Internet players can join a Garry’s Mod server hosted on your home connection only when the server is listening, the router sends the right traffic to the correct computer, and that computer’s firewall permits it. This guide covers the complete setup, secure RCON handling, external testing, and the network conditions—especially CGNAT and double NAT—that can make forwarding impossible.
Playing with friends? Godlike.Host runs hosted Garry's Mod servers from 10 data-center locations, with free DDoS protection.
What port forwarding changes
A home router normally lets devices on the LAN start outbound connections, but it drops unsolicited inbound traffic because it does not know which device should receive it. Port forwarding creates a specific exception: when a connection arrives at a chosen WAN port, the router translates it to a chosen port on the server computer’s private IPv4 address.
As an Amazon Associate I earn from qualifying purchases.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteGarry’s Mod players on your home network can often connect without this rule because local traffic stays inside the LAN. Players on the internet need your public IPv4 address and the forwarded port. The server must also be running at the moment they connect; a forwarding rule does not start the game process for you.
| Address or setting | Role | Example |
|---|---|---|
| Private IPv4 | Stable address of the server computer inside your home network | 192.168.1.50 |
| WAN/public IPv4 | Address friends use from outside your home | Assigned by your ISP; it may change |
| Listening port | Port opened by the Garry’s Mod server process | 27015 unless you set another value with -port |
| Forwarding rule | Router mapping from WAN traffic to the private IPv4 and listening port | UDP 27015 → 192.168.1.50:27015 |
Check the prerequisites first
Before changing router settings, make sure you have the following:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- A Windows or Linux computer that will run the dedicated server and remain powered on while people play.
- Router administrator access, including permission to edit Port Forwarding, Virtual Server, or NAT Forwarding settings.
- The computer’s current private IPv4 address and its network adapter’s MAC address, if you will create a DHCP reservation.
- A way to identify your public IPv4 address and a friend on a different internet connection for testing.
- A server installation that has been updated with SteamCMD and the Garry’s Mod dedicated-server app.
Do not assume that the address shown by the server computer will remain unchanged. A normal DHCP lease can give the computer a different private IPv4 after a reboot, which leaves the router rule pointing at the wrong device. Reserve the address before testing.
Install and start the dedicated server
Install the files with SteamCMD
Facepunch’s current dedicated-server documentation uses SteamCMD app ID 4020. The following examples install the files into a fixed directory; use an equivalent directory if your system stores servers elsewhere.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- On Windows, open a command prompt in the directory containing
steamcmd.exeand runsteamcmd.exe +login anonymous +force_install_dir C:GModServer +app_update 4020 validate +quit. - On Linux, run SteamCMD with a fixed installation directory, for example
./steamcmd.sh +login anonymous +force_install_dir /opt/gmodserver +app_update 4020 validate +quit. - Run
validatewhen you want SteamCMD to check and replace damaged or missing files. It is optional for a routine update. - Repeat the
app_update 4020operation whenever you intentionally update the server. Keep the server stopped while files are being replaced.
Start it on a known port
Facepunch documents srcds.exe on Windows and ./srcds_run -game garrysmod on Linux. Start with an explicit port even if you intend to use the default, because the same number must appear in the router, host firewall, and the address given to friends.
Windows example:
srcds.exe -game garrysmod +map gm_construct +maxplayers 8 -port 27015Linux example:
./srcds_run -game garrysmod +map gm_construct +maxplayers 8 -port 27015Replace gm_construct and 8 with the map and player limit you want. If you omit -port, Source servers normally use 27015, but verify the actual listening port in the server console or logs rather than relying on an assumption. If you choose another value, such as 27020, use that value consistently everywhere below.
Know which traffic to forward
Steam lists the default Source dedicated-server ports as follows:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Purpose | Protocol | Default local port | When to forward it |
|---|---|---|---|
| Gameplay traffic | UDP | 27015 | Required for internet players to join a server using the default port |
| SRCDS RCON | TCP | 27015 | Only if you deliberately run the default RCON service and need remote administration |
| Alternate server port | The protocol used by the service | The value supplied to -port |
Use this instead of 27015 when you configured a different port |
The same number can appear for UDP gameplay and TCP RCON because protocol is part of a firewall and NAT rule. UDP 27015 alone does not expose TCP RCON, and TCP 27015 alone does not carry gameplay traffic. Never add ports simply because a game list displays them; forward only services you actually run.
Free tools Windows power users keep installed
One-click scans. No signup required.
