Ports, firewall, and NAT for an S&Box server

Introduction

S&Box listens by default on two UDP ports:

• 27015: game traffic (real-time player packets)
• 27016: query port (Steam Master Server, list appearance)

At VeryCloud, the Wisp panel automatically handles allocation and opening of these ports. This guide also covers cases where you self-host, where you put S&Box behind a proxy, or where you tunnel via GRE.

Prerequisites

• An S&Box server (at VeryCloud or elsewhere)
• root/admin access if self-hosting
• Basic knowledge of iptables or Windows Firewall

Step 1: Understand S&Box ports

No TCP. No default admin web port. Simpler than GMod / FiveM.

Step 2: At VeryCloud — nothing to do

On a Wisp VeryCloud server, the allocation is assigned at order time. Go to Network in the panel to see your ports. They're already open at node level and through our Netrix anti-DDoS filtering.

💡 If you want a custom port (rare case), add a secondary allocation from Network or open a ticket with support.

Step 3: Linux self-hosting — iptables / nftables

If you run sbox-server on a personal VM (no panel), you need to open ports manually.

With UFW (Debian/Ubuntu):

ufw allow 27015/udp comment 'S&Box game'
ufw allow 27016/udp comment 'S&Box query'
ufw reload

With raw iptables:

iptables -A INPUT -p udp --dport 27015 -j ACCEPT
iptables -A INPUT -p udp --dport 27016 -j ACCEPT
# Persist
netfilter-persistent save

With firewalld (RHEL/Rocky):

firewall-cmd --permanent --add-port=27015/udp
firewall-cmd --permanent --add-port=27016/udp
firewall-cmd --reload

Step 4: Windows self-hosting — Windows Firewall

New-NetFirewallRule -DisplayName "S&Box Game UDP" `
  -Direction Inbound -Protocol UDP -LocalPort 27015 -Action Allow

New-NetFirewallRule -DisplayName "S&Box Query UDP" `
  -Direction Inbound -Protocol UDP -LocalPort 27016 -Action Allow

Or via GUI: wf.msc → Inbound Rules → New Rule → Port → UDP → 27015,27016.

Step 5: NAT case (residential self-hosting)

If you run S&Box behind a home internet box:

1. Reserve a static LAN IP for the S&Box machine
2. Configure port forwarding on your box: UDP 27015 and 27016 → LAN IP
3. If you have multiple servers on the same network, change +port and +net_query_port

⚠️ Beware: many ISP boxes filter aggressively, and query port stability can be flaky. For serious hosting, go datacenter (VPS or dedicated server) rather than home.

Step 6: Test port openness

From a machine outside the network:

# With nmap
nmap -sU -p 27015,27016 SERVER.IP

# With netcat (TCP-style doesn't quite work for UDP, but you can try)
nc -u -v -z SERVER.IP 27015

Best test: launch S&Box, open server list, find your hostname. If it appears, query port (27016) is open.

Step 7: Filtering and anti-DDoS

At VeryCloud, the Netrix Anti-DDoS filters L3/L4/L7 attacks specific to UDP gaming protocols. No action required from you.

If self-hosting, you're exposed. Basic measures:

# Coarse rate-limit on 27015 (iptables hashlimit)
iptables -A INPUT -p udp --dport 27015 \
  -m hashlimit --hashlimit-name sbox \
  --hashlimit-above 200/sec --hashlimit-burst 400 \
  --hashlimit-mode srcip -j DROP

A workaround. Real protection needs a dedicated appliance or filtered transit IP.

Troubleshooting

Server is running but doesn't appear in the list

• Query port 27016 closed/blocked — check iptables/firewall
• +net_game_server_token not set? (not required but helps persistence)
• Wait 1-2 minutes for Steam propagation

Players see the server but can't connect

• Port 27015 blocked server-side or by player ISP
• Test from another network (mobile 4G for example)

Unusual latency despite open ports

• Conflict with another service on the same port
• Server CPU or network saturation — check Wisp graphs in Console

Useful commands

# List what's listening on UDP ports
ss -ulnp | grep 27015

# Test from outside (nmap)
nmap -sU -p 27015,27016 SERVER_IP

# View active iptables rules
iptables -L INPUT -n -v --line-numbers

Conclusion

At VeryCloud, allocation is handled for you: no action required except special cases. Self-hosting: 2 UDP ports to open, done. Residential NAT is the main pain vector — prefer a VPS or dedicated server for a stable public server.

Going further: admin permissions, performance tuning, managed anti-DDoS.

Resources

• S&Box Docs — Dedicated Servers
• Steam Master Server protocol
• iptables hashlimit
• UFW documentation