Insurgency: Sandstorm server setup, config and mods

The Insurgency: Sandstorm dedicated server is a free SteamCMD download (app id 581330) with a native Linux build, it listens on two UDP ports, and it wants 2 to 3 GB of memory and one fast core. Almost everything that makes it behave the way you want is in two places: a long travel URL appended to the map name on the command line, and a Game.ini that does not exist until you create it. That second point catches nearly everyone - a fresh install has no config directory at all, so the first hour is often spent editing files the server has never read.

What the dedicated server gives you#

One server runs one scenario at a time. A scenario is a map, a game mode and usually a faction bundled into one name, and changing between them is a travel rather than a restart, either through the map cycle or an admin command.

The two families are worth separating, because they size and configure differently:

• Co-op, which is Checkpoint, Outpost, Survival and their hardcore variants. Humans against bots. Eight human players is a hard cap here; setting a higher number is ignored. Bot counts, not player counts, decide what it costs to run.
• PvP, which is Push, Firefight, Skirmish, Frontline, Domination, Team Deathmatch, Ambush and Defusal. Twenty-eight players is the number in every official example.

Out of the box you also get a real RCON implementation over the Source protocol, an admin file of Steam IDs with an in-game admin menu, a ban file the server maintains itself, a map cycle, a message of the day, and twenty-odd shipped mutators that change the rules without any third-party code. Mods on top of that come through mod.io, and the way that works changed recently enough that most of what you will find written about it is wrong.

Requirements and resource usage#

New World Interactive publishes no official figures, so these come from measurement rather than a spec sheet. Bots are the expensive thing, not humans.

• CPU: an Unreal Engine 4 dedicated server runs its game thread on one core. Clock speed is what holds the tick rate together during a firefight; extra cores mostly help the engine's worker threads and the operating system.
• Disk: the install is several gigabytes and mods add to it. Fifteen to twenty gigabytes is a comfortable floor for a modded server.
• Network: modest. Sandstorm is not a bandwidth-hungry game, and latency between the players and the server matters far more than throughput - see latency, jitter and packet loss for how to tell which of the three you have.

The uncomfortable version of the sizing question: a co-op server with MaximumEnemies pushed up is a much heavier server than the same box running 28-player Push, and no amount of memory fixes a bot count that a single core cannot simulate.

Installing, and the config folder that does not exist#

Anonymous on SteamCMD, no account needed:

$ steamcmd +force_install_dir /home/sandstorm/server +login anonymous \    +app_update 581330 validate +quit

SteamCMD explained has the general form, including update scripts. The binaries:

Now the part that is not obvious. The ini configuration lives in Insurgency/Saved/Config/LinuxServer/ (or WindowsServer/ on Windows), and neither the directory nor the files exist on a fresh install. You create them:

$ mkdir -p Insurgency/Saved/Config/LinuxServer$ touch Insurgency/Saved/Config/LinuxServer/Game.ini$ touch Insurgency/Saved/Config/LinuxServer/Engine.ini

A second, separate directory holds the plain-text server files, and this one does ship with the install:

Insurgency/Config/Server/  Admins.txt      one SteamID64 per line  MapCycle.txt    the rotation  Motd.txt        the message of the day  Mods.txt        mod ids, on the older mod scheme  Bans.json       written and read by the server itself

Two config trees with different rules is unusual and it is the main reason people put settings in the wrong file. Ini settings go in Saved/Config/<platform>Server/. Lists of things go in Config/Server/. On RE:NODE both are in the file manager and over SFTP, and the in-browser editor will highlight the ini syntax so a missing bracket is visible.

The launch line: maps, scenarios and lighting#

The server is started with a map name, a travel URL of ?-separated parameters, and then command-line switches:

$ ./Insurgency/Binaries/Linux/InsurgencyServer-Linux-Shipping \    Oilfield?Scenario=Scenario_Refinery_Push_Security?MaxPlayers=28 \    -Port=27102 -QueryPort=27131 -log -hostname="Frankfurt Push"

Look at that line carefully, because it contains the single most confusing thing about this game. The map token is Oilfield. The scenario token says Refinery. They are the same place. Sandstorm's maps have an internal name and a display name, and the travel URL wants the internal one while the scenario wants the display one:

Farmhouse, Ministry, Precinct, PowerPlant, Tell and Bab are the same in both. Everything else in the pair table is a trap you will fall into once.

Scenario names follow Scenario_<DisplayName>_<Mode> with a faction or layout suffix where the mode needs one: Scenario_Refinery_Push_Security, Scenario_Hideout_Checkpoint_Security, Scenario_Crossing_Skirmish, Scenario_Farmhouse_Firefight_West, Scenario_Precinct_Domination, Scenario_Bab_Survival. For Checkpoint the faction is the side you play; for Push it is the side you attack as.

The travel parameters worth knowing, each prefixed with ?:

Game.ini: the settings that matter#

Three sections carry most of it, and which section a key belongs to is not always intuitive.

