Host an Arma 3 dedicated server for your unit

What you're setting up

Your unit wants somewhere to play that is up when you are not: a server that keeps the mission running, loads your mod set, and lets only the right people take the admin seat. Bohemia publishes that server as its own Steam app, number 233780, at no charge. It runs on Windows Server 2008 or newer, or on what Bohemia's wiki calls a modern Linux distribution. This guide uses Linux, with the program arma3server_x64 started under an ordinary user account.

Bohemia's Linux notes are brief (the wiki itself flags the section as unfinished), so where we add a common Linux step, such as the firewall or the systemd service, we say so.

Will one machine carry your missions?

Bohemia's own figures are modest. The minimum is a 2.4 GHz dual-core processor, 2 GB of memory and 32 GB of disk; the recommendation is a 3.5 GHz quad-core, 4 GB and 32 GB on an SSD. The catch is how the server uses those cores.

• Most of the work happens on one or two threads, according to the wiki, and every AI unit in a mission is handled by the same single thread.
• So a faster core helps more than extra cores. Bohemia's wording is that core speed is king.
• The spare cores still earn their keep: for AI-heavy missions, wiki notes written with Windows hosts in mind say handing AI to headless clients running beside the server will probably work best.
• A real IPv4 address is required. Arma 3 can't serve players over IPv6, nor over IPv4 tunnelled inside IPv6 (DS-Lite).

The server that fits

Our game server hosting gives you a whole physical machine, with nobody else's games on it, on a port no other customer shares at the access switch. You choose the hardware and the operating system. Nothing meters the traffic, so a packed weekend op never turns into a bandwidth bill.

• One IPv4 address comes with the server, which is exactly what Arma 3 needs; IPv6 is available at no charge if you want it for anything else.
• Five cities: Amsterdam and Bucharest in Europe, and in the US, New York, San Francisco and Miami. Ping each one from our locations page and choose the city most of your players are closest to.
• Many lines use older processors on purpose, so compare clock speeds on our Intel servers page before you order: for Arma 3, a faster core matters more than a bigger core count.
• A server already racked is ready about 30 minutes after your order is approved; payment checks can add time.
• Rack servers and blades include a remote console, so a firewall slip never locks you out for good.
• Real people answer live chat, email and phone, 24 hours a day, 365 days a year.

Up and running in an evening

Log in to a fresh Ubuntu or Debian machine as your own user with sudo. You'll make a separate account called a3srv for the game: Bohemia's guide says a server running under its own user is harder for an attacker to use against the rest of the system, and Valve warns never to run SteamCMD as root.

sudo apt update && sudo apt install -y lib32gcc-s1 curl ufw
sudo useradd -m -s /bin/bash a3srv
sudo -u a3srv bash -c 'mkdir -p /home/a3srv/steamcmd /home/a3srv/config && chmod 700 /home/a3srv/config'
sudo -u a3srv bash -c 'cd /home/a3srv/steamcmd && curl -sqL "https://client-update.steamstatic.com/installer/steamcmd_linux.tar.gz" | tar zxvf -'
sudo -u a3srv bash -c 'mkdir -p "/home/a3srv/.local/share/Arma 3" "/home/a3srv/.local/share/Arma 3 - Other Profiles"'

# firewall: turn on IPv6 handling first, then add the rules
sudo sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw allow proto udp from any to any port 2302:2306
sudo ufw --force enable
sudo ufw status verbose

The five ports, in plain terms: 2302 carries the game and voice chat, 2303 answers the server browser's Steam query, 2304 talks to Steam's master list, 2305 is reserved for voice but unused today, and 2306 carries BattlEye, the anti-cheat. BattlEye also connects out to its own servers on 2344 and 2345, which ufw lets through because it allows outgoing traffic unless told otherwise. Arma 3 itself ignores IPv6, but the sed line goes first anyway: ufw only gives IPv6 copies to rules created while that setting is on, and without them SSH and the deny rule would not cover your IPv6 address. Bohemia also says the server has to answer ping so Steam can reach it. You don't need a rule for that: the before.rules file ufw ships with lets IPv4 ping through, and its before6.rules does the same for ICMPv6 once IPV6=yes is set.

