Killing Floor 2 dedicated server on bare metal: install, ports, web admin, Workshop

What Tripwire's guide pins down

Tripwire publishes no CPU, memory or disk figures for the server. Its wiki guide fixes the install, the binary, the ports and the config files; the table below is that guide, plus Valve's Dedicated Servers List for the app id. The revision quoted here was last edited on 30 July 2024 and read from the Internet Archive's copy, because the live wiki now answers scripts with a browser check.

Without an official floor, size by measurement. Our rule, not Tripwire's: start one instance, run a full Survival game at the player cap with the maps you plan to rotate, and watch top. If the process keeps a core busy, give it fewer neighbours; if it leaves most of the machine idle, the guide's per-instance options below let the same box carry more servers.

Ports and what each one carries

The guide's -Port= switch moves the game port, and the query port moves with it by the same offset unless -QueryPort= sets it apart. -WebAdminPort= exists too, marked beta in the guide; ListenPort in KFWeb.ini is the documented way to move the web admin.

Choosing the machine

Each machine is single-tenant: every core and all the memory go to the KF2 process and whatever you run beside it, with root and no hypervisor in between. Each includes one public IPv4 and an unmetered port, 1 Gbps on 10 of the 18 configurable lines and 500 Mbps on the other 8. Nothing counts the traffic. With a public address there is no home router in the path and no port forwarding to set up: the ports above are opened in the host firewall and nowhere else.

• Cities: New York, Miami, San Francisco, Amsterdam and Bucharest, on our own network, AS19624. Ping each city's test IP on the locations page from where your players are.
• Delivery: a build to order takes 4-24 hours, while a ready server, by contrast, is handed over in about 30 minutes once payment is approved.
• Operating system: Ubuntu installs in one click on the Linux servers; the widest lines go up to 26.04.
• Console: rack servers and blades carry an out-of-band controller (HPE iLO, Dell iDRAC or a Supermicro BMC), published in the dashboard once you add a console login. Moonshot cartridges other than the m510 and m710x have power control only.

Skip the ARM lines, both the X-Gene cartridge and the Ampere Altra. Our reading of the x86_64 suffix on the only Linux binary the guide names is that the server is built for x86-64, and the X-Gene cartridge boots only Ubuntu 16.04 or 18.04 in any case. Take an x86 line.

Installing app 232130 on Ubuntu

Run this as your own sudo user. The firewall comes up with SSH only, IPv6 included, before anything else listens; the game ports follow. Valve's SteamCMD page asks for a separate unprivileged account and for Ubuntu's multiverse repository with i386 packages enabled. If apt shows Steam's licence agreement, read it and accept it.

sudo sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
sudo ufw allow OpenSSH
sudo ufw --force enable
sudo ufw allow 7777/udp
sudo ufw allow 27015/udp
sudo ufw allow 20560/udp

sudo useradd -m -s /bin/bash kf2
sudo add-apt-repository -y multiverse
sudo dpkg --add-architecture i386
sudo apt update
sudo apt install -y steamcmd

sudo -u kf2 bash -c 'cd /home/kf2 && /usr/games/steamcmd +force_install_dir /home/kf2/server +login anonymous +app_update 232130 validate +quit'

1. force_install_dir comes before login, the order in Tripwire's own scripts.
2. validate checks every file. Tripwire uses it for a first install and for verifying a broken one; the routine update in the unit below leaves it out.
3. Check the SteamCMD path with command -v steamcmd and use what it prints if it is not /usr/games/steamcmd.

systemd unit, first start and updates

The guide's step to download the server is one Tripwire says to repeat for every game update, so the unit runs it before each start. With the - prefix, an update step that exits with an error does not stop the game from starting; an update that hangs keeps the start waiting until TimeoutStartSec=1800, half an hour, expires. Restart=always relaunches the game after any exit, since the guide does not document its exit codes.

sudo tee /etc/systemd/system/kf2.service > /dev/null <<'EOF'
[Unit]
Description=Killing Floor 2 server
Wants=network-online.target
After=network-online.target

[Service]
User=kf2
WorkingDirectory=/home/kf2/server
TimeoutStartSec=1800
ExecStartPre=-/usr/games/steamcmd +force_install_dir /home/kf2/server +login anonymous +app_update 232130 +quit
ExecStart=/home/kf2/server/Binaries/Win64/KFGameSteamServer.bin.x86_64 kf-bioticslab?Difficulty=1
Restart=always
RestartSec=15

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now kf2
sudo journalctl -u kf2 -f

• The map and URL options follow the binary, joined by ?. Difficulty runs 0-3 (Normal, Hard, Suicidal, Hell on Earth); ?Game=KFGameContent.KFGameInfo_Endless or KFGameInfo_WeeklySurvival picks those modes.
• Let the first start finish, so the server writes its own PCServer-*.ini files into KFGame/Config, then sudo systemctl stop kf2 before the next section.
• If the log loops on waiting for a Steam Server UID, Tripwire's advice includes validating the files; rerun the install line above with the service stopped.
• Updates after that are sudo systemctl restart kf2, which drops everyone online: pick an empty hour.

