example uses the documented default ports and an eight-player limit; preserve your existing values if they differ. The password may contain spaces, but avoid characters that your editor or hosting panel could reinterpret. Keep it within the documented 40-character maximum.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Save the file. Confirm that the editor did not append an extra extension such as .txt. The filename must remain dedicatedserver.cfg.
  2. Restart the server. Start StartSOTFDedicated.bat again and wait for the server to finish booting. Give the password only to the people who should play.

When a player connects after the restart, the game should request the password before allowing the connection to continue. If no prompt appears, use the troubleshooting section below rather than assuming the server is protected.

Make the server LAN-only

For a server intended only for devices on the same home or office network, set:

"LanOnly": true

Save and restart after changing the value. LAN-only mode limits visibility to the local network; it does not replace a password if you want an additional access barrier for people who can already see that network. Conversely, setting LanOnly to false does not make a server public when a password is configured. It simply allows normal internet discovery, subject to the server’s password and network rules.

Internet connectivity: private does not mean offline

A password controls who is admitted after reaching the server. It does not create a network path through your router or operating-system firewall. For friends connecting from another house, the configured UDP ports must be allowed through both layers.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord | 6.35mm Jack, Durable Design, Stage and Home Studio Use, Low Noise Shielded Electric Cord for Bass, Keyboard, Amp, Mixer
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Traffic Default UDP port Required action for internet players
Game 8766 Forward the port to the computer running the dedicated server and allow it through the host firewall.
Query 27016 Forward and allow it when using the default configuration.
Blob synchronization 9700 Forward and allow it when using the default configuration.

The Steam Community configuration guide notes that the startup self-test can stop boot when a required UDP port is closed. Therefore, a server that refuses to start may have a firewall or forwarding problem rather than a bad password. If you changed any port in dedicatedserver.cfg, create rules for the changed value and remove stale rules that point to an old one.

Router checklist

  • Assign the server computer a stable local IP address, preferably through a DHCP reservation.
  • Create UDP forwarding rules for GamePort, QueryPort, and BlobSyncPort from the router to that local IP.
  • Make sure the router’s WAN address is actually reachable from the internet. Carrier-grade NAT or a second router can prevent inbound connections even when the rules look correct.
  • Do not forward unrelated ports. Only expose the values the server uses.

Windows firewall checklist

  • Allow the dedicated-server executable, or create inbound UDP rules for the three configured ports.
  • Apply the rule to the network profile the machine is using.
  • After changing a port, update the firewall rule and restart the server.

Players on the same LAN may be able to connect even when internet forwarding is wrong, so test from an outside network if remote access is the goal.

Use a managed hosting control panel

A hosted server normally does not expose the Windows file path. Instead, open the provider’s server control panel, go to its configuration area, choose the dedicated-server settings, enter a non-empty password, save, and restart the instance. A provider guide published November 16, 2025, states that setting a server password is currently the available way to make its Sons of the Forest server private; after the change, connecting players are prompted for that password.

Panel labels vary, but the required sequence is consistent:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Stop the server from the panel.
  2. Open Config or Configuration, then Dedicated Server Settings (or the equivalent page).
  3. Enter the shared secret in the password field; do not leave it blank.
  4. Save or apply the configuration.
  5. Restart the server and test with an intended player.

If a panel offers both a password and a LAN-only switch, treat them as separate controls. LAN-only may prevent remote friends from discovering the instance, while the password still determines who is admitted once a connection reaches it.

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

How friends should connect

  1. Start the server and wait for its normal ready state.
  2. Send the password through a private channel. Do not post it in a public server name, forum, or stream overlay.
  3. Have the player find the server using the method appropriate to your setup.
  4. When the password prompt appears, enter the value exactly, including capitalization, spaces, and punctuation.
  5. If the connection fails before a prompt appears, troubleshoot reachability first; authentication cannot happen until the client can contact the server.

Troubleshooting common failures

The server still appears to be public

Visibility and admission are different. Check that Password contains an actual value, not an empty string such as "", then stop and restart the server. A server can remain visible in listings while still requiring a password. If you need it hidden from public discovery for local play, set LanOnly to true.

Friends cannot connect after the password was added

First verify that the server restarted after the edit and that the file you changed is in the active user-data directory. Next compare the configured ports with the router forwards and firewall rules. The defaults are UDP 8766, 27016, and 9700; a custom value in the file requires a matching network rule. Finally, have the player re-enter the password exactly. A typo produces an authentication failure, while closed ports usually prevent the password prompt from appearing at all.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The password prompt never appears

  • Confirm the value is under the Password property, not under a similarly named field.
  • Check that the JSON is valid and that the password is not accidentally followed by a missing comma or extra quote.
  • Make sure the server process was stopped before saving and restarted afterward.
  • Verify that no startup option points to another -userdatapath.
  • Look at the startup output for a configuration error or a port self-test failure.

The server will not start after editing

Malformed JSON is the usual cause. Restore the backup, start the server to confirm it works, and then make one small change at a time. In JSON, property names and string values use double quotation marks; Boolean values such as true and false are unquoted; numeric ports and player limits are also unquoted. A trailing comma before the closing brace can invalidate the file.

LAN players can join but remote players cannot

This pattern points to routing or firewall access, not the password. Confirm that the server computer’s local IP has not changed, that all required UDP ports are forwarded to it, and that the operating-system firewall permits inbound traffic. Test from a phone hotspot or another external connection rather than from the same LAN.

Remote players can reach the server but LAN players cannot see it

Check whether LanOnly is set to true on a network where the players are not actually on the same subnet. Disable LAN-only mode for mixed local-and-remote play, keep the password enabled, and restart.

A server update removed the password

Keep a backup of dedicatedserver.cfg and record your intentional values. After an update, stop the server, inspect the active file, reapply the password if necessary, and restart. Do not assume that a copied configuration is still being used if the installation or startup path changed.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Security and maintenance practices

Use a dedicated shared secret

Choose a random password that is not reused for email, Steam, router administration, or another game. Share it only with the intended players. If someone who should no longer have access knows it, stop the server, replace the value, save, and restart; every player will then need the new secret.

Keep access and capacity separate

Set MaxPlayers to the number of people you actually intend to host, from 1 through the documented maximum of 8. This limits capacity but does not authenticate players. A lower limit can reduce unwanted load, while the password remains the access control.

Protect saves before changing settings

Back up the configuration before each major change and keep routine backups of the game saves. The SaveMode value controls whether the server starts a new save or continues an existing one; changing it while trying to fix privacy can alter how the world is initialized, so leave it alone unless save behavior is the issue.

Review exposure after every network change

When you change ports, move the server to another computer, or replace the router, re-check forwarding, firewall scope, and the active user-data path. A password is valuable only when the intended server process is the one receiving connections.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Quick verification checklist

  • The server is stopped while dedicatedserver.cfg is edited.
  • Password contains a non-empty value no longer than 40 characters.
  • The file remains valid JSON and retains the .cfg filename.
  • The server has been restarted after saving.
  • LanOnly is true only when all intended players are on the same LAN.
  • For internet play, UDP ports 8766, 27016, and 9700—or your customized equivalents—are forwarded and allowed through the firewall.
  • An intended player receives a password prompt and can join with the exact shared secret.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Dedicated ServerLAN serverserver configurationserver privacySons of the Forest

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.