How to Make Your Arma Reforger Server Private

Set a non-empty game.password value. That is Arma Reforger’s documented control for requiring a password before a player can join. Dedicated servers read the value from their JSON configuration; a player-hosted session sets it in Multiplayer > Host. If friends connect over the internet to a server on your home network, forward the game’s default UDP port, 2001, to the hosting machine. Give the join password only to the people you intend to admit.

Prefer not to run the server on your own PC? Godlike.Host offers hosted Arma Reforger servers with free DDoS protection and up to three free backups a day.

What “private” means in Arma Reforger

Arma Reforger does not use a separate “private server” switch for ordinary players. The supported native method is a join password. When game.password contains a value, the server asks for that password during the join process; someone who does not know it cannot enter through the normal game browser or direct connection flow.

#	Preview	Product	Price
1		TP-Link Dual-Band BE3600 Wi-Fi 7 Router, Archer BE230 | 4-Stream | 2×2.5G + 3×1G Ports, USB 3.0,...	$79.98	Buy on Amazon
2		TP-Link Tri-Band BE9700 WiFi 7 Router (Archer BE600) | 10G Port, 2.5G Port, 3× 2.5G LAN, 320MHz...	$189.98	Buy on Amazon
3		TP-Link BE6500 Dual-Band WiFi 7 Router (BE400) | Dual 2.5Gbps Ports, USB 3.0, Covers up to 2,400 sq....	$149.00	Buy on Amazon
4		NETGEAR Nighthawk WiFi 6 Router R6700AX, Up to 1,500 sq ft, 1.8 Gbps | Reliable Performance, Easy...	$60.15	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

This is different from hiding a server from the browser. A password-protected server may still be visible to other players, but visibility does not grant access. If your goal is to keep strangers out while letting friends find the session, a password is the documented solution. If you need the server to be invisible, or you want to approve individual identities without sharing one password, the official configuration reference does not describe a general player allowlist.

“You can also choose to lock your server behind a password if you don’t want strangers to join.”

#1 Best Overall

Sale

TP-Link Dual-Band BE3600 Wi-Fi 7 Router, Archer BE230 | 4-Stream | 2×2.5G + 3×1G Ports, USB 3.0, 2.0 GHz Quad Core, 4 Antennas | VPN, EasyMesh, HomeShield, MLO, Private IOT

• 𝐅𝐮𝐭𝐮𝐫𝐞-𝐏𝐫𝐨𝐨𝐟 𝐘𝐨𝐮𝐫 𝐇𝐨𝐦𝐞 𝐖𝐢𝐭𝐡 𝐖𝐢-𝐅𝐢 𝟕: Powered by Wi-Fi 7 technology, enjoy faster speeds with Multi-Link Operation, increased reliability with Multi-RUs, and more data capacity with 4K-QAM, delivering enhanced performance for all your devices.
• 𝐁𝐄𝟑𝟔𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐑𝐨𝐮𝐭𝐞𝐫: Delivers up to 2882 Mbps (5 GHz), and 688 Mbps (2.4 GHz) speeds for 4K/8K streaming, AR/VR gaming & more. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance, and obstacles like walls.
• 𝐔𝐧𝐥𝐞𝐚𝐬𝐡 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠 𝐒𝐩𝐞𝐞𝐝𝐬 𝐰𝐢𝐭𝐡 𝐃𝐮𝐚𝐥 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭𝐬 𝐚𝐧𝐝 𝟑×𝟏𝐆𝐛𝐩𝐬 𝐋𝐀𝐍 𝐏𝐨𝐫𝐭𝐬: Maximize Gigabitplus internet with one 2.5G WAN/LAN port, one 2.5 Gbps LAN port, plus three additional 1 Gbps LAN ports. Break the 1G barrier for seamless, high-speed connectivity from the internet to multiple LAN devices for enhanced performance.
• 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝟐.𝟎 𝐆𝐇𝐳 𝐐𝐮𝐚𝐝-𝐂𝐨𝐫𝐞 𝐏𝐫𝐨𝐜𝐞𝐬𝐬𝐨𝐫: Experience power and precision with a state-of-the-art processor that effortlessly manages high throughput. Eliminate lag and enjoy fast connections with minimal latency, even during heavy data transmissions.
• 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐟𝐨𝐫 𝐄𝐯𝐞𝐫𝐲 𝐂𝐨𝐫𝐧𝐞𝐫 - Covers up to 2,000 sq. ft. for up to 60 devices at a time. 4 internal antennas and beamforming technology focus Wi-Fi signals toward hard-to-reach areas. Seamlessly connect phones, TVs, and gaming consoles.

