Use UDP port 7777 for a standard SCP: Secret Laboratory dedicated server. Forward UDP 7777 from your router’s WAN side to the server computer’s fixed LAN address, allow inbound UDP 7777 in the computer’s firewall, and use the same port in the server configuration and players’ direct-connect address. Do not forward TCP 7777 for ordinary game traffic.
Playing with friends? Godlike.Host runs hosted SCP: Secret Laboratory servers from 10 data-center locations, with free DDoS protection.
What port does SCP: Secret Laboratory use?
The normal dedicated-server port is UDP 7777. Northwood’s technical-support guidance specifically says to open the game port for UDP, not TCP or TCP/UDP. That protocol distinction matters: a forwarding rule for TCP 7777 does not provide the UDP path that normal gameplay needs.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The complete path has four matching pieces:
- The dedicated server must actually listen on UDP 7777.
- Your router must forward its public UDP 7777 to the server computer’s private address on UDP 7777.
- The operating-system firewall, and any upstream or cloud firewall, must permit inbound UDP 7777.
- Players connecting directly must use your public address and the configured port.
If you change the server to another port, replace 7777 everywhere. A mismatch between the launch configuration, router rule, firewall rule and connection address is one of the most common causes of failed joins.
How SCP:SL port forwarding works
A home router normally separates your private LAN from the public internet with Network Address Translation (NAT). Computers on the LAN receive private addresses such as 192.168.x.x or 10.x.x.x, while the router has the public address visible to players outside your home. A port-forwarding rule tells the router where an unsolicited incoming packet should go.
#1 Best Overall
- OneMesh Compatible Router - Form a seamless WiFi when work with TP-Link OneMesh WiFi Extenders
- Next-Gen Wi-Fi 6 Technology – The Archer AX10 leverages advanced Wi-Fi 6 features like OFDMA and 1024-QAM to deliver improved efficiency across your entire network. Perfect for high-bandwidth activities like streaming, gaming, and smart home connectivity.
- Next-gen Dual Band router - 300 Mbps on 2. 4 GHz (802. 11n) plus 1201 Mbps on 5 GHz (802. 11ax)
- Connect more devices than ever before - Wi-Fi 6 technology simultaneously communicates more data to more devices using OFDMA and MU-MIMO while reducing lag dramatically
- Powerful Dual-Core 900MHz Processor – Handles multiple data streams simultaneously for reliable performance across your devices. Ensures smooth streaming, online gaming, and video conferencing without buffering or lag.
For a default server, the rule should look like this:
| Router field | Value |
|---|---|
| External/WAN port | 7777 |
| Internal/LAN port | 7777 |
| Protocol | UDP only |
| Destination host | The server computer’s fixed LAN address |
Some routers label the fields “start port” and “end port.” Enter 7777 in both fields for a single-port rule. If the interface asks for a service name, use a descriptive label such as “SCPSL UDP.” The label itself has no technical effect.
Prepare the server before changing the router
Confirm the port the process is using
Start the dedicated server and check its console output or configuration. Port 7777 is the normal default, but a previous administrator, a container template or a second instance may have selected another value. Record the actual gameplay port before creating a forwarding rule.
Do not assume that a server process merely being open means it is reachable. The process can be running on a different port, bound only to a local interface, or blocked by the host firewall.
Give the host a stable private address
Port forwarding points to an internal IP address. If your router later gives the computer a different DHCP address, the rule can continue pointing at the wrong device. Create a DHCP reservation in the router for the server computer’s network adapter, or configure a static address using values appropriate for your LAN.
A reservation is usually simpler because the router continues managing the gateway and DNS settings while keeping the same address for the host. After applying it, verify the address on the server computer and make sure the forwarding rule uses that current value.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteKeep the server on the intended interface
Multi-homed computers can have Ethernet, Wi-Fi, VPN and virtual-adapter addresses at the same time. Ensure the server is bound to the interface that actually leads to the router. A rule aimed at an Ethernet address cannot deliver traffic to a process listening only on an isolated virtual adapter.
Rank #2
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Port-forwarding procedure for a home server
- Launch the dedicated server. Confirm the gameplay port in the server output or configuration. Use 7777 unless you intentionally selected another port.
