NMRiH Server Port Forwarding
Open UDP 27015 for NMRiH gameplay and optionally TCP 27015 for RCON — with UFW and Windows Firewall examples and a security note on RCON exposure.
Port Forwarding for No More Room in Hell
NMRiH uses the Source engine's standard port scheme. Only one port is required for players to connect and play.
Required Ports
| Port | Protocol | Purpose |
|---|---|---|
| 27015 | UDP | Game traffic — required for players to connect |
| 27015 | TCP | RCON — only open if you use remote console access |
UDP 27015 is the only port you must forward. TCP 27015 is optional and should only be opened if you actively need RCON access from outside the server.
Router Port Forwarding
Log in to your router's admin interface (commonly 192.168.1.1 or 192.168.0.1). Navigate to port forwarding and create a rule:
- Protocol: UDP
- External port: 27015
- Internal port: 27015
- Internal IP: the local IP of your server machine (e.g.
192.168.1.50)
If you need RCON, add a second rule with protocol TCP on the same ports.
Linux — UFW
# Allow game traffic
sudo ufw allow 27015/udp
# Allow RCON (only if needed)
sudo ufw allow 27015/tcp
sudo ufw reload
Verify the rules are active:
sudo ufw status
Linux — iptables (without UFW)
# Game traffic
sudo iptables -A INPUT -p udp --dport 27015 -j ACCEPT
# RCON (optional)
sudo iptables -A INPUT -p tcp --dport 27015 -j ACCEPT
Windows Firewall
Open Windows Defender Firewall with Advanced Security and create an inbound rule:
- New Rule → Port → UDP → Specific local port:
27015→ Allow the connection - Name it (e.g. "NMRiH Game Traffic")
For RCON: repeat with protocol TCP.
Alternatively, via PowerShell:
# Game traffic
New-NetFirewallRule -DisplayName "NMRiH UDP 27015" -Direction Inbound -Protocol UDP -LocalPort 27015 -Action Allow
# RCON (optional)
New-NetFirewallRule -DisplayName "NMRiH TCP 27015" -Direction Inbound -Protocol TCP -LocalPort 27015 -Action Allow
RCON Security Warning
Exposing TCP 27015 to the internet gives anyone who knows your rcon_password full console access to the server. If your password is weak or leaked, an attacker can run any server command — including shutting the server down or executing arbitrary configs.
Best practice: Do not expose TCP 27015 publicly. Instead, use SSH tunneling to forward the port only when you need it:
ssh -L 27015:localhost:27015 [email protected]
Then connect your RCON client to localhost:27015 rather than the public IP.