$79.98

Buy on Amazon

Arma Platform, Boot Camp – Host Your Own Game

Use the join-password setting

Dedicated-server JSON

In a dedicated server’s configuration JSON, put a non-empty string in the game.password property. A minimal example is:

{
  "game": {
    "name": "Friends Server",
    "password": "Use-a-unique-join-password"
  }
}

If your existing file already contains other game properties, add password inside that same object rather than replacing the rest of the configuration. Keep the JSON syntax valid: property names and string values use double quotation marks, and a comma separates adjacent properties. A malformed file can prevent the server from starting or cause it to ignore the intended settings.

Save the file, then restart or reload the server using the procedure supplied by your host or service wrapper. The dedicated process must be started with the configuration file passed through its configured -config startup option; editing a JSON file that the process never loads will not change the running instance.

Player-hosted session

A player-hosted server is your local game session while it also hosts other players. Before starting it, open the game’s Multiplayer menu, choose Host, and enter a password in the host settings. Start the session only after the password field contains the value you want to use. This flow does not require editing a dedicated-server JSON file.

To change the password for a later session, return to the Host screen and replace the old value before launching. Players who were given the former password should receive the new one only if you still want them to join.

Dedicated and player-hosted servers: choose the right procedure

Use the dedicated procedure when you want a server process that is independent of a player’s active game session. Use the Host menu when you are starting a temporary session from the game client. The password concept is the same, but the configuration path is not interchangeable.

Make a home-hosted server reachable from the internet

A password protects the join once a connection reaches the server. It does not open your home network to outside traffic. For friends outside your local network, the hosting documentation says that port forwarding is required when the relevant port is closed. The documented default public game port is UDP 2001.

1. Give the hosting machine a stable local address. Reserve its address in the router’s DHCP settings, or otherwise ensure the address will not change. A forwarding rule aimed at yesterday’s address stops working after the machine receives a different one.
2. Create the router rule. Forward UDP port 2001 from the router’s public side to UDP port 2001 on the dedicated-server machine, unless your server configuration explicitly uses another public and local range.
3. Check the host firewall. Allow the server process to receive the same UDP traffic on the machine. A router rule cannot bypass a local firewall block.
4. Start or reload the server. Use the normal startup procedure after saving the JSON and confirm that the process is using the file containing your password.
5. Test from outside your network. Ask a friend to connect through their own internet connection, not the same home Wi-Fi. This verifies the router path rather than only local connectivity.

If you have configured a custom public or local port range, use those values consistently in the server configuration and router rule. Forwarding UDP 2001 is correct for the documented default, but it will not fix a mismatch created by deliberately changing the range. Write down the public port, local destination, and machine address so the rule can be recreated after a router replacement.

Rank #2

Sale

TP-Link Tri-Band BE9700 WiFi 7 Router (Archer BE600) | 10G Port, 2.5G Port, 3× 2.5G LAN, 320MHz Channel, Covers up to 2,600 sq. ft., 120 Devices, VPN, HomeShield Security

• 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝐖𝐢-𝐅𝐢 𝟕 - Optimize performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, Samsung Galaxy S24 Ultra, and PS5 Pro with the latest WiFi 7 technology with Multi-Link Operation, Multi-RUs, 4K-QAM, and up to 320 MHz channels.◇△
• 𝟕-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐁𝐄𝟗𝟕𝟎𝟎 𝐓𝐫𝐢-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐒𝐩𝐞𝐞𝐝𝐬 - Delivers smooth 4K/8K streaming, immersive AR/VR gaming, and blazing-fast downloads with speeds up to 5,765 Mbps on the 6 GHz band, 2,882 Mbps on the 5 GHz band, and 1,032 Mbps on the 2.4 GHz band.⌂
• 𝐌𝐚𝐱𝐢𝐦𝐢𝐳𝐞𝐝 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 - Up to 2,600 sq. ft. coverage for up to 120 devices at a time. 6 optimally positioned antennas and Beamforming technology focus Wi-Fi signals toward hard-to-cover areas for stronger coverage-—ideal for those seeking the best WiFi router for large homes.
• 𝟏𝟎 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭 𝐟𝐨𝐫 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠𝐚𝐛𝐢𝐭 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐯𝐢𝐭𝐲 - Features 1x 10 Gbps WAN/LAN port, 1x 2.5 Gbps WAN/LAN port, and 3x 2.5 Gbps LAN ports. Integrate with a multi-gig modem for fast, wired gig+ internet.
• 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.