- Record the host’s private address. Check the network settings on the computer running the server. Reserve that address in the router’s DHCP settings so it remains stable.
- Sign in to the router. Open its administration interface and locate Port Forwarding, NAT, Virtual Server or a similarly named section.
- Create one rule for gameplay. Set the external port and internal port to 7777, select UDP only, and target the server computer’s reserved LAN address.
- Save and apply the rule. Some routers restart networking or require a separate Apply button. Wait for the configuration to finish before testing.
- Allow the port in the host firewall. Create an inbound rule for UDP 7777, scoped to the server application or the appropriate network profiles. If a security suite has its own firewall, permit the same traffic there.
- Check upstream controls. If the server is in a cloud environment, behind an additional gateway, or connected through ISP equipment in router mode, allow UDP 7777 at each layer.
- Test from outside the LAN. Give an external player your public address and port. A test from another device on the same home network can fail even when internet players can connect, because some routers do not support NAT loopback.
The direct-connect format is the public address followed by the configured port, for example public-address:7777. Use the actual public address and actual server port rather than the private 192.168.x.x or 10.x.x.x address.
Why UDP 7777 is different from TCP 7777
UDP and TCP are separate transport protocols. A router rule can match one, the other, or both, but ordinary SCP:SL gameplay forwarding requires UDP. Northwood’s support guidance advises opening the port for UDP rather than TCP or TCP/UDP.
The configuration reference includes an optional enable_query setting that uses a query protocol over TCP. That setting does not change the transport required for normal player traffic. Only add a TCP rule when you have a specific, documented query or administration requirement; do not substitute TCP for the game’s UDP rule.
Free tools Windows power users keep installed
One-click scans. No signup required.
Running multiple SCP:SL server instances
Two servers cannot normally listen on the same host and the same UDP port. Assign each instance a distinct port and carry that choice through every layer.
| Instance | Gameplay port | Router destination | Firewall rule |
|---|---|---|---|
| First instance | 7777/UDP | Host LAN address, UDP 7777 | Inbound UDP 7777 |
| Second instance | 7778/UDP | Host LAN address, UDP 7778 | Inbound UDP 7778 |
| Third instance | 7779/UDP | Host LAN address, UDP 7779 | Inbound UDP 7779 |
Container deployment documentation exposes 7777/udp by default and shows 7778 and 7779 as alternate instance ports. Changing a container’s published port alone is not enough: change the gameplay configuration, publish the matching UDP port, update the router and firewall, and give players the corresponding public address and port.
If several instances run on different computers, each forwarding rule must target the correct computer’s LAN address. If they run on one computer, each process needs its own configuration and port.
UPnP versus manual forwarding
Manual forwarding
Manual forwarding gives you an explicit UDP rule, a known destination address and a configuration you can audit. It is the dependable procedure when the router does not support UPnP or when automatic changes are not acceptable.
Recommended Free Tools
Rank #3
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
UPnP automatic forwarding
The SCP:SL configuration reference exposes forward_ports for automatic forwarding when the router supports UPnP. With UPnP enabled, the server can request a mapping instead of requiring you to create it by hand. This is a convenience feature, not a guarantee: the router may disable UPnP, reject the request, remove the lease, or sit behind another NAT device.
If you use UPnP, verify that a UDP mapping was actually created and that it targets the correct host. Do not leave a stale manual rule pointing to an old address while troubleshooting an automatic mapping. For a stable, auditable setup, a DHCP reservation plus a manually managed UDP rule is generally easier to verify.
Diagnosing friends who cannot join
1. Verify the configured port
Read the server’s startup output and configuration again. A rule for UDP 7777 cannot reach a process listening on 7778. Check for command-line arguments, per-instance configuration files and container environment variables that override the default.
2. Verify the LAN destination
Compare the router rule’s destination with the host’s current private address. If DHCP changed the address, renew the reservation or correct the rule. Confirm that the server is running on the same machine and interface that the rule targets.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →3. Verify protocol and firewall scope
Make sure the router rule says UDP, not TCP and not an incorrectly combined TCP/UDP option. Confirm that the operating-system firewall allows inbound UDP on the selected port and that the rule applies to the active network profile. Security suites and endpoint firewalls can block traffic even when the operating-system rule is correct.