[/Script/Insurgency.INSGameMode]bKillFeed=FalsebKillFeedSpectator=TrueTeamKillLimit=3TeamKillGrace=0.2bDeadSay=FalsebVoiceAllowDeadChat=False[/Script/Insurgency.INSMultiplayerMode]bAllowFriendlyFire=TrueFriendlyFireModifier=0.2FriendlyFireReflect=0bAutoBalanceTeams=TruebMapVoting=TruebUseMapCycle=TrueTeamSwitchTime=10IdleLimit=150bBots=False[/Script/Insurgency.INSCoopMode]AIDifficulty=0.5FriendlyBotQuota=4MinimumEnemies=6MaximumEnemies=12bUseVehicleInsertion=True

The four keys in [/Script/Insurgency.INSCoopMode] are the whole of co-op tuning. AIDifficulty is a float from 0 to 1 and 0.5 is the default; small changes to it are felt immediately, and pushing it to 1 makes bots unpleasantly accurate rather than tactically smarter. MinimumEnemies and MaximumEnemies set the band the server scales bot counts inside, and they are the numbers that decide whether your plan is big enough. FriendlyBotQuota adds AI teammates, which is how a server of three friends still feels like a squad.

Some placements are worth memorising because they are commonly got wrong:

• Friendly fire, RoundLimit, bBots and the team-switch timer are in INSMultiplayerMode, not INSGameMode and not INSCoopMode.
• The key is TeamSwitchTime, not TeamSwitchTimer.
• There is no family of bVoteX keys. Voting is [/Script/Insurgency.TeamInfo] bVotingEnabled plus a [/Script/Insurgency.VoteIssueKick] section with MinimumPlayersRequired, VotePassRatio, VoteTimeout and friends. Vote kick is still the only supported vote issue.

Per-mode sections exist too, named after the mode: [/Script/Insurgency.INSCheckpointGameMode] holds DefendTimer, RetreatTimer, RespawnDelay, CounterAttackRespawnDelay and the rest of the Checkpoint pacing. Those are the knobs for a co-op server that feels too frantic or too slow.

Map cycles and mutators#

MapCycle.txt accepts two forms. One scenario per line is enough for most servers:

Scenario_Crossing_SkirmishScenario_Hideout_SkirmishScenario_Refinery_Push_Security

The tuple form lets you override the mode or the lighting per entry, which is how you get the same map in the rotation both by day and by night:

(Scenario="Scenario_Town_Checkpoint_Security",Lighting="Day")(Scenario="Scenario_Town_Checkpoint_Security",Lighting="Night")(Scenario="Scenario_Town_Checkpoint_Security",Mode="CheckpointHardcore")

The cycle needs bUseMapCycle=True to be used at all, and the file is selected with -MapCycle= if you keep more than one. With no cycle file the server rotates through every PvP scenario, which is almost never what a co-op server wants.

Mutators are the other half of this, and they are a genuinely good feature that costs nothing to try. Around two dozen ship with the game and are selected by name on the command line: -mutators=Hardcore, or several comma-separated. The list includes Competitive, Hardcore, Frenzy, BoltActionsOnly, PistolsOnly, ShotgunsOnly, HeadshotOnly, Vampirism, LowGravity, FastMovement, SlowMovement, BulletSponge, HotPotato, Warlords and SoldierOfFortune. A server running Hardcore plus a night-time Checkpoint cycle is a completely different experience from the default, with no mods involved.

Admins, RCON and the commands#

Admins.txt is one SteamID64 per line, no blank lines, in Insurgency/Config/Server/. It is read at start-up and on a level change, so adding somebody mid-round means waiting for the next map rather than restarting.

An admin in game opens the admin menu, bound by default to Keypad Subtract. The same commands go over RCON or the server console. RCON is the real remote administration here, and unlike Killing Floor 2 or Valheim it is a proper implementation of the Source protocol - which means it is TCP, and the familiar clients work with it.

[Rcon]bEnabled=TruePassword=a-long-random-stringListenPort=27015bAllowConsoleCommands=TrueMaxPasswordAttempts=3IncorrectPasswordBanTime=30

The command set, with <> mandatory and [] optional:

gamemodeproperty is the one that repays learning. It changes a Game.ini value on the running server, so you can raise MaximumEnemies mid-session and watch what it does rather than editing, restarting and guessing. listgamemodeproperties prints the ones the current mode exposes.

Anything the server does not recognise as an admin command is passed through as a console command, which is why bAllowConsoleCommands exists and why an RCON password deserves the same care as a root password.

Ports, the server browser and stats#

Set the first two with -Port= and -QueryPort=. The official guidance is to open the game and query ports for both TCP and UDP, and there is no cost to following it. A server that runs but never appears is the query port nine times out of ten - game server ports explained covers why that pair exists and how to test each half separately.