$189.98

Buy on Amazon

Do not forward administrative ports merely because the game port is forwarded. The official server reference lists RCON port 19999 and A2S port 17777 as default configuration values; expose them only when you intentionally need those services and understand the access controls that protect them.

Share the right password with the right people

The value in game.password is the player join password. Treat it as a shared invitation, not as an administrator credential. Send it through a private channel to the intended group, and avoid putting it in a public server name, public community post, or open social-media message. If the password leaks, replace it in the configuration or Host screen and distribute the replacement privately.

A long, unique phrase is preferable to a password reused for another service. The documented setting accepts a string; the critical operational rule is that the value must not be empty if you want the join prompt enforced. Keep a record of which group received each value so you know who must be notified after a rotation.

When rotating a password on a dedicated server, keep the old JSON as a recovery copy, edit only the intended property, and restart or reload through the same -config procedure. Then give the replacement to the approved players and perform a test join. A password change is useful only if the running process actually loaded the changed file.

Do not confuse player, administrator, and RCON credentials

These settings do not substitute for one another. Giving players the administrator or RCON password defeats the separation between joining a game and controlling the server. Conversely, changing an admin credential does not change the password required to join.

Can you make the server invite-only with a whitelist?

Not through the documented admins array. The configuration reference describes that array as a list of server administrators and priority-queue users, using IdentityIds and/or Steam IDs. It does not define it as a general allowlist for ordinary player joins.

Therefore, the supported native approach for keeping regular players out is a shared join password. A true identity-based invite list would require a separately documented server feature or moderation tool. Do not assume that adding a player’s ID to admins creates an invite-only server; it changes administrative or queue treatment instead.

End-to-end setup checklist

• Decide whether you are using a dedicated process or the in-game Host flow.
• Set a unique, non-empty game.password in the dedicated JSON, or enter the password under Multiplayer > Host.
• For dedicated hosting, verify that the process starts with the edited file through -config.
• Save the change and restart or reload through your normal hosting procedure.
• If people are joining from outside the home network, forward UDP 2001 to the hosting machine and allow the server through its firewall.
• Share only the join password with intended players; keep passwordAdmin and rcon.password private.
• Test from a friend’s separate internet connection.
• Attempt a join without the password to confirm that the server rejects an uninvited player.
• Rotate the join password whenever it is posted publicly, shared with the wrong group, or no longer appropriate.

Test privacy instead of assuming it

Run three separate checks after setup. First, have a local player connect if the server is on the same network; this confirms that the game process and password setting work without the router path. Second, have an internet friend connect from a different connection; this tests forwarding, firewall access, and the public route. Third, try an incorrect or missing password. The expected result is that the uncredentialed attempt is refused while the approved player can join.

Rank #3

Sale

TP-Link BE6500 Dual-Band WiFi 7 Router (BE400) | Dual 2.5Gbps Ports, USB 3.0, Covers up to 2,400 sq. ft., 90 Devices, Quad-Core CPU, HomeShield, Private IoT

