SRCDS sv_lan 1 does not restrict socket bind address to private interfaces

Binding behavior with sv_lan enabled

When sv_lan 1 is set in server.cfg, the Source Dedicated Server stops advertising to the Steam master list and rejects connections from non-RFC1918 addresses. However, the engine continues to bind the game port (default 27015 UDP/TCP), SourceTV port (27020), and RCON to 0.0.0.0 on all interfaces. This leaves the sockets reachable from any network interface, including public IPs on cloud VMs or hosts without a host firewall.

Missing interface-specific bind option

The +ip launch parameter can restrict the bind address, but using +ip 127.0.0.1 prevents legitimate LAN clients from connecting. There is no documented console variable or launch option that binds only to private (RFC1918) interfaces while keeping the server accessible on the local network. Administrators must rely on OS-level firewall rules or wrapper scripts to achieve this isolation.

Given that Source 2013/2007 codebases exhibit this behavior and public documentation for newer branches (CS2/Source 2) remains limited:

1. Is there any undocumented net_bind_addr-style cvar or launch flag that restricts the bind address to private interfaces without breaking LAN connectivity?
2. Do recent SRCDS builds (post-2023 SteamCMD updates) introduce a sv_bind_lan_only or equivalent setting that changes the socket bind behavior rather than just the connection filter?