Palworld Server Ports and Firewall Guide

Palworld Server Ports and Firewall Guide

Networking is one of the most common reasons a Palworld server works for some players but not others. This guide covers every port the server uses, how to forward them on a router, and how to secure management interfaces.

Gameplay and Steam query

The main game traffic runs over UDP port 8211. This port must be forwarded on your router and allowed through the host firewall. Steam server query traffic and the in-game server browser use UDP port 27015. If you want the server to appear in the community list and show player counts, forward UDP 27015 as well.

Many routers label protocol as TCP/UDP. Palworld gameplay and query traffic are UDP only. If you accidentally forward TCP 8211, players will not be able to connect.

Management ports

Remote management uses additional TCP ports. The REST API listens on TCP port 8212 when RESTAPIEnabled=True. The older RCON protocol uses TCP port 25575, but RCON is deprecated and scheduled to stop functioning. New installations should use the REST API instead.

Example INI entries:

RESTAPIEnabled=True
RESTAPIPort=8212

Security recommendations

Never expose the REST API or RCON ports to the public internet. These interfaces can save, shut down, kick, ban, and broadcast. Limit them to LAN access, or place them behind a reverse proxy with strong authentication. If you only use in-game admin commands, leave RESTAPIEnabled=False.

On a VPS or cloud instance, use the provider's firewall or security groups to block inbound TCP 8212 and 25575 from the internet. On Windows, allow only your local subnet.

Firewall examples

On Linux with ufw, allow the public game ports:

sudo ufw allow 8211/udp
sudo ufw allow 27015/udp

On Windows, allow PalServer.exe through Windows Defender Firewall for public and private networks. On your router, create port forwarding rules that send UDP 8211 and UDP 27015 to the server's local IP address.

UPnP and cloud hosting

Do not rely on UPnP for a public server. It may open ports temporarily but can fail after a router reboot. Manually configured port forwarding rules are more reliable. On cloud providers such as AWS, Azure, or OVH, open ports through the security group or firewall panel in addition to the host firewall.

If you use a reverse proxy for the REST API, bind the API to 127.0.0.1 on the server and forward only the paths you need. Avoid changing the default gameplay port unless you have a specific reason; players are used to 8211, and custom ports must be included in every direct-join address.

Verifying connectivity

After opening ports, compare your router's WAN IP with the PublicIP value in PalWorldSettings.ini. Use an external port-checking tool to confirm UDP 8211 is reachable. Without that, external players cannot join. A few minutes spent on firewall rules will save hours of troubleshooting connection errors later.