Signing in to Steam safely

Bohemia's guide downloads the server with a Steam account login, not anonymously, and says the account doesn't need to have bought Arma 3. Make a new, empty account just for the server: SteamCMD remembers the login on the machine, so anyone who got into the server could use that account, and an account can't be signed in from two places at the same moment.

1. Become the game user with sudo -iu a3srv and start /home/a3srv/steamcmd/steamcmd.sh. It updates itself, then shows a Steam> prompt.
2. Enter force_install_dir /home/a3srv/server. Valve's instructions set the folder before you sign in.
3. Enter login followed by the account name only. SteamCMD then asks for the password, so it never appears in your shell history or in the process list.
4. If the account has Steam Guard, SteamCMD asks next for the code Steam emails you. Valve says you only need it the first time, or again if the stored login files are deleted.
5. Enter app_update 233780 validate, wait until it reports success, and finish with quit.

Enter these one at a time rather than pasting them together: anything typed ahead lands in the password prompt.

Your settings file, kept private

Everything about your server lives in one text file that you name when you start it. Keep it in /home/a3srv/config rather than in the game folder: the wiki explains that the script commands which load files are limited to the game's own folder and its subfolders, which puts a file stored elsewhere beyond them, and Valve notes that validate overwrites changed files inside the install.

// /home/a3srv/config/a3server.cfg
hostname = "Our unit's Arma 3 server";
password = "choose-a-join-password";     // or "" for a public server
passwordAdmin = "long-random-admin-password";
serverCommandPassword = "another-long-random-one";
admins[] = { "76561198000000001" };      // your SteamID64: #login without typing a password
maxPlayers = 32;
BattlEye = 1;                          // anti-cheat on (the default)
verifySignatures = 2;                  // only mods signed by a key you installed
kickDuplicate = 1;
allowedFilePatching = 0;
headlessClients[] = { "127.0.0.1" };
localClient[] = { "127.0.0.1" };

1. Lock it down with sudo chown a3srv:a3srv /home/a3srv/config/a3server.cfg and sudo chmod 600 /home/a3srv/config/a3server.cfg.
2. Keep all three passwords in this file only. Typed on a start line, they would be visible to anyone who runs ps.
3. In game, an admin opens chat and types #login with the admin password; anyone whose Steam ID is listed in admins[] just types #login. Unless you use BattlEye's RCon, the admin seat holds just one person at once.
4. serverCommandPassword is what server-side scripts must supply to use the alternate form of the serverCommand scripting command, so give it a value of its own.
5. For a public server, add the three file-extension lists from the security section of Bohemia's server config page.

Starting it with the machine

The wiki starts the server by hand in a terminal, where it stops when you disconnect. A systemd service, our addition, brings it up at boot and again if it ever crashes. Create /etc/systemd/system/arma3server.service:

[Unit]
Description=Arma 3 server for our unit
Wants=network-online.target
After=network-online.target

[Service]
User=a3srv
Group=a3srv
WorkingDirectory=/home/a3srv/server
ExecStart=/home/a3srv/server/arma3server_x64 -name=a3srv -config=/home/a3srv/config/a3server.cfg
Restart=on-failure

[Install]
WantedBy=multi-user.target

Then run sudo systemctl daemon-reload and sudo systemctl enable --now arma3server, and watch it with journalctl -u arma3server -f. Leave out -profiles=, which Bohemia says doesn't work on Linux; your difficulty settings are kept in a profile that the server creates for a3srv under .local/share. When Bohemia releases a patch, stop the service and open SteamCMD again as a3srv. Enter force_install_dir /home/a3srv/server first, then login with the account name, after that, app_update 233780 validate, and quit to finish. Skip the folder line and SteamCMD puts a second copy somewhere else. Start the service again afterwards.

Mods your players can trust

• Upload each mod folder, such as @cba_a3, into /home/a3srv/server. On Linux, -mod= only accepts paths inside the game folder, though symlinks work.
• Copy every mod's .bikey file into the server's keys folder. With verifySignatures = 2, players can join only with addons signed by a key there, and a fresh install usually trusts nothing but Bohemia's own bi.bikey.
• Add keys only from mod authors you trust; the wiki warns that a key's name proves nothing about who made it.
• Watch out for capital letters in file names: the wiki names CUP Terrains and ALiVE among mods that fail on Linux unless every name is lowercase.
• For a list of mods, Bohemia's Linux syntax separates them with a backslash before each semicolon. A service file runs without a shell, so here is our own workaround rather than the wiki's: create /home/a3srv/start.sh containing the single line exec /home/a3srv/server/arma3server_x64 -name=a3srv -config=/home/a3srv/config/a3server.cfg -mod=@cba_a3\;@ace and change the service to ExecStart=/bin/bash /home/a3srv/start.sh. Leave the -mod value unquoted, as the wiki itself writes its Linux -serverMod= example; Bohemia's -mod example adds double quotes, but inside them bash keeps the backslash rather than removing it. Either way, check journalctl -u arma3server to confirm each mod loaded.
• Mods that only the server should load go in -serverMod=; players never download them.

Sharing the AI load with a headless client

A headless client is a second copy of the server program, started with -client, that joins your server and runs the AI so the server thread doesn't have to. On the same machine you'd start it like this: ./arma3server_x64 -client -connect=127.0.0.1 -name=hc1. If your server runs mods, give the headless client the same -mod= list; -serverMod= has no effect alongside -client. The 127.0.0.1 entries in the settings file above are what let it connect at full speed. Your mission has to be ready for it, with a named Headless Client unit placed in the editor and scripts that hand the AI over.

A password-protected server wants its join password from the headless client too. Rather than adding -password= to the start line, put it in a parameter file: an ordinary text file with each option on its own line, named with any extension except .par, because Bohemia's page warns that files ending in .par are parsed in an older class layout which a dedicated server apparently no longer reads properly. For example /home/a3srv/config/hc1.txt, owned by a3srv at chmod 600, passed with its full path as -par=/home/a3srv/config/hc1.txt. Bohemia documents the file but doesn't say it was tested on Linux, so run ps -o args -u a3srv afterwards and make sure no password shows.

When this isn't the right fit: for a one-off evening with a few friends, the Arma 3 Launcher can host from the game itself. Running your own machine means the missions, mods and BattlEye filters are yours to look after. You manage the server; we keep the hardware and the network running. For another community shooter on Linux, see our Squad server guide.

Questions people ask

Do I have to buy Arma 3 again for the server?

No. The dedicated server package is free, and Bohemia says the Steam account SteamCMD signs in with doesn't need to own the game. Use a brand-new account just for the server, since SteamCMD stores its login on the machine.

My friends can't see the server in the browser. What should I check?

First, that UDP 2302 to 2306 are open, since 2303 and 2304 are the Steam ports the browser relies on. Then that players are on the same game branch as the server: Bohemia notes that stable and development builds can't join each other. Finally, the server needs a real IPv4 address; it has no IPv6 support.

Can I run two Arma 3 servers on one machine?

Yes. Bohemia suggests leaving at least 100 ports between them, so start the second with -port=2402, give it a different -name= (which keeps its profile apart on Linux, where -profiles doesn't work) and a config file of its own, and add a firewall rule for it: sudo ufw allow proto udp from any to any port 2402:2406.

Where do I change the difficulty settings?

In the server's profile file, which Arma 3 creates on first start. On Linux the -profiles option doesn't work, so look for it in the game user's own home, under .local/share, in the folder whose name ends in Other Profiles. Set difficulty = "Custom" for a mission and the server reads your custom settings from that file.