Garry's Mod dedicated server on Linux bare metal

What the server needs from the machine

Facepunch's Linux hosting article lists its prerequisites: a dedicated user to run the server (it recommends steam, home /home/steam), enough disk for the content you plan to install, a shell running as that user, and basic command-line experience. It publishes no per-player CPU or memory figure for Garry's Mod.

Valve's generic Source Dedicated Server page, written for every Source game rather than for Garry's Mod, sets a very low floor: a 1.0 GHz CPU for a basic 20-slot server, no less than 512 MB of memory, and 1 GB as enough for more than 60 slots. The same page highly recommends at least 4 GB of RAM on newer systems, naming Windows 10/11 and some Linux distributions. Treat those as the engine's floor. On a real Garry's Mod server the load comes from the gamemode, the Lua addons and the props players spawn, so size for the addon set you intend to run and watch it under load.

Ports to open, and TCP 27015 left closed

Valve lists the ports srcds officially requires, each movable with a startup option:

• 27015 TCP/UDP: game transmission, pings and RCON. Change it with -port.
• 27020 UDP: SourceTV. Change it with +tv_port.
• 27005 UDP: the client port. Change it with -clientport.
• 26900 UDP: the Steam port, outgoing. Change it with -sport.

Valve's RCON protocol page adds that RCON listens on TCP 27015 by default and follows -port if you move it. Our reading of that: players and the server browser need UDP 27015, while TCP 27015 only carries remote administration, so a host firewall can leave it closed and you administer from the console on the machine itself. Open 27020 only if you run SourceTV. Valve also notes a server will not answer queries until a map has loaded.

Installing app 4020 with SteamCMD

These steps follow Valve's SteamCMD page for Ubuntu and Facepunch's Linux article, on a fresh Ubuntu install with root over SSH. The firewall goes on first, before anything listens. Valve warns against running SteamCMD as root, so the download runs as the steam user. Installing the steamcmd package asks you to accept the Steam licence.

# as root: firewall first (SSH and the game port only)
ufw allow OpenSSH
ufw allow 27015/udp
ufw enable

# SteamCMD from the Ubuntu repositories (multiverse + i386)
add-apt-repository multiverse
dpkg --add-architecture i386
apt update
apt install steamcmd

# a normal user for the server; never download or run it as root
useradd -m steam
sudo -u steam bash -c 'cd /home/steam && /usr/games/steamcmd +force_install_dir /home/steam/gmodds +login anonymous +app_update 4020 validate +quit'

Valve's page says +force_install_dir must come before +login, as it does in the command above. If SteamCMD fails with linux32/steamcmd: No such file or directory, the 32-bit libraries are missing; the i386 architecture step above is what Valve's Ubuntu instructions use to provide them.

server.cfg and the RCON password

Source keeps a game's settings in its cfg folder, so for Garry's Mod the file is /home/steam/gmodds/garrysmod/cfg/server.cfg. Set hostname (what players see listed), rcon_password, and sv_location. Facepunch says the location value is the ISO 3166-1 alpha-2 country code that matches a flag icon, such as us or gb, with eu as a special case. Valve's RCON page says that if rcon_password is empty, every RCON login is refused.

The RCON password gives full control of the server, so keep the file private: chown steam:steam server.cfg and chmod 600 server.cfg. Keep it out of version control and out of support tickets. To keep a test server out of the public list while you work, set hide_server 1.

The GSLT, the launch line and a systemd unit

Facepunch says every Garry's Mod server should have a Game Server Login Token since the May 2020 update, and that servers without one suffer a severe ranking penalty in the server list. Create it at Steam's game server account page with 4000 (the base game) as the App ID, not 4020. Each server needs its own token: Facepunch traces Steam error code 6 disconnects to one token shared by two servers. An invalid or expired token prevents startup, and changing your Steam password invalidates every token you hold.

