DayZ Ports and Firewall

A DayZ server that is "running" on the desktop and missing from the server list is usually a port problem. The game is UDP. Opening TCP 2302 in a panel and feeling finished is how weekends disappear. The common game port is 2302. The process also uses the following UDP ports in that range, typically through 2305, plus the Steam query port that lets browsers and the CFTools crawler see the server at all. If you moved the game port, move the rest with it. Do not keep a screenshot of the default and a config that says otherwise.

BattlEye RCon is not one of those game ports unless you chose it to be. It is a separate UDP listener, configured in BEServer_x64.cfg or beserver_x64.cfg with RConPort. CFTools' own guidance is to set that port to the game port plus three. Game port 2302 means RCon 2305. Some communities pick another free UDP port on purpose. That is fine if every firewall, security group, and the Cloud connection form agree. It is not fine if only the cfg was edited.

The firewall list is short and people still miss half of it. The host's own firewall, the provider's edge filter, and any "DDoS proxy" that only forwarded TCP. UDP has to be allowed inbound on the game ports and on the RCon port if CFTools Cloud is going to manage the server from outside. Restricting RCon to a single management IP is reasonable. Forgetting that CFTools' egress addresses have to be allowed is how "RCon times out" tickets start. The password and RestrictRCon 0 still have to be right. A perfect firewall in front of RestrictRCon 1 only proves you can connect far enough to be refused.

Query and game ports are how DayZ Manager and the CFTools Gameserver Data Service learn your hostname, map, and player count. If you hide the query port, you also hide the server from the index. That can be what you want for a private test. It is a mistake for a public community that then complains about rank. Rank is computed from servers the crawler can see, and spoofed counts are dropped. There is no form on this site to "add my IP."

Write the ports down next to the mission name. When you migrate to CFTools Architect, the process moves. The ports should not secretly change because a template assumed 2302 while your players have 2402 in the launcher. The Windows and Linux guides are where the cfg files live. The startup parameters are where a -port= flag can disagree with serverDZ.cfg and waste an evening.

Test from outside the machine. A local connect proves the process started. A connect from a phone on cellular, or a second host, proves the firewall. Then look at the country roster and confirm the server landed in the country you think you bought. Geolocated country is not always the city in the product name. If it is wrong, players will still feel the route, and the flag on the list will not match the ad.

Write the four numbers down

You need the game port, the query port, the RCon port, and the direction: inbound UDP. Write them next to the process name. If the game port is 2302, the usual companions sit on the following UDP ports and RCon often sits at 2305. "Often" is not a discovery method. Read the cfg you actually run. Then open those ports on the OS firewall and on the provider's edge. One without the other is a server that answers itself.

Do not open the RCon port and then publish it on the server page by stuffing it into the hostname. Players need the game address. Cloud needs the RCon address. Those audiences are different. The open roster and the community roster should show the game port in the connect string and nothing else. If your provider's panel only has a TCP field, you are not done. DayZ is UDP. A green checkmark on TCP 2302 is a different protocol.

Changing ports later is a migration. Every launcher favorite breaks, and the crawler must see the new query port before the public list updates. Do it in a window you announce. Confirm you did not leave the old process bound, or you will have two servers and one Cloud entry pointed at whichever answered first. The player chart will look haunted: online, then empty, then a different map. That is two processes. Kill the one you do not want.

Test with a client outside the datacenter after every firewall change. Then test RCon from outside. Then stop. Extra "security" rules that drop large UDP bursts will also drop the game. If you are being attacked, call the provider. Do not close the query port to hide. You will vanish from this index and from the launcher, and the attack on the game port will continue. The country you hosted in does not change because you filtered yourself. Visibility and abuse handling are both allowed to exist. Close the RCon port only if you have decided not to manage the server remotely, and mean it.