• 𝐅𝐮𝐭𝐮𝐫𝐞-𝐑𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 𝟕 - Designed with the latest Wi-Fi 7 technology, featuring Multi-Link Operation (MLO), Multi-RUs, and 4K-QAM. Achieve optimized performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra.
• 𝟔-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝐰𝐢𝐭𝐡 𝟔.𝟓 𝐆𝐛𝐩𝐬 𝐓𝐨𝐭𝐚𝐥 𝐁𝐚𝐧𝐝𝐰𝐢𝐝𝐭𝐡 - Achieve full speeds of up to 5764 Mbps on the 5GHz band and 688 Mbps on the 2.4 GHz band with 6 streams. Enjoy seamless 4K/8K streaming, AR/VR gaming, and incredibly fast downloads/uploads.
• 𝐖𝐢𝐝𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐒𝐭𝐫𝐨𝐧𝐠 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐨𝐧 - Get up to 2,400 sq. ft. max coverage for up to 90 devices at a time. 6x high performance antennas and Beamforming technology, ensures reliable connections for remote workers, gamers, students, and more.
• 𝐔𝐥𝐭𝐫𝐚-𝐅𝐚𝐬𝐭 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐖𝐢𝐫𝐞𝐝 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 - 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port and 3x 1 Gbps LAN ports offer high-speed data transmissions.³ Integrate with a multi-gig modem for gigplus internet.
• 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.

$149.00

Buy on Amazon

If the server appears in the browser during these tests, that is not a failure. The documented privacy control protects admission, not listing visibility. Record whether each test used the dedicated JSON or the Host screen so a later troubleshooting session does not mix procedures.

Troubleshooting private-server problems

The server is visible, but a friend cannot join

Visibility and reachability are separate. Confirm that UDP 2001 is forwarded to the correct local address, that the host firewall permits the server, and that your friend is testing from outside the host’s network. If the server uses a custom public or local range, forward the configured range rather than the default.

The password prompt never appears

For a dedicated server, check that game.password is inside the game object, that the value is not empty, and that the process loaded the edited file through -config. For a player-hosted session, leave and relaunch the Host flow after entering the password. A saved file or screen that is not used to start the active session cannot affect that session.

The server will not start after editing JSON

Inspect the edited section for missing commas, mismatched braces, or single quotation marks. Compare it with the minimal structure shown above, then restore the last known-good file and add the password property carefully. Keep a backup before each change so you can roll back without losing unrelated settings.

An administrator can join but ordinary players cannot

Check which credential is being used. passwordAdmin authenticates the #login command; it is not the player join password. Players need the value in game.password.

RCON stopped working after credentials were changed

RCON has its own rcon.password. The value must be at least three characters, cannot contain spaces, and is required for RCON to start. Changing game.password does not update RCON credentials, and changing RCON credentials does not change player access.

Friends on the same Wi-Fi can join, but internet friends cannot

That pattern usually points to the edge of the home network rather than the join password. Recheck the UDP 2001 forwarding destination, the host’s current local address, and the firewall rule. Then repeat the test from a genuinely external connection.

Self-hosting versus managed hosting

Both approaches can support a password-protected Arma Reforger instance, but they move different responsibilities between you and the hosting operator. The official material establishes the dedicated/player-hosted distinction and the need for forwarding when a home server must be visible from the internet; provider-specific capacity, locations, uptime commitments, and prices vary and must be confirmed with the provider you select.

Rank #4

NETGEAR Nighthawk WiFi 6 Router R6700AX, Up to 1,500 sq ft, 1.8 Gbps | Reliable Performance, Easy Set Up, 20 devices, 4× Gigabit Port, Dual Band, AX1800

• NIGHTHAWK WIFI 6 ROUTER FOR YOUR WHOLE HOME: Delivers fast, reliable WiFi across every room of your apartment or small home for streaming, gaming, video calls, and smart home devices, all running at the same time without slowing each other down.
• WORKS WITH YOUR EXISTING INTERNET SERVICE: Pairs with your existing modem or gateway via ethernet. Compatible with most cable, fiber, DSL, and satellite providers. Some gateways and modem router combos may require bridge mode. No coax needed.
• SET UP AND MANAGE YOUR NETWORK WITH THE NIGHTHAWK APP: Download the free Nighthawk app on iOS or Android for guided setup. Manage WiFi, run speed tests, pause devices, and set up guest networks from anywhere. Active internet required.
• READY FOR THE DEVICES YOU ALREADY OWN: Your phones, laptops, and TVs work right out of the box. WiFi 6 delivers speeds up to 1.8 Gbps across 2.4 GHz and 5 GHz bands. Backward compatible with WiFi 5 and earlier.
• COVERAGE IN EVERY ROOM: Covers up to 1,500 sq. ft. for up to 20 connected devices. Walls, floors, and interference can reduce range. Larger or multi-story homes may benefit from a NETGEAR Orbi mesh WiFi system.

