How to Set Up an Arma 3 Server

Ports and firewall rules

The default ports are all UDP, and the Steam ports are derived from the game port, so changing -port= shifts the whole block.

• Open ports alone are not enough: the server must also be pingable (ICMP 8, echo reply) before it can reach Steam's servers.
• IPv6 and DS-Lite IPv4-over-IPv6 tunnels are not supported; a real IPv4 connection is required.
• A second instance on the same machine belongs at least 100 ports higher — 2402-2406, then 2502-2506 — so the two query ranges cannot collide.
• BattlEye RCon is configured separately, in beserver.cfg (beserver_x64.cfg for the 64-bit server), where RConPassword sets the password and RConPort the port it listens on.

Installing the server files with SteamCMD

The server is its own Steam application, appID 233780, documented for Windows Server 2008 or later and for Linux. Ownership of the game is not checked, but anonymous SteamCMD login is refused, so real credentials have to be supplied.

On Linux, inside steamcmd.sh:

force_install_dir /home/steam/arma3
login <steam-login> <steam-password>
app_update 233780 validate
quit

The same steps work as a single Windows command line:

steamcmd.exe +login USERNAME PASSWORD +force_install_dir "C:\arma3" +app_update 233780 validate +quit

validate re-checks every file against Steam's manifest, which is what catches a corrupted download; the same app_update line is also how you patch later. Install the server in its own directory, kept apart from any Arma 3 client on the same machine.

The resulting binary is arma3server_x64 on Linux — 64-bit arrived with the 2.0 patch — while arma3server is the older 32-bit build; on Windows it is arma3server.exe. A first launch looks like this:

./arma3server_x64 -name=server -config=server.cfg -port=2302

server.cfg: the keys that decide behaviour

The file name itself carries no meaning: the file is chosen with -config=, and there is no default, so omitting the parameter means no server configuration is loaded at all.

For a public server the documented protection set is BattlEye = 1;, verifySignatures = 2; and allowedFilePatching = 0; used together, described as the de facto standard for public servers.

Loading mods and their keys

Mod folders are conventionally named with a leading @, and the server is told which ones to load on the command line:

# Windows
arma3server_x64.exe "-mod=@cba_a3;@ace" "-serverMod=@admintools"

# Linux: escape each semicolon so the shell does not split the command
./arma3server_x64 -mod=@cba_a3\;@ace -serverMod=@admintools

• -mod= covers anything the clients have to load too, while -serverMod= covers folders that stay on the server and are never sent out.
• Each signed addon carries a .bisign file, and the matching .bikey has to be copied into the server's keys folder. A vanilla installation holds only Bohemia's own bi.bikey, so a forgotten key produces the "not signed by a key accepted by this server" kick.
• To tie a mod to its Workshop entry, put a meta.cpp in the mod's root containing protocol = 1; and publishedid = 123456789;, taking the number from the Workshop URL. Without it, players have to activate the mod manually.
• On Linux, mods such as CUP Terrains and @ALiVE will not work if any of their file names contain capital letters. The documented remedies are renaming the tree to lowercase recursively, or mounting it through ciopfs, a case-insensitive filesystem.

Mission files and the rotation cycle

Custom missions go into the server's MPMissions folder as .pbo files. Which of them run, and in what order, is set by a class Missions block in the server config:

class Missions
{
    class Rotation01
    {
        template = "MyMission.Altis";
        difficulty = "Veteran";
        class Params
        {
            RespawnDelay = 15;
        };
    };
};

• The class keyword must be lowercase; a capitalised one throws a parsing error. The same parser is equally unforgiving about missing semicolons, unmatched quotes and stray braces.
• template is the mission name joined to its terrain — MyMission.Altis for a mission built on Altis — so the entry changes when the mission moves to another map.
• difficulty names the preset the mission runs under. Custom is the exception: it reads its values from the server profile instead of a built-in preset.
• class Params is optional and overrides that mission's own parameter defaults, which are declared in its Description.ext.

Startup parameters and the server profile

Beyond -config=, the parameters that matter on a first run are:

• -port= — the game port; the Steam query and master ports follow it automatically.
• -cfg= — the basic configuration file, which holds the network tuning values rather than the gameplay ones.
• -name= — the profile name, which also determines where the profile is written.
• -pid= — writes the process ID to a file that stop and restart scripts can read.
• -bePath= — points BattlEye at a folder other than the default.
• -enableHT — uses logical cores, but it is overridden whenever -cpuCount or -cpuAffinity is present, so combining them achieves nothing.

-profiles= is the exception: it does not work on Linux. Run the server with -name=server instead, and the profile is created on first start at ~/.local/share/Arma 3 - Other Profiles/server/server.Arma3Profile, in the home directory of the user the server process runs as. That file holds the difficulty settings, which is what a difficulty = "Custom" entry in the mission cycle reads from.

Errors with a documented cause

• 2500 ms ping in the server browser. Caused by running the Steam client without administrator rights.
• The server loads full client data instead of the server package. This happens when a game client is installed on the same machine, because of a precedence check in the registry. The documented workaround is an empty mod line: arma3server.exe -mod=.
• Nothing happens for ten minutes after starting. upnp = 1 on a host with an active firewall or anti-DDoS measures can hold the server back for 600 seconds; it is not recommended where the ports are already open or forwarded.
• Desync appears after network tuning. MaxMsgSend defaults to 128, and higher values cause desync when the available processing power or bandwidth cannot support them.
• A long mod list is truncated in the Launcher. steamProtocolMaxDataSize caps the Steam query packet length at 1024 by default. Raising it lifts that limit, but it can push UDP packets past the MTU, and some older routers do not support the resulting fragmentation.
• Clients refused after a branch switch. The development and stable branches have not been compatible since 12 March 2013: dev clients connect only to a dev server, and stable clients only to a stable one.