Hosting a Game Server From Home
A game server is the case where a public address genuinely wins. Players type an address and a port, the traffic is usually UDP, and you cannot ask strangers to install a VPN first — which rules out most of the free options that beat us elsewhere. Here is what to open, why your upload speed decides how many players you can hold, and the two situations where renting a host is the better answer.
Why the usual free answers do not fit here
Most of our guides end with "use Cloudflare Tunnel, it is free and better". This is the page where that stops being true, and it is worth being precise about why, because the reason is structural rather than a matter of degree.
Players connect to an address and a port. A game client has a server field, and what goes in it is a host and a port number. There is no place to put a tunnel hostname with a path, no HTTP layer to route on, and no way to hand the client a certificate and a virtual host.
Most game traffic is UDP. Cloudflare Tunnel is shaped around HTTP; Tailscale Funnel listens on a fixed set of TLS ports. Neither is built to carry arbitrary UDP on a port you choose, which is what a game server is.
You cannot ask the other end to install anything. Tailscale is genuinely better than a public address whenever the audience is your own devices — but a friend of a friend joining your server is not going to install a mesh VPN and accept an invite. The moment strangers are involved, a private network stops being an option by design.
So this is the narrow case where the honest answer is a routed public address, a rented server, or a game-specific tunnel service. All three are real; the rest of this page is about choosing.
What to open
Our addresses are closed by default apart from SSH, and you open what you need explicitly. The protocol matters — opening TCP when the game speaks UDP is the single most common reason a correctly-configured server appears dead:
sudo tnet ports allow udp 19132
Common ones, as a starting point rather than gospel — check your server's own documentation, because modded setups and version changes move them:
Minecraft. Java Edition is TCP 25565. Bedrock is UDP 19132. If you run both, you need both, and they are different protocols on different ports.
Valheim is UDP 2456 to 2458 — a range, and all three matter. sudo tnet ports allow udp 2456-2458.
Palworld is UDP 8211. Terraria is TCP 7777. Project Zomboid is UDP 16261 to 16262. Source-engine games including Counter-Strike are UDP 27015. Rust is UDP 28015.
After opening, check from outside your own network — a phone on mobile data is the easiest external vantage you have. Testing from inside the house can succeed over the LAN without the traffic ever leaving, which tells you nothing about whether a player can connect.
Your upload speed is the constraint, not your CPU
People size a home game server on cores and RAM, and then hit a wall that has nothing to do with either. The server sends a state update to every connected player, several times a second, so outbound traffic scales with player count while inbound barely moves. Home connections are asymmetric — often ten or twenty times more download than upload — so the direction you have least of is the direction a game server needs most.
Rough figures, and treat them as an order of magnitude rather than a specification: a Minecraft or Valheim-style server tends to want somewhere around 100 to 200 kbit/s of upload per connected player, and a fast-paced shooter wants several times that. Ten players on a survival server is a megabyte or two per second of upload at peak. That fits comfortably on most modern connections and not at all on an older DSL line.
The failure mode is worth recognising because it does not look like a bandwidth problem. Everyone gets rubber-banding and lag spikes at once, usually when the player count crosses some threshold, and the server's own CPU graph looks fine. If that is what you are seeing, measure your upload before you tune anything else.
And remember that upload is shared with everything else in the house. A server that is fine on a weekday afternoon can fall over when somebody starts a video call or a console downloads a patch.
What you are taking on
The address is yours and it is attributable. That is the product — but it means the address your players see is one leased to your account, and what happens on it is your responsibility. That is stated plainly in our acceptable use policy and it is not boilerplate.
We do not offer DDoS mitigation, and game servers attract it. This is the honest limitation and it is the one most likely to matter to you. Public game servers get attacked — by a player who lost, by someone who found the address in a server list, for no reason at all. Large providers absorb that; we are a small network and we do not. Our pricing page says the same thing in the other direction: for an HTTP service, Cloudflare's absorption is a real advantage we do not match. If your server is likely to be a target, weigh that before anything else on this page.
An exposed server is a server people probe. Within minutes of the address going live it will be scanned. Keep the game server patched, do not run it as root, and open only the port it needs — which is what the default-closed policy is for.
When to rent a host instead
Two situations, and neither is a close call.
If the game has a good managed host, use it. For popular titles there are providers charging a few dollars a month who handle updates, backups, mod installation and a control panel, on connections with far more upload than your house has. If you want to play the game rather than operate a server, that is the correct answer and it is cheaper than your time.
If latency to your players is what matters, put the server near them. A home server is at your house, so everyone else pays the distance. For a competitive shooter with players on another continent, a rented box in the right city beats anything you can do at home, and no amount of address routing changes the speed of light.
There are also game-specific tunnel services — playit.gg and similar — which give you a hostname and port that forwards to your machine, free at small scale. They work, they are shaped for exactly this, and they are worth trying first. What they do not give you is an address of your own, a port you choose, or any control over the path.
Where TunnelNet fits
A routed address makes sense here when you already have the hardware, when your upload can carry the player count you actually want, and when you want the server to be yours — a fixed address you can put in a Discord channel that keeps working when your ISP changes your IP, with whatever ports you decide, for anything you want to run alongside it.
It works from behind NAT or CGNAT with no port forwarding, because the tunnel dials outward from your machine. It is $10 a month for the address. It does not include DDoS protection, and if that is your main worry then a managed host is the better purchase.
If you are not sure whether your connection is the problem in the first place, the CGNAT guide has the two-command check, and plans and prices are one page over.