Host a TF2 dedicated server your community can count on

What your TF2 server actually needs

Less than you might expect. The Valve Developer Community (VDC) gives no figures for TF2 alone; its general page for Source servers names 512 MB of memory as the minimum, 1 GB as enough for over 60 player slots, and at least 4 GB on newer operating systems. The Official TF2 Wiki asks for roughly 8 GB of free disk.

What matters more is the kind of processor and the connection. The wiki's Linux guide targets x86 and x86_64 machines with 32-bit compatibility libraries, and VDC says the server has to accept incoming connections nobody asked for, which is exactly what a home router blocks. VDC also warns that carrier-grade NAT, common on mobile and some home lines, may make hosting impossible.

How many players? VDC's maxplayers page puts TF2 at 101, or 33 on 32-bit unless you start with -unrestricted_maxplayers, a flag its command-line page says is unsupported and causes stability issues near the top. This guide uses 24 slots, the number in the wiki's own example.

The server that fits

Pick an x86 rack server or blade from our game server machines, in whichever of our five cities (Bucharest, Amsterdam, Miami, San Francisco or New York) sits nearest your players. The whole machine is yours, with root, so nothing else competes with your matches for the processor.

• A ready server is yours in about 30 minutes; payment verification can make it longer. Instant servers shows what is racked.
• Every server ships on an unmetered port, so busy nights don't run up a traffic bill.
• On a rack server or blade you get a management controller (HPE's iLO, Dell's iDRAC, or the BMC on Supermicro boards): a browser-based console plus power control for the day it won't boot. The dashboard shows it when you add console credentials.
• You can have Ubuntu put on with one click. Our Linux page covers the rest of the choices.

You manage the server; we keep the hardware and the network running.

Skip our ARM servers for this game. This is our own conclusion rather than Valve's: neither VDC nor the TF2 Wiki describes running the server on arm64, and the wiki's guide covers x86 machines only. Our ARM cartridge is also limited to Ubuntu 16.04 or 18.04.

Up and running in one sitting

Log in over SSH and paste this block. It starts the firewall first, then installs SteamCMD and the server as a normal user called gameserver, the name the TF2 Wiki suggests; VDC says running SteamCMD as root is a security risk. Swap 198.51.100.7 for your own home address.

# 1. Firewall first: IPv6 on, SSH kept, then the game port
sudo sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
sudo ufw allow OpenSSH
sudo ufw --force enable
sudo ufw allow 27015/udp
sudo ufw allow from 198.51.100.7 to any port 27015 proto tcp

# 2. The 32-bit pieces SteamCMD needs, and an account to run under
sudo apt-get update && sudo apt-get install -y lib32gcc-s1 lib32stdc++6 curl
sudo useradd --create-home --shell /bin/bash gameserver

# 3. SteamCMD and the TF2 server files (app 232250, anonymous)
sudo -u gameserver bash -c 'mkdir -p /home/gameserver/steamcmd && cd /home/gameserver/steamcmd && curl -sqL "https://client-update.steamstatic.com/installer/steamcmd_linux.tar.gz" | tar zxf -'
sudo -u gameserver bash -c 'cd /home/gameserver/steamcmd && ./steamcmd.sh +force_install_dir /home/gameserver/tf2 +login anonymous +app_update 232250 validate +quit'
sudo -u gameserver bash -c 'mkdir -p /home/gameserver/.steam/sdk32 && ln -sf /home/gameserver/steamcmd/linux32/steamclient.so /home/gameserver/.steam/sdk32/steamclient.so'

1. The firewall order matters: IPv6 is switched on before any rule is added, SSH is allowed before the firewall starts, and the game port comes last.
2. lib32gcc-s1 and lib32stdc++6 are the 32-bit libraries VDC names for SteamCMD on 64-bit Ubuntu. The wiki lists a few more; some of them, like libtinfo5:i386, are no longer shipped in recent releases, so add one only if the server stops and names it.
3. On VDC's list of dedicated servers, 232250 is TF2's, and it can be downloaded anonymously.
4. The last line links Steam's client library where the server looks for it; the TF2 Wiki's fix for a missing steamclient.so.

Getting listed: the Steam login token

A Game Server Login Token (GSLT) lets your server sign in to Steam as its own game server account. Valve's pages don't spell out a TF2 rule, but the Official TF2 Wiki tells you a server without a valid token won't be listed. The wiki ties the listing to the token; it does not say what happens without one.

1. Open the token page, steamcommunity.com/dev/managegameservers. Valve asks that your account owns the game, has a qualifying phone number, and is not limited, locked or banned. Since June 2011 TF2 has cost nothing (VDC), so as we read it, adding the game to your library covers ownership.
2. Make the token for app 440, the game's own ID on Steam according to VDC. 232250 is just the server download.
3. Make an empty, private file before the token goes in: sudo mkdir -m 700 /etc/tf2server and sudo install -m 0600 -o root -g root /dev/null /etc/tf2server/token.env. Then sudo nano /etc/tf2server/token.env and write one line, TF2_GSLT= followed by your token.

Keep the token to yourself; Valve says not to share it, and you answer for anything done with it. If it goes unused for a long time it expires, and a Steam password reset regenerates all of your tokens; either way, make a new one on the same page. If the log shows result 18 or 106, VDC's advice is the same: regenerate or replace the token.

