Friends can't join your CS2 server?

Quick answer

A Counter-Strike 2 dedicated server uses port 27015 for game traffic, pings and RCON (UDP and TCP; change it with -port). The number one cause of "friends can't join" is a missing Game Server Login Token (GSLT): Valve's docs say other players can only join if you start the server with +sv_setsteamaccount <TOKEN>, generated for app ID 730. After that, check that 27015 is forwarded to the right PC, the firewall allows the server, sv_lan is 0, friends are typing your public IP and port, and your ISP isn't using CGNAT.

Ports

• 27015 UDP + TCP: Game traffic, pings (Steam query) and RCON. Set with -port
• 27005 UDP: Client port (-clientport)
• 26900 UDP outbound: Steam port (-sport)

How to fix it, step by step

1. Create a GSLT and add it to the launch line. Go to steamcommunity.com/dev/managegameservers, create a token with app ID 730, and start the server with +sv_setsteamaccount <TOKEN>. Without a token, other players can't join. Use a separate token for each server.
2. Start it as a dedicated server. Windows: game\bin\win64\cs2.exe -dedicated +map de_dust2. Linux: ./cs2.sh -dedicated +map de_dust2. Without -dedicated it starts the game instead. On Windows, Steam must be installed or the server window closes straight away.
3. Turn off LAN mode. Set sv_lan 0. With sv_lan 1 the server sends no heartbeat and doesn't authenticate players, so it only works on your local network.
4. Forward 27015 to the server PC. Reserve the server PC's local IP in the router, then forward 27015 UDP and TCP to it. If you started with -port 27016 (or any other port), forward that port instead and share IP:port.
5. Allow cs2.exe through the firewall. Allow the server in Windows Firewall on Private and Public networks, or open UDP/TCP 27015 with ufw or firewall-cmd on Linux.
6. Test from outside your network. Pinging or joining your own public IP from inside your house can fail even when everything works. Ask a friend to join, or use a phone hotspot. If the forward is right and it still fails, check for CGNAT (see the CGNAT guide).
7. Share the right address. Friends open the developer console and type connect your-public-ip:27015 (or your custom port). Players on your Wi-Fi use your local IP.

What the symptoms usually mean

• Works on LAN, nobody outside can join: no GSLT, or sv_lan 1.
• Connection timed out from outside: 27015 isn't forwarded, the firewall blocks it, friends have the wrong IP, or you're behind CGNAT.
• The server window closes immediately (Windows): Steam isn't installed. The log says Failed to initialize Steamworks SDK for gameserver.
• Failed to load module ... steamclient.so (Linux): SteamCMD didn't place steamclient.so where the server looks. Symlink steamcmd/linux64/steamclient.so into ~/.steam/sdk64/.

Updating after a CS2 patch

The CS2 client and the dedicated server are the same Steam app (730). Update the server with SteamCMD app_update 730 validate after every game update, or players on the new version can't join.

Test it from the outside

Your own Wi-Fi can't tell you whether friends can reach the server. The free Server Doctor check contacts your server once from the internet, the way the game does, and tells you the most likely cause. The same check runs in Discord with /fix.

No PC to host 24/7?

A CS2 server needs about 60 GB of disk, a GSLT and a port forward, and your PC has to stay on. Behind CGNAT a home server can't be reached at all. A rented server or VPS has its own public IP and nothing to configure on your router.

Related guides

• Garry's Mod server not showing up, or friends can't join?
• Rust server not showing up, or friends can't join?
• Friends can't join your Minecraft server? Here's the fix.
• Behind CGNAT? Host a game server without port forwarding.
• All guides

Sources: developer.valvesoftware.com/wiki/Counter-Strike_2/Dedicated_Servers · developer.valvesoftware.com/wiki/Source_Dedicated_Server