4. Test from a genuinely external network
Ask someone outside your home network to connect, or test from a separate internet connection. A same-LAN test can be misleading when the router lacks NAT loopback (also called hairpin NAT). Use the public address for the outside test and the private address only for an internal test that is known to support local routing.
5. Check for double NAT
If your ISP supplied a gateway and you added your own router, both devices may be performing NAT. Forward UDP 7777 through the upstream gateway as well, place the downstream router in the appropriate bridge or passthrough arrangement, or otherwise ensure that the public-facing device knows where to send the traffic.
Rank #4
- NIGHTHAWK WIFI 6 ROUTER FOR YOUR WHOLE HOME: Delivers fast, reliable WiFi across every room of your apartment or small home for streaming, gaming, video calls, and smart home devices, all running at the same time without slowing each other down.
- WORKS WITH YOUR EXISTING INTERNET SERVICE: Pairs with your existing modem or gateway via ethernet. Compatible with most cable, fiber, DSL, and satellite providers. Some gateways and modem router combos may require bridge mode. No coax needed.
- SET UP AND MANAGE YOUR NETWORK WITH THE NIGHTHAWK APP: Download the free Nighthawk app on iOS or Android for guided setup. Manage WiFi, run speed tests, pause devices, and set up guest networks from anywhere. Active internet required.
- READY FOR THE DEVICES YOU ALREADY OWN: Your phones, laptops, and TVs work right out of the box. WiFi 6 delivers speeds up to 1.8 Gbps across 2.4 GHz and 5 GHz bands. Backward compatible with WiFi 5 and earlier.
- COVERAGE IN EVERY ROOM: Covers up to 1,500 sq. ft. for up to 20 connected devices. Walls, floors, and interference can reduce range. Larger or multi-story homes may benefit from a NETGEAR Orbi mesh WiFi system.
6. Check CG-NAT
Carrier-grade NAT (CG-NAT) places many customers behind an ISP-controlled public address. In that situation, your router may show a WAN address that differs from the address visible on the internet, and you cannot create the required inbound mapping on the carrier’s equipment. Local forwarding can therefore look correct while unsolicited internet traffic never reaches your home.
Compare the router’s WAN address with the public address shown by a trusted internet service. If they differ, or if the WAN address is in a private or carrier-shared range, ask the ISP whether CG-NAT is in use and whether a public IPv4 address or an alternative inbound service is available. Northwood’s support material points to CG-NAT troubleshooting for this failure mode.
7. Check upstream or cloud firewalls
A virtual server, hosted machine or managed network can have a provider-level security group in addition to the operating-system firewall. Permit inbound UDP on the selected port at every layer. Conversely, do not open unrelated ports merely because they appear in a generic game-server guide.
8. Recheck the public address
Residential public addresses can change. Give players the current address, or use a DNS name that you control. A correct port-forwarding rule cannot help if players are using an old address.
When home hosting is the wrong fit
Home hosting gives you direct control over the router, firewall and machine, but it depends on those systems remaining powered, reachable and correctly configured. CG-NAT, restrictive ISP equipment, unstable home uptime or reluctance to administer firewall rules can make inbound hosting impractical.
Managed SCP:SL game-server hosting moves the public network edge to a provider. Hosting documentation describes network settings and direct-connect details, but regions, uptime commitments, pricing and any referral arrangement must be checked with the provider before purchase. A managed service does not eliminate configuration work: select the intended port, confirm the provider’s firewall settings, and use the supplied address and port exactly as shown.
| Approach | Best suited to | What you control | Main dependency |
|---|---|---|---|
| Home server with manual forwarding | Admins with router and firewall access | Server files, LAN address, NAT rule and host firewall | Public reachability, stable power and ISP support for inbound traffic |
| Home server with UPnP | Networks where the router accepts automatic mappings | Server configuration and the UPnP policy | Router UPnP support and a usable upstream public address |
| Managed hosting | Admins blocked by CG-NAT or home-network limitations | Server settings exposed by the provider | Provider’s network, availability and account terms |
Using an SRV record instead of publishing a port
Version 13.2 added SRV-record support. An SRV record lets a DNS service name point to a selected port, while an A or AAAA record maps a name to an address without selecting a non-default port.
