SRCDS sv_lan 1 does not restrict socket bind address to private interfaces

Direct answer

No. sv_lan 1 is an advertisement and connection-filter setting, not a socket-bind setting. It stops Steam master-list advertising and causes the engine to reject connections from non-RFC1918 addresses, but the game, SourceTV, and RCON sockets still bind to 0.0.0.0 on every interface unless you explicitly override the bind address. There is no confirmed net_bind_addr, sv_bind_lan_only, or equivalent cvar in public SRCDS documentation, and post-2023 SteamCMD builds have not been confirmed to add one.

Confirmed behavior versus unverified claims

Steps for this case

1. Identify the LAN-facing IPv4 address. On Linux:

   ip -4 -br addr

   . On Windows:

   ipconfig

   or

   Get-NetIPAddress | Where-Object {$_.AddressFamily -eq 'IPv4'}

   . Pick the address on the subnet LAN clients use, not 127.0.0.1.
2. Start SRCDS with that address. Example Linux launch:

   ./srcds_run -game csgo +ip 192.168.1.50 -port 27015

   . Keep sv_lan 1 in server.cfg.
3. Verify the bind. Before the change:

   sudo ss -lunp | grep -E '27015|27020'

   shows 0.0.0.0. After restarting with +ip, the same command should show only the LAN address.
4. Have a LAN client on the same subnet join. If it cannot, the chosen +ip address is wrong.
5. If SourceTV or RCON are enabled, check those ports separately with ss or netstat -ano; +ip should not be assumed to cover every derived socket without verification.

Assumptions and uncertainty

• This applies to Source Dedicated Server builds from SteamCMD, typically Source 2013/2007 engine branches. CS2 and Source 2 dedicated-server documentation is limited, so behavior in those branches is treated as unverified.
• Do not rely on sv_lan 1 alone for isolation on cloud VMs or multi-interface hosts. Add host firewall rules as defense in depth.
• Do not start the server with +ip 127.0.0.1 if LAN clients must connect; that restricