Host an Insurgency: Sandstorm dedicated server your squad can rely on

What you are setting up

You are running a program, not the game. The server download is a separate Steam app with the ID 581330, and New World Interactive's guide fetches it anonymously, so your own Steam password never touches the machine. On Linux it is a single program, InsurgencyServer-Linux-Shipping, that you start by naming a map, a scenario and how many players may join, all in one string; the guide's example is the Refinery map (Oilfield) on Push with 28 players.

The guide lives on mod.io now; the old support site points there. It covers a vanilla server. Mods have their own, newer guide, which we come back to near the end.

Will one machine carry your matches?

Probably, but nobody official will give you a number: New World Interactive publishes no processor, memory or disk requirement for the server. What makes it work harder is easy to name, though. More players, AI bots on the co-op modes, and a second server on the same box all add load.

Here is how we would size it, as our own advice rather than anything from the guide. Start the server, play a full match with the player count and bots you actually plan on, and watch the memory and processor use while it runs. If it sits comfortably below what the machine has, you have room. If you plan two servers, test the first one full before adding the second.

The server that fits

Choose an x86 machine. That is our conclusion rather than a line from either manual: Valve's instructions for SteamCMD, the tool that installs and updates the server, need x86 packages, and the only Linux server program in the guide is an x86 build. Neither source mentions ARM, so we would leave our ARM servers, the eight-core X-Gene cartridge among them, out of it. Everything else on our game server page is a candidate.

What you get is a whole physical server: the processors and memory belong to you alone, with no other customer on the machine. Nothing meters the traffic on your port, so a busy weekend never becomes an extra charge, and there is no contract, so you can stop when your group moves on. A machine already in a rack is ready about 30 minutes after your order is approved; ready machines are listed live. There are five cities to choose from, listed on our locations page; pick the one closest to where most of your squad plays from.

You manage the server; we keep the hardware and the network running. If the machine ever stops answering, the rack servers and blades have a remote console you can open from your dashboard after you set up a console login there.

Installing it, step by step

These steps assume Ubuntu or Debian from our Linux servers and a user account of yours with sudo. Valve's documentation says SteamCMD should not run as root, which is why everything below belongs to a separate insurgency account.

1. Install SteamCMD's library, create the user and download the server.
2. Create the folders and empty settings files the guide asks for.
3. Switch the firewall on, allowing SSH first, then open the two game ports.
4. Check ufw status lists 27102 and 27131 for both IPv4 and IPv6.

sudo apt update && sudo apt install -y lib32gcc-s1 curl ufw
sudo useradd -m -s /bin/bash insurgency
sudo -u insurgency bash -c 'mkdir -p /home/insurgency/steamcmd && cd /home/insurgency/steamcmd && curl -sqL "https://steamcdn-a.akamaihd.net/client/installer/steamcmd_linux.tar.gz" | tar zxvf -'
sudo -u insurgency bash -c '/home/insurgency/steamcmd/steamcmd.sh +force_install_dir /home/insurgency/sandstorm +login anonymous +app_update 581330 validate +quit'
sudo -u insurgency bash -c 'cd /home/insurgency/sandstorm && mkdir -p Insurgency/Saved/Config/LinuxServer Insurgency/Config/Server && cd Insurgency && touch Saved/Config/LinuxServer/Game.ini Saved/Config/LinuxServer/Engine.ini Config/Server/Admins.txt Config/Server/MapCycle.txt Config/Server/Motd.txt && chmod 600 Saved/Config/LinuxServer/Game.ini'

# firewall: IPv6 first, SSH before enabling, game ports after
sudo sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
sudo ufw allow OpenSSH
sudo ufw --force enable
sudo ufw allow 27102
sudo ufw allow 27131
sudo ufw status

Your server has its own public address, so you skip the home router and the port forwarding entirely; the firewall above is the only door. The guide opens both TCP and UDP on these ports, which is what ufw allow with no protocol does.

Make it start by itself

You want the server to come back after a reboot and to update itself without you logging in. First, the start script the guide describes, saved as /home/insurgency/sandstorm/start.sh and owned by insurgency:

cd /home/insurgency/sandstorm
exec Insurgency/Binaries/Linux/InsurgencyServer-Linux-Shipping 'Oilfield?Scenario=Scenario_Refinery_Push_Security?MaxPlayers=28' -Port=27102 -QueryPort=27131 -log -hostname="Our Squad" -GSLTToken="$GSLT" -GameStatsToken="$GAMESTATS" -GameStats

Next, put your two tokens in /etc/insurgency.env with sudoedit, one GSLT= line and one GAMESTATS= line, and sudo chmod 600 it. Then the service that runs everything, saved as /etc/systemd/system/insurgency.service:

[Unit]
Description=Insurgency Sandstorm server
Wants=network-online.target
After=network-online.target

[Service]
User=insurgency
WorkingDirectory=/home/insurgency/sandstorm
EnvironmentFile=/etc/insurgency.env
ExecStartPre=-/home/insurgency/steamcmd/steamcmd.sh +force_install_dir /home/insurgency/sandstorm +login anonymous +app_update 581330 +quit
ExecStart=/bin/bash /home/insurgency/sandstorm/start.sh
Restart=on-failure
TimeoutStartSec=1800

[Install]
WantedBy=multi-user.target

Run sudo systemctl daemon-reload and sudo systemctl enable --now insurgency, and the server starts now and at every boot, updating first each time.

Two honest caveats. The guide only documents the tokens as launch switches, so anyone with a login on the machine can read them in the process list while the server runs; keep the box to yourself. And the minus sign before the update line means a failed update will not stop the server starting, while TimeoutStartSec=1800 gives a slow download half an hour instead of the default 90 seconds.

Getting XP and stats to count

The guide says enabling stats is also what turns on experience gain on your server. You need all of the following.

• A GSLT, Steam's login token for game servers, from Steam's game server account manager. Enter 581320, the game's ID, not the server's 581330. Steam only issues one to an account that has bought the game, has a phone number on it and is in good standing, and you need a separate token per server.
• A GameStats token from New World Interactive's generator, where you sign in through Steam.
• The -GameStats switch, since servers do not report unless they opt in.
• No password. A passworded server cannot be stats-enabled.

The guide asks you to keep the GameStats token private and says tokens used to abuse the system get revoked. It links the Steam token to stats, and it never claims the token decides whether you appear in the server list. If you keep the settings close to stock, -ruleset=OfficialRules lists you under the official rules filter, at the cost of locking many options.

Admins, map rotation and house rules

Admins go in Insurgency/Config/Server/Admins.txt, one 64-bit Steam ID per line; they can then open the in-game admin menu, bound to Keypad Subtract by default. Your rotation goes in MapCycle.txt in the same folder, one scenario per line, and the loading-screen message in Motd.txt. Changes to admins apply after a restart or a map change.

Gameplay settings such as friendly fire, the kill feed, bots and vote kicks go in Game.ini under Insurgency/Saved/Config/LinuxServer, each under the section the guide names. One thing to know: the newer modded-server guide calls the admin and rotation files Admins.ini and MapCycle.ini. The vanilla guide says .txt; if your list seems ignored, try the other name.

Mods and remote admin, carefully

Mods follow New World Interactive's separate guide on mod.io. In short, the server signs in with its own mod.io account using the emailed code (add -SecurityCode= with that code on the first launch, then -SecurityCode=none from then on), you subscribe to mods on the mod.io website, and you launch with -mods. Its Linux instructions are a video, so set aside time.

Remote admin (RCON) is optional. If you want it, enable it in Game.ini's [Rcon] section with your own password and a port of your choice (the guide's example is 27015), plus bUseBroadcastAddress=False and ListenAddressOverride=127.0.0.1. Going by our own reading of the guide's settings table, that binds RCON to the loopback address (127.0.0.1), so that only the machine itself should be able to reach it. To be sure, run sudo ss -tlnp | grep 27015 after a restart and look for 127.0.0.1. Connect through ssh -L 27015:127.0.0.1:27015 yourname@your-server-ip. The guide's own RCON page reports server crashes with a third-party RCON wrapper, so if you do not need it, leave it off.

Finally, copy your Game.ini, Engine.ini, the Config/Server files, the start script and the service file somewhere other than this server, so a rebuild means reinstalling and copying them back.

Questions people ask

Is the Sandstorm server software free?

Yes. App 581330 downloads through SteamCMD with an anonymous login, no purchase needed. Generating the Steam token for stats, though, only works from an account with the game in its library.

Which ports should I open for players?

The ports you pass with -Port and -QueryPort, which the guide sets to 27102 and 27131, on TCP and UDP. Keep RCON closed to the internet and reach it through SSH.

Why are my players not getting XP?

Check four things: -GSLTToken= holds a token generated for app 581320; -GameStatsToken= holds your GameStats token; -GameStats is on the launch line; and no password is set. If any one is missing, the server does not report stats.

Can I use a cheap ARM server for it?

We would not. Valve's SteamCMD instructions need x86 packages and the guide's Linux server is an x86 build, so our advice is to pick an x86 machine. Our ARM servers suit other jobs.

Do I need Windows to host it?

No. The guide gives both Windows and Linux launch lines, and this page uses Linux, which avoids a Windows licence on your bill.