The block below keeps the token in /home/steam/gslt, mode 600 and owned by steam. It still has to reach srcds as a startup argument, so it is visible in the process list to anyone with a shell on the machine; on a single-tenant server that is only you. The launch line follows Facepunch's own examples, and the heredocs write the script and the unit as files rather than running them in your root shell.

# as root: token file (paste the token with nano), then the start script
install -m 600 -o steam -g steam /dev/null /home/steam/gslt
nano /home/steam/gslt
cat > /home/steam/start-gmod.sh <<'EOF'
cd /home/steam/gmodds || exit 1
exec ./srcds_run -game garrysmod +maxplayers 16 +gamemode sandbox \
  +map gm_construct +host_workshop_collection 123456789 \
  +sv_setsteamaccount "$(cat /home/steam/gslt)"
EOF
chown steam:steam /home/steam/start-gmod.sh
chmod 700 /home/steam/start-gmod.sh

cat > /etc/systemd/system/gmod.service <<'EOF'
[Unit]
Description=Garry's Mod dedicated server
After=network-online.target
Wants=network-online.target

[Service]
User=steam
ExecStart=/bin/bash /home/steam/start-gmod.sh
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now gmod

Facepunch's article uses a crontab @reboot line for the same job and notes that srcds_run already restarts the process after a crash; the unit adds a clean start and stop, and logs you can read with journalctl -u gmod.

Workshop collections and mounted game content

+host_workshop_collection makes the server download a Workshop collection at startup and mount every addon in it, including nested sub-collections. The collection must be public or unlisted, otherwise srcds cannot read it. From version 2026.09.22, Facepunch also accepts a list of Workshop IDs in cfg/srcds_workshop_ids.txt, in place of or beside a collection.

Addons update on every start. Setting host_workshop_autoupdate 0 stops that, which Facepunch suggests as protection against an addon update that turns malicious; the trade-off it names is that an updated map can then stop players joining. +gamemode takes the gamemode's folder name, which for Workshop gamemodes is usually in the addon's description.

Content from other Source games is a separate install. Facepunch's script fetches Team Fortress 2 as app 232250 into ~/content/tf2, and garrysmod/cfg/mount.cfg tells the server where to find it. Linux paths in that file are case-sensitive.

Which of our machines fit

Garry's Mod runs on the x86 lines on our game server page: HPE enterprise hardware, root access, and any Linux the line installs in one click, Ubuntu up to 26.04 on the widest. Leave out the ARM cartridge line (X-Gene): it boots only Ubuntu 16.04 and 18.04, and srcds and SteamCMD are x86 software.

• Port: unmetered, 1 Gbps on 10 of the 18 configurable lines and 500 Mbps on the other 8. No traffic allowance, no overage line.
• Location: New York, Miami, San Francisco, Amsterdam or Bucharest, all on our own network, AS19624. The data centers page lists each site.
• Console: each rack server and blade carries an out-of-band controller (iLO, iDRAC or a Supermicro BMC) published to the dashboard once you add a console login, so a firewall mistake is recoverable without SSH.
• Delivery: a racked machine is live about 30 minutes after the order is approved; a build to order takes 4 to 24 hours. Month-to-month terms.

If you run several game servers, our notes on a Counter-Strike 2 dedicated server cover the same SteamCMD and token workflow, and the Linux server page lists the distributions on offer.

Updates, branches and limits

Facepunch's update step is the same SteamCMD command again, and it says the server must be off or the update fails: systemctl stop gmod, run the sudo -u steam line from the install block, then start the unit. Facepunch also publishes beta branches (-beta dev, -beta prerelease, -beta x86-64 on app_update), and leaving one takes -beta public; simply dropping the flag keeps you on the last beta.

The limits are plain ones. For a small private sandbox among friends, a whole machine is overkill; Facepunch documents a -p2p mode for that case. Facepunch's Server Operator Rules apply to every public server, and breaking them gets the server blacklisted. Nothing on this page replaces backups: copy garrysmod/cfg and garrysmod/data off the machine on a schedule.