Killing Floor server ports and NAT (port forwarding guide)

This page focuses on the mindset and the checklist that solves most cases.

The simple model (what must be true)

Your router must forward that port to the host machine (if you host at home).
Your firewall must allow inbound traffic on that port.
Your public IP must be reachable (some ISPs use CGNAT).

Step-by-step checklist

1) Pick a fixed server port

Do not leave ports random. Use a fixed game port in server config.

If you do not know where to set it, start with the dedicated server guide:

Dedicated server setup (KF1)

2) Allow it in firewall (host machine)

On Windows, the first run often triggers a firewall prompt. If you missed it:

Allow the server process in Windows Firewall (Private/Public as needed).

3) Forward the port on your router (home hosting)

Create a port forward rule:

External port: your chosen server port
Internal IP: the LAN IP of the host machine
Internal port: same port
Protocol: usually UDP (depends on server config)

Important:

Make the host LAN IP static (DHCP reservation), or your forwarding will break later.

MikroTik RouterOS. In the killingfloor.ru forum "Help me open ports" thread, a user could not open ports on MikroTik RouterOS v5.12 through Firewall. Flack's answer: a forwarding rule is needed, not just an opened port. In the general settings: chain DST_NAT, Dst Addr. - the external address, Port - 7707, protocol - UDP; in Action: dst NAT, address - the server's local IP, dst port - 7707.

4) Verify your public reachability (CGNAT check)

If you configured forwarding and firewall, but nobody can join, your ISP might use CGNAT.

Typical signs:

You have no real public IPv4 address on your router.
Port forwarding seems to do nothing.

In that case, options are:

host on a VPS with a public IP
ask ISP for a public IP option
use an existing community server instead
let a friend whose ISP gives a public IP host, or play over a virtual network; see Hamachi (from the "How to get around NAT?" thread on the killingfloor.ru forum)

If your IP changes and players need a stable address, point a domain name at it: a bought domain on a static IP, or a free dynamic DNS service such as No-IP that updates the record for you.

KF ports and a Windows Firewall rule

Based on the thread "Checking/Opening ports on Windows XP/7" on the killingfloor.ru forum (Винни, 2011–2013).

Ports the thread suggests opening for KF:

7707;7709 - UDP (Game).
7708;7710 - UDP (Query).
7717;7719 - UDP (GameSpy).
8075; 8077 - TCP (WebAdmin).
20560; 20562 - UDP & TCP (Steam).
28852; 28854 - UDP & TCP (Master Server Browser).

Use the port set in the game; the default is 7707.

Windows 7:

Control Panel → Windows Firewall (turn it on if it is off).
"Advanced settings" → "Inbound Rules" → "New Rule".
Choose "Port", then TCP or UDP (better to create a rule for each in turn) and "Specific local ports", and enter the ports from the list above.
"Allow the connection", tick all profiles, name the rule and click "Finish".

Windows XP: Start → Control Panel → Network and Internet Connections → Windows Firewall → Exceptions → Add Port. Name the exception, for example KillingFloorServer, enter the port and add it as two separate exceptions, one for TCP and one for UDP. Save and reboot.

If the ports are still closed:

Your antivirus may be blocking them. For Eset NOD32 the thread suggests temporarily disabling protection and the firewall.
If disabling the antivirus does not help, the cause is most likely your ISP.
Some routers have a DMZ feature: it opens all ports on the router, but for one computer only.
Switching the modem to bridge mode opens all ports automatically; you can check the result with an online port scanner.

Troubleshooting (fast)

Symptom: friends can join on LAN, but not from the internet

Almost always port forwarding or CGNAT.

Symptom: one friend can join, another cannot

Could be their network restrictions, firewall, or mismatched connection method. Try:

Have them try a different network (mobile hotspot) as a test.

Such servers cannot share ports: a port can only be forwarded to one internal IP. Each server needs its own ports, and all of them must be forwarded; the first three (game, query, WebAdmin) go into each server's killingfloor.ini.
The thread's author found that the common Steam port (20560) can be shared by all servers, but each server needs its own master server port.
Forward each port to the same number the server listens on. The author had external 7707 mapped to internal 7607: traffic came in on 7607 but still went out on 7707, and that kept the server out of the list.

Mini scenario (realistic)

A server host forwards the port but forgets to reserve a static LAN IP. It works for a day, then breaks after a router reboot because the host gets a new IP. Fixing DHCP reservation makes it stable.