Give the server a stable private IPv4 address
Preferred method: DHCP reservation
- Open the router’s LAN or DHCP settings.
- Find the server computer in the connected-device list, using its hostname or MAC address.
- Create a reservation for its current private IPv4 address, or choose a new address that the router reserves for that MAC address.
- Reconnect the computer or renew its DHCP lease, then confirm that it received the reserved address.
A reservation keeps the address inside the router’s managed network while preventing another device from receiving it. This is usually safer than manually entering a static address without knowing the correct gateway and DNS settings.
Alternative: configure a static address
You can set a static private IPv4 on the server itself, but choose an address outside the router’s automatic DHCP pool and copy the correct subnet mask, gateway, and DNS values from the router. An address duplicated by another device will cause intermittent connectivity, so a router reservation is preferable when the option exists.
On Windows, check the address with ipconfig. On Linux, use ip addr. Record the IPv4 address, not an IPv6 address, unless you have deliberately designed an IPv6-only setup and verified that every player and firewall supports it.
Create the router forwarding rules
- Sign in to the router’s administration interface and open the page labelled Port Forwarding, Virtual Server, NAT Forwarding, or a similar name.
- Create a rule with an unambiguous name such as
GMod-gameplay. - Set the external or WAN port to the port on which players will connect. For the default setup, enter 27015 as both the start and end of the range.
- Set the internal or LAN port to the server’s listening port, normally 27015.
- Enter the server’s reserved private IPv4 address, such as 192.168.1.50, as the destination device.
- Select UDP, save the rule, and apply the router configuration.
- If RCON is enabled and genuinely required, add a separate TCP rule for its port. Restrict its source addresses if the router supports that feature.
| Rule name | External port | Internal address | Internal port | Protocol |
|---|---|---|---|---|
| GMod gameplay | 27015 | Reserved server IPv4 | 27015 | UDP |
| GMod RCON (optional) | 27015 | Reserved server IPv4 | 27015 | TCP |
If you deliberately use a different server port, substitute that value in the gameplay rule. If the router supports a different external port from the internal port, friends must use the external value in their join address; keeping them identical avoids that extra source of error.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Allow the same traffic through the host firewall
Port forwarding changes the router, not the operating system. The server computer can still discard the packet. Create an inbound rule for the selected UDP gameplay port and, only when needed, a TCP RCON rule.
Windows Defender Firewall
- Open Windows Security, choose Firewall & network protection, then open Advanced settings.
- Select Inbound Rules and choose New Rule.
- Choose Port, select UDP, and enter the gameplay port, such as 27015.
- Choose Allow the connection, apply only the network profiles appropriate for the computer, and give the rule a descriptive name.
- Repeat with TCP only if RCON is enabled. Do not create a broad rule that allows every port or every executable.
Linux firewall
Use the firewall system enabled by your distribution and add an inbound UDP rule for the gameplay port. For a host using UFW, the equivalent command is sudo ufw allow 27015/udp; replace 27015 if you selected another port. Add a TCP rule only for an intentionally enabled RCON service, and verify the rule with your distribution’s firewall-status command. If the server is managed by nftables, firewalld, or another system, use that system’s syntax rather than enabling multiple firewalls at once.
After changing firewall rules, restart or reload the firewall if your operating system requires it. Keep the server process running during the first connectivity test so a listening socket exists.
Test from outside your home network
A test from the same Wi-Fi can be misleading. Some routers do not support NAT loopback, also called hairpin NAT, so a local device may fail to reach the public address even though an internet player can connect. Use a friend on another connection, a phone hotspot, or another genuinely external network.
Recommended Free Tools
- Start the dedicated server and confirm that it reports the intended map and port.
- Confirm the server computer still has the reserved private IPv4.
- Give the tester your current public IPv4 and the external port, for example
PUBLIC_IPV4:27015. - Have the tester connect while the server is running. A Garry’s Mod console command such as
connect PUBLIC_IPV4:27015can bypass a server-browser display issue. - If the connection fails, test the router rule and firewall in that order rather than changing several settings simultaneously.
Generic online port checkers are often designed for TCP and may not reliably report a UDP game port. A successful connection from an external player is the meaningful test for UDP gameplay. Test again after a reboot and after renewing the DHCP lease to prove that the reservation remains effective.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Troubleshoot in the order packets travel
The server works on the LAN but not remotely
- Confirm the server is listening on the port you forwarded. A startup command with
-port 27020cannot work with a rule that still targets 27015. - Check that the router rule uses UDP for gameplay, not only TCP.