Best Value
- 𝐆𝐢𝐠𝐚𝐛𝐢𝐭 𝐖𝐢𝐅𝐢 𝐟𝐨𝐫 𝟖𝐊 𝐒𝐭𝐫𝐞𝐚𝐦𝐢𝐧𝐠 – Up to 5400 Mbps WiFi for faster browsing, streaming, gaming and downloading, all at the same time. Performance varies by conditions, distance to devices, & obstacles such as walls.
- 𝐅𝐮𝐥𝐥 𝐅𝐞𝐚𝐭𝐮𝐫𝐞𝐝 𝐖𝐢𝐅𝐢 𝟔 𝐑𝐨𝐮𝐭𝐞𝐫 – Equipped with 4T4R and HE160 technologies on the 5 GHz band to enable max 4.8 Gbps ultra-fast connections.Power:12 V 2.5 A
- 𝐂𝐨𝐧𝐧𝐞𝐜𝐭 𝐌𝐨𝐫𝐞 𝐃𝐞𝐯𝐢𝐜𝐞𝐬 – Supports MU-MIMO and OFDMA to reduce congestion and 4X the average throughput
- 𝐄𝐱𝐭𝐞𝐧𝐬𝐢𝐯𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 - Covers up to 2,000 sq. ft. High-Power FEM, 6× Antennas, Beamforming, and 4T4R structures combine to adapt WiFi coverage to perfectly fit your home and concentrate signal strength towards your devices.
- 𝐌𝐨𝐫𝐞 𝐕𝐞𝐧𝐭𝐬, 𝐋𝐞𝐬𝐬 𝐇𝐞𝐚𝐭 – Improved vented areas help unleash the full power of the router
The SCP:SL convention uses the _scpsl service and UDP protocol. In practical terms, the DNS record identifies the service, transport and target host, while the router and firewall still must permit the selected UDP port. DNS does not bypass NAT, CG-NAT or a blocked firewall.
Use an SRV name when you want players to use a stable service address even if the server is moved to a different port. Keep the DNS target, SRV port, router mapping, server configuration and firewall rule synchronized. Players using a raw address-and-port connection can continue to connect directly without SRV, provided they use the correct public address and port.
Port-forwarding checklist
- Server process is running and listening on the intended port.
- Gameplay traffic uses UDP; the default is UDP 7777.
- Host computer has a DHCP reservation or another stable LAN address.
- Router forwards external UDP port to the same internal UDP port and correct host.
- Operating-system, security-suite and upstream firewalls allow inbound UDP on that port.
- Each additional instance has its own port, configuration and forwarding rule.
- External testing is performed from outside the home LAN.
- Router WAN address is publicly reachable, without an unresolved CG-NAT or double-NAT barrier.
- Players have the current public address and matching port, or the correct SRV service name.
Common configuration mistakes
- Forwarding TCP only: ordinary gameplay expects UDP.
- Forwarding to a changing DHCP address: the rule eventually points at the wrong computer.
- Testing only from inside the LAN: missing NAT loopback can produce a false failure.
- Changing a container’s published port without changing gameplay configuration: the external mapping and process listener no longer match.
- Assuming UPnP succeeded: inspect the router’s active mappings rather than trusting the server setting.
- Ignoring an upstream gateway or CG-NAT: a local rule cannot control equipment outside your network.
- Adding TCP because a query option exists: optional TCP query support does not replace the UDP game port.
Direct answers to the usual port questions
What port does SCP: Secret Laboratory use?
A standard dedicated server uses UDP 7777 unless its configuration specifies another port.
Is SCP:SL port 7777 TCP or UDP?
For ordinary game traffic and port forwarding, it is UDP 7777. Northwood’s guidance says not to use TCP or a combined TCP/UDP rule for this purpose.
Do I need TCP 7777?
Not for normal gameplay. The configuration reference documents an optional TCP query protocol, but that is a separate function and should not be used to infer that gameplay belongs on TCP.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why can local players connect while friends cannot?
Local connectivity can work without an internet-facing mapping. Check the public address, UDP rule, host firewall, double NAT and CG-NAT from an external network.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