$60.15

Buy on Amazon

Before paying for a managed instance, confirm that the plan supports Arma Reforger specifically, exposes the join-password setting, and lets you edit or upload the relevant configuration. Also check the advertised player capacity, location, restart process, mod controls, and recurring price. A provider that gives you a generic game server without Reforger configuration access may not provide the privacy control you need.

Privacy and security practices that hold up over time

• Rotate leaked passwords. A password is only private while the intended group is the only group that knows it.
• Separate roles. Never reuse the player password for passwordAdmin or rcon.password.
• Limit exposure. Forward only the ports and ranges you actually configure. The game’s default public port is UDP 2001; RCON and A2S have separate defaults and purposes.
• Protect the configuration file. Restrict operating-system access to the JSON and avoid posting screenshots that reveal credentials.
• Re-test after network changes. Router replacement, a changed local IP, firewall reset, or a new internet provider can invalidate forwarding even when the JSON is unchanged.
• Keep a recovery copy. Preserve a known-good configuration before changing passwords or network ranges so a syntax error can be reversed quickly.

With a non-empty game.password, the correct hosting-specific setup, and a working network path, your Arma Reforger server is private in the sense the official documentation supports: strangers may see the listing, but they cannot join without the credential you control.

Frequently Asked Questions

How do I make my Arma Reforger server private?

Set a non-empty game.password. On a dedicated server, add it inside the game object in the JSON file loaded with -config. For a player-hosted session, enter the password under Multiplayer > Host before starting the session.

How do I password-protect an Arma Reforger server?

Use the player join password, not an administrator or RCON credential. Save the dedicated JSON and restart or reload the server, or set the value in the Host screen for a player-hosted game.

Can I make an Arma Reforger server invite-only?

The documented native control is a shared join password. The admins array is documented for administrators and priority-queue users, not as a general allowlist for ordinary players.

Do I need port forwarding for a private server?

You normally need it when friends outside your home network must reach a server hosted at home. The documented default public game port is UDP 2001; forward it to the server machine and allow the process through the host firewall.

What is the difference between game.password and passwordAdmin?

game.password admits ordinary players. passwordAdmin authenticates the #login administrator command and does not grant normal players access. RCON uses its separate rcon.password.

Why can friends on Wi-Fi join but internet friends cannot?

That usually indicates a router or firewall issue rather than a password issue. Check the UDP 2001 forwarding destination, confirm the host’s local address has not changed, and test again from an external connection.

The Bottom Line

For the documented native privacy control, set a non-empty game.password, load it through the correct dedicated-server or Host-menu procedure, and forward UDP 2001 when internet players must reach a home-hosted server. Keep administrator and RCON credentials separate, and remember that a password can restrict joining even when the server remains visible in the browser.

Quick Recap

SaleBestseller No. 1

TP-Link Dual-Band BE3600 Wi-Fi 7 Router, Archer BE230 | 4-Stream | 2×2.5G + 3×1G Ports, USB 3.0, 2.0 GHz Quad Core, 4 Antennas | VPN, EasyMesh, HomeShield, MLO, Private IOT

$79.98

SaleBestseller No. 2

TP-Link Tri-Band BE9700 WiFi 7 Router (Archer BE600) | 10G Port, 2.5G Port, 3× 2.5G LAN, 320MHz Channel, Covers up to 2,600 sq. ft., 120 Devices, VPN, HomeShield Security

$189.98

SaleBestseller No. 3

TP-Link BE6500 Dual-Band WiFi 7 Router (BE400) | Dual 2.5Gbps Ports, USB 3.0, Covers up to 2,400 sq. ft., 90 Devices, Quad-Core CPU, HomeShield, Private IoT

$149.00

Bestseller No. 4

NETGEAR Nighthawk WiFi 6 Router R6700AX, Up to 1,500 sq ft, 1.8 Gbps | Reliable Performance, Easy Set Up, 20 devices, 4× Gigabit Port, Dual Band, AX1800

$60.15

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.