A CS2 server can accept players by IP and still be absent from the Internet list. Work out whether the failure is in joining, information queries, Steam login or the browser's selection of results. Reinstalling a working instance or regenerating tokens after every refresh makes that distinction harder.
This guide covers an existing Linux dedicated server reached by direct public IP. Keep its installed build, actual endpoint and startup configuration at hand. You need administrative access and a tester outside the server's network. It is a discovery investigation, not a replacement installation guide.
Record the symptom before changing settings#
Write down the public address, game port, server build and time with timezone. Ask the tester to try three things: join directly, add the endpoint to Favorites and search the Internet list. Record the exact result of each, including whether Favorites shows a current map or only an unresponsive saved address.
In the CS2 client console, replace this documentation-reserved address and example port with your real endpoint:
connect 203.0.113.20:27015
Reaching the map is stronger evidence than seeing a server name. A timeout, password rejection and version rejection are different outcomes. If the direct join fails, use the connection diagnosis guide first. Discovery can be a second problem, but a missing route needs its own repair.
A responsive Favorites entry establishes an information-query result for that endpoint and client. It does not prove every browser client has the same network path. Repeat a useful observation from another network before concluding that the service is universally reachable.
Match the instance with its actual sockets#
On the Linux host, inspect UDP listeners without dumping complete process arguments, which can contain credentials:
sudo ss -lunp
ps -eo pid,user,comm
Match the CS2 PID, bind address and configured endpoint. Multiple instances need distinct port allocations; a reply from another server is not a successful test of this one. Compare its current map and name with what Favorites displays.
Valve's Steam game-server interface distinguishes gameplay and query duties. That does not establish that a particular CS2 installation requires a second separately opened port. Inspect the actual configuration and traffic instead of importing another game's port formula.
Keep the game version current with the clients and preserve configuration before an update. Do not combine a plugin removal, reinstall, network migration and token rotation in one experiment. If behavior changes, you need to know which intervention caused it.
Verify Steam login and token handling#
Read the current startup log privately for Steam connection, game-server identity, authentication failures and disconnections. A token present in a config file does not establish a successful login. Conversely, a successful login does not establish that the browser selected the server.
For a systemd installation, substitute the real unit name:
sudo journalctl -u YOUR_CS2_UNIT -n 150 --no-pager
Review the instance's public-versus-LAN configuration in its actual console and config. A public server should not intentionally be restricted to LAN operation. Check the installed build's supported settings before editing; copying a long launch string from an old CS:GO tutorial can introduce unrelated changes.
Use Steam's server-account page to inspect the account when logs point to a GSLT problem. Valve lists account prerequisites and explains that a Steam password reset regenerates tokens; unused tokens can expire. Keep each running instance's account/token assignment distinct and keep tokens out of support posts, screenshots and shell history.
Rotate a token because it is invalid, compromised or demonstrably assigned incorrectly. Repeated rotation without a login error does not repair a query path or force Internet-list inclusion.
Remove filters and compare the same moment#
Clear map, name, ping, player-count, password and security filters that the current browser exposes. Check that you selected CS2 rather than a neighboring game. Refresh and repeat after startup has settled. Record whether the test happened immediately after a map change.
Compare the same endpoint on another client and another network. If one client can find it, capture both clients' filters and times before touching the server. If neither can find it but both join and query successfully, preserve those successful boundaries.
In Valve's open issue tracker, administrators describe this combination even with successful Steam login. October 2026 follow-ups discuss filters and map-transition timing. These are reports, not a confirmed universal fix. They do not establish a provider blacklist, and a value such as gmsindex=-1 alone cannot prove why a server is hidden.
Investigate failed queries at the network boundary#
If Favorites cannot obtain information, compare the actual UDP port against the host firewall, provider firewall and any NAT rule. Preserve SSH access and keep administration ports private. A TCP-only checker cannot verify a UDP query response.
With tcpdump already installed, capture one tester's attempt. Replace the example port and tester address; press Ctrl+C if the capture does not reach its packet limit:
sudo tcpdump -ni any -c 30 'udp port 27015 and host 198.51.100.24'
No matching packets calls for checking the filter, destination and upstream rules. Incoming packets without replies lead toward the host firewall, correct socket and application logs. Bidirectional traffic still requires a valid information response; arbitrary UDP activity does not establish a successful query. Avoid publishing payload captures containing player data.
Escalate with a reproducible matrix#
Report the build, endpoint, sanitized Steam-login outcome, direct-join result, responsive or unresponsive Favorites entry, cleared filters, test times and second-client comparison. Include when the behavior began and any single controlled change that affects it.
If gameplay, queries and login work while Internet discovery remains absent, give players the verified direct endpoint and keep the evidence for the relevant support channel. Another full reinstall has little diagnostic value until a failing boundary or reproducible configuration difference explains it.