- Verify that the destination IPv4 is the server’s current reserved address.
- Check the host firewall for an inbound rule covering the same UDP port and the active network profile.
- Repeat the test from a different internet connection; a same-LAN failure can be caused by missing NAT loopback rather than a broken public path.
The router’s WAN address is private or does not match your public address
Compare the IPv4 shown on the router’s WAN or Internet-status page with the public IPv4 reported by an external address service. If the router shows an RFC1918 private address, an address in 100.64.0.0/10 (100.64.0.0 through 100.127.255.255), or simply a different address, another NAT device is upstream.
Carrier-grade NAT (CGNAT) is an ISP-level form of that arrangement. The ISP shares public IPv4 addresses among customers, and your router cannot create the unsolicited inbound mapping required for a public server. Ask the ISP whether it can provide a genuine public IPv4 address. If it cannot, use a hosted server or a relay design that accepts outbound connections from your home instead of requiring inbound traffic. Changing local firewall rules will not overcome CGNAT.
Two routers are installed
An ISP gateway plus your own router creates two NAT layers. Where supported, put the ISP gateway into bridge mode so your router receives the public address. If bridge mode is unavailable, forward the gameplay port on the outer gateway to the inner router’s WAN address, then create the normal rule on the inner router to the server’s private IPv4. Verify the WAN and LAN address at each layer before editing firewall settings. A rule on only the inner router cannot receive traffic that the outer gateway still drops.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsFriends can connect only intermittently
- Check whether the server’s private IPv4 changed; a missing DHCP reservation is the common cause.
- Check whether the public IPv4 changed after an ISP reconnect. Give players the current address.
- Confirm that the server process is still running and listening on the configured port.
- Look for duplicate devices using the supposed static address.
- Check router logs for dropped inbound packets and the host firewall’s blocked-connection log.
RCON or an alternate port does not work
RCON is TCP in the default Source configuration, while gameplay is UDP. Make sure you created the correct protocol rule and that the RCON service is actually enabled. For an alternate server port, update the startup command, router rule, firewall rule, and join address together; leaving one component at 27015 creates a partial configuration.
Secure and maintain a home server
RCON provides administrative access, so treat it as a sensitive service. Disable it when you do not need remote administration. When it is necessary, use a strong secret, restrict the allowed source addresses to trusted administrators where possible, and forward no management ports beyond the one service you understand.
Do not expose extra ports to make the server appear in a browser. Keep the dedicated-server files, operating system, and installed addons updated, and review logs for unexpected connection attempts. A home server also consumes upload bandwidth; if several players or bandwidth-heavy addons saturate the upstream link, everyone in the home may experience latency even though port forwarding is functioning correctly.
Home hosting versus alternatives
Port forwarding is only one hosting approach. The right choice depends on whether your ISP permits inbound traffic and how much control and maintenance you want.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Consideration | Home hosting | Rented server | Relay or outbound-tunnel approach |
|---|---|---|---|
| Inbound ports | Possible with a public IPv4 and a correctly configured router | Usually supplied by the hosting environment | Designed to avoid unsolicited inbound traffic to the home |
| Recurring cost | Uses your existing connection and electricity; no universal additional price | Requires a provider payment; the amount depends on the service and plan | May require a paid relay or tunnel; pricing varies |
| Mods and files | Full control of files, addons, and configuration | Control depends on the provider’s access and policies | The game server can remain at home, but the relay adds another component to manage |
| Upload and latency | Limited by your home’s upstream capacity and ISP route | Depends on the facility’s network and distance from players | Adds a relay hop, which can change latency and available throughput |
| Maintenance and exposure | You maintain the machine and expose a narrowly selected service from your home network | The provider maintains the physical network, while you still maintain the game software | You avoid direct inbound exposure but must maintain the tunnel or relay credentials |
No single option is universally best. If you have a public IPv4, modest player count, sufficient upload capacity, and want complete file control, home hosting is practical. CGNAT, strict ISP filtering, unreliable power, or a need for continuous availability are strong reasons to use a hosted or relay design instead.
Final verification
A working setup has all of these facts aligned: the dedicated server is installed from app ID 4020, the startup command shows the chosen port, the server computer keeps the same private IPv4, the router forwards UDP gameplay traffic to that address, the host firewall permits it, and an external player can connect while the process is running. If any one of those statements is false, fix that layer before changing the others.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