Stats and XP are a separate thing from being listed, and this is where the tokens come in. Any community server can host a stats-enabled game, and the requirements are specific: a Steam game server login token, the -GameStats switch, a second token generated on New World's own game stats site and passed as -GameStatsToken=, and no server password. A password disqualifies the server from stats entirely. The GSLT is created for app id 581320, which is the game rather than the server tool - Steam game server tokens covers what a GSLT is and how bans against one work. If you do not care about XP, you need none of this; the server runs and lists perfectly well without a token.

Mods through mod.io#

Sandstorm's mods come from mod.io rather than the Steam Workshop, and how a server subscribes to them changed. Both schemes are documented on the internet and only one of them currently works, so check which you are reading.

The older scheme put a mod.io OAuth access token in Engine.ini under [/Script/ModKit.ModIOClient], listed numeric mod ids in Insurgency/Config/Server/Mods.txt, and added -Mods to the command line. Almost every hosting knowledge base still describes this.

The current scheme registers the server itself as a mod.io user. You authorise it once with a security code emailed to your mod.io account, pass that code on the first launch only, and manage which mods the server runs from the mod.io web portal rather than from a text file:

$ ./InsurgencyServer-Linux-Shipping -mods -SecurityCode=34678 \    -ModDownloadTravelTo=Mod_Test?Scenario=Scenario_Mod_Test \    -Port=27102 -QueryPort=27131 -hostname="Modded"

Every launch after that uses -SecurityCode=none. There is one constraint that catches people running a server on their own gaming PC: the mod.io client does not support more than one instance under one account on one machine, so a co-located game client has to subscribe to the mods separately under its own account.

When mods stop downloading after an update, the fix is almost always to re-authorise and clear the mod.io caches - there is one under the public user directory and one in the local application data folder. The general playbook for the day a mod breaks is in what to do when a mod update breaks, and the hygiene argument for not installing everything you find is in keeping a modded server clean.

Troubleshooting#

Nothing in my config does anything. The Saved/Config/LinuxServer directory or the ini files inside it do not exist. The server does not create them.

A setting is ignored but the file is right. Check the section. Friendly fire and bBots belong to INSMultiplayerMode; mutator settings belong to Engine.ini; [Rcon] belongs to Game.ini.

More than eight people cannot join my co-op server. That is the cap. ?MaxPlayers= above eight and [/Script/Engine.GameSession] MaxPlayers= are both ignored for co-op, whatever a config template claims.

The server is running but not in the browser. Query port. Open 27131 inbound, and open both protocols if you are unsure.

The log is full of `LogSkinnedMeshComp` warnings about a head socket. Harmless noise. Suppress it with a [Core.Log] section in Engine.ini setting that category to Error.

RCON refuses my correct password. You are banned. Three failed attempts trigger a thirty-minute block by default, tuned with MaxPasswordAttempts and IncorrectPasswordBanTime.

No XP on the server. A missing GSLT, a missing -GameStats, a missing stats token, or a server password. The last one surprises people.

Mods worked last month and do not now. The mod.io scheme changed. Re-authorise with a security code and manage subscriptions on the portal.

Complaints about editor packages in the log at start-up. A map referencing editor-only content, or a stale install. Re-run app_update with validate.

On RE:NODE the game and query ports come with the server and an extra port for RCON is added on the Network tab. The console is the server's own output with a command line attached, backup slots cover the two config trees, and the Schedules tab will run a nightly backup and a restart on a cron expression - useful here because an Unreal server that has travelled through twenty maps is not in the same state as one that just started. If it hits its memory limit the container is stopped and restarted clean instead of swapping.

FAQ#

How many players can an Insurgency: Sandstorm server hold?

Twenty-eight in PvP, which is the number in every official example. Co-op is capped at eight human players and no setting lifts it; the bots are what make a co-op round feel full, and their count is set with MinimumEnemies and MaximumEnemies.

Do I need a Steam game server token?

Only for stats and XP. The server runs, lists and plays without one. If you do want XP on your server you need the token, the -GameStats switch, a separate game stats token, and no server password.

Where does RCON go, Game.ini or Engine.ini?

Game.ini. This is the most commonly repeated mistake about Sandstorm server configuration. There is also no default RCON port, so pick one, set ListenPort, and open it on TCP.

Why does the launch line say Oilfield but the scenario say Refinery?

Because several maps have an internal name that differs from the one players see. The travel URL takes the internal name, the scenario token takes the display name. Oilfield is Refinery, Town is Hideout, Canyon is Crossing.

How do I change bot difficulty?

AIDifficulty in [/Script/Insurgency.INSCoopMode], a float between 0 and 1 with 0.5 as the default. You can also change it live with gamemodeproperty AIDifficulty 0.6 over RCON, which is a much better way to find the number your group actually wants.

Can I run mods without the mod.io portal?

Not on the current scheme. Subscriptions are managed on the mod.io web portal under the server's own registered account, and the older token-and-Mods.txt workflow has been replaced. Any guide still describing an AccessToken in Engine.ini is out of date.