Name, passwords and map rotation

Your settings live in tf/cfg/server.cfg, which VDC says runs at start-up and after every map change. Because it holds your remote-console password, create it locked first with sudo install -m 600 -o gameserver -g gameserver /dev/null /home/gameserver/tf2/tf/cfg/server.cfg, then fill it in with sudo -u gameserver nano and the same path.

// /home/gameserver/tf2/tf/cfg/server.cfg  -- owner gameserver, mode 600
hostname "Friday Night Fort"
rcon_password "change-me-to-something-long"
sv_password "only-for-friends"
sv_lan 0
mapcyclefile "rotation_friday.txt"

// /home/gameserver/tf2/tf/cfg/rotation_friday.txt
cp_granary
ctf_2fort
pl_badwater
cp_dustbowl

• hostname is what people see in the browser list (up to 64 characters, in quotes if it has spaces).
• rcon_password lets you run console commands from afar. Keep it here rather than on the start-up line, where anyone on the machine could read it with ps.
• sv_password is the join password. Leave it as "" for a public server, or set one for a friends-only night.
• sv_lan 0 keeps it an internet server; VDC says a LAN server skips the heartbeat and authentication.
• Your rotation lives in a file named by you, because VDC warns that a validate run puts a changed mapcycle.txt back to the default, while files the install doesn't own are left alone. Write one map per line, without .bsp.

Keep it running after you log off

A systemd service starts your server at boot, checks for a TF2 update before every start, and brings the server back if it stops.

# /etc/systemd/system/tf2server.service
[Unit]
Description=TF2 community server
Wants=network-online.target
After=network-online.target

[Service]
User=gameserver
WorkingDirectory=/home/gameserver/tf2
EnvironmentFile=/etc/tf2server/token.env
TimeoutStartSec=1800
ExecStartPre=-/home/gameserver/steamcmd/steamcmd.sh +force_install_dir /home/gameserver/tf2 +login anonymous +app_update 232250 +quit
ExecStart=/home/gameserver/tf2/srcds_run -game tf -console -norestart -nohltv -port 27015 +map cp_granary +maxplayers 24 +sv_setsteamaccount ${TF2_GSLT}
Restart=always
RestartSec=20

[Install]
WantedBy=multi-user.target

1. Save it and run sudo systemctl daemon-reload. Then sudo systemctl enable --now tf2server starts it and sets it to start at boot.
2. Watch the server's output with journalctl -u tf2server -f. VDC notes the server won't reply to queries until its first map has loaded.
3. To pick up a game update, run sudo systemctl restart tf2server; the update step runs before the server starts.

A few honest details. -norestart stops srcds_run restarting the server itself, so Restart=always makes systemd do it, whether the process crashed or exited cleanly. The dash in ExecStartPre=- means an update that fails with an error doesn't block the start; an update that hangs will hold it for as long as TimeoutStartSec=1800 permits, which is half an hour. And the token is passed on the server's command line, so other users on the machine could see it with ps; on a server only you log into, that is acceptable.

Ports, a second server, and what to save

VDC lists 27015 for both UDP and TCP. Players use UDP 27015; the remote console uses TCP on the same number, which is why the firewall opens TCP to your address only. -nohltv turns off SourceTV and closes its UDP port 27020; drop the flag and open that port if you want spectators. VDC also lists 27005 UDP (the client port) and 26900 UDP (outgoing, for Steam) among the required ports. Our reading, not VDC's, is that neither needs an inbound rule, since ufw lets outgoing traffic through by default.

Want a second server, say one for practice? Give it a separate folder (+force_install_dir /home/gameserver/tf2-practice), a server.cfg of its own inside it, a separate token, a separate service file and -port 27016, then open 27016 UDP to everyone and 27016 TCP to yourself.

SteamCMD can always download the game again, but not your own work. Copy these to a computer of yours from time to time: tf/cfg, maps you've dropped into tf/maps, plus tf/custom and tf/addons when you've used them, the service file and the token file. The copy contains passwords, so store it somewhere private.

Never put -insecure on a public server: VDC says it starts the server without Valve Anti-Cheat. Running another Source game too? Our Left 4 Dead 2 guide follows the same pattern.

Questions people ask

Do I have to pay for the TF2 server software?

No. The server files are app 232250, which VDC lists as downloadable with an anonymous SteamCMD login, so you never type a Steam password on the machine. The game itself costs nothing either.

Why doesn't my server show up in the browser?

Look at the login token first: the TF2 Wiki ties a listing in the server browser to a valid one. Check the log for result 18 or 106, which VDC says means the token must be regenerated or replaced, and make sure sv_lan is 0.

Which app ID goes on the token, 440 or 232250?

440, which VDC lists as Team Fortress 2's Steam app ID. 232250 is only what SteamCMD downloads to run the server.

Can I run more than 24 players?

Change +maxplayers in the service file and restart; VDC says the value can't change while the server runs. VDC's figure for TF2 is 101, yet only 33 for a 32-bit server not launched with -unrestricted_maxplayers; VDC's list of launch options describes that option as unsupported.

How do I lock the server to my group?

Put a password in sv_password in server.cfg and share it with your players. The file is already private at mode 600, which also protects your RCON password.

How long until my server is ready to set up?

A ready server is yours in about 30 minutes, and payment verification can add time. A custom build takes longer. The setup in this guide is a handful of commands after that.