PCServer-KFGame.ini and the admin password

The guide accepts ?AdminPassword= on the command line, but anything on a launch line shows in the process list to every local user and lands in the unit file. Put it in the ini instead. Edit the keys under the section headers the first start already wrote, with the service stopped and as the service user: sudo -u kf2 nano /home/kf2/server/KFGame/Config/PCServer-KFGame.ini.

; /home/kf2/server/KFGame/Config/PCServer-KFGame.ini
[Engine.GameReplicationInfo]
ServerName=Biotics Lab, Hard, EU evenings
AdminContact=ops@example.com

[Engine.AccessControl]
AdminPassword=a-long-random-string
; GamePassword=only-if-the-server-is-private

; KFWeb.ini (find it: find /home/kf2/server -name KFWeb.ini)
[IpDrv.WebServer]
bEnabled=true
ListenPort=8080

Then sudo -u kf2 chmod 600 /home/kf2/server/KFGame/Config/PCServer-KFGame.ini. In the same file, GameLength sets 4, 7 or 10 rounds (0, 1, 2), and GameMapCycles with bUseMapList=True replaces the stock rotation; the guide warns that more than 519 maps in rotation breaks the server.

Web admin over an SSH tunnel

The web admin signs in as user Admin with the AdminPassword above; with no admin password set, nobody can log in. The guide describes no HTTPS option and gives a bare IP and port as the address, so treat it as plain HTTP: anything typed into it crosses the network unencrypted. Keep 8080 closed in ufw and tunnel to it through your own SSH login.

From your workstation: ssh -N -L 8080:203.0.113.10:8080 you@203.0.113.10, with your server's address in both places, then browse to http://localhost:8080. The tunnel ends on the server itself, where loopback traffic passes ufw, so the port never needs a public rule. If you must open it, limit it to one source: sudo ufw allow from 192.0.2.44 proto tcp to any port 8080.

Workshop maps and Server Takeover

1. Stop the service; the guide says a running server overrides the Workshop setup on its next restart.
2. In KFGame/Config/PCServer-KFEngine.ini, add a section [OnlineSubsystemSteamworks.KFWorkshopSteamworks] with one ServerSubscribedWorkshopItems= line per item: the number after id= in the item's Steam Workshop address.
3. For players to fetch those items from Steam on connect, add DownloadManagers=OnlineSubsystemSteamworks.SteamWorkshopDownload to [IpDrv.TcpNetDriver] in the same file, as the first DownloadManagers= line.
4. Start the server and let it download. Map files land in a folder per item, such as KFGame/Cache/535769647/0/BrewedPC for 535769647, the guide's Workshop Test map; the map name for your cycle is the file name without .kfm.

The guide notes that Linux servers do not create the cache folder and that you must run mkdir -p KFGame/Cache in the install folder. Create it as kf2 before the first Workshop start: sudo -u kf2 mkdir -p /home/kf2/server/KFGame/Cache.

Server Takeover lets matchmaking players claim an idle server, apply their own settings and switch it to private for the length of their visit; the guide says admin passwords are not exposed. To keep your server out of it, set bUsedForTakeover=FALSE under [Engine.GameEngine] in PCServer-KFEngine.ini.

Several servers, backups and limits

A second instance on the same machine gets its own install folder (a second force_install_dir, say /home/kf2/server2), its own unit file, its own config files inside that install and its own ports. Launch it with -Port=7787 and the guide says the query port moves by the same 10, to 27025; open that pair in ufw and give its web admin a different ListenPort in its own KFWeb.ini. The guide does not say whether the Steam port 20560 shifts too, so check with sudo ss -ulpn once the second instance runs. That layout is ours, not a Tripwire recipe.

The settings worth keeping are the ini files. With the service stopped: sudo tar czf /root/kf2-config-$(date +%F).tgz -C /home/kf2/server KFGame/Config, then copy the archive off the machine; it holds the admin password, so store it like one. To restore, stop the service and check the file is there first: sudo test -f /root/kf2-config-2026-10-23.tgz && sudo tar xzf /root/kf2-config-2026-10-23.tgz -C /home/kf2/server.

• Wrong fit: any ARM line, for the reason above.
• Wrong fit: wanting a panel that patches, backs up and restarts the game for you. Here you get root and a clean OS, and the game server is yours to run.

Hardware and network faults go to support: phone, email and live chat, 24/7.