CS2 ports, server queries, and RCON security

CS2 ports, server queries, and RCON security. Version-specific steps, checks, rollback, and upstream sources for Source 2.

Counter-Strike 2Source 2Current

SHORT ANSWER

Document the Counter-Strike 2 connection endpoint, query endpoint, and administration method separately. Permit only the configured ports, test from outside the host, and restrict remote administration; do not expose a broad “Steam port range” without observing the running process.

Before you change anything

A legitimate Steam installation or dedicated-server installation for Counter-Strike 2.
A backup of every file that will be changed.
Access to the local client console or the dedicated-server console, as appropriate.

Version-specific procedure

Start the stock server and record its bound TCP/UDP sockets from the operating system.
Map each observed socket to player traffic, query traffic, TV/spectator service, or administration using the engine documentation.
Allow only the required direction and protocol in the host and network firewall.
Test player connection and A2S query independently from an external network.
Store RCON credentials outside public configs and rotate them after any accidental disclosure.

Verify the result

Every firewall rule maps to an observed service.
External player traffic and query traffic are tested separately.
RCON is not exposed with a default, reused, or published password.

Rollback

Remove the newly added narrow rules and restore the last known-good firewall configuration from its saved copy.

Common pitfalls

Source RCON documentation does not automatically apply to GoldSrc or Source 2 implementations; confirm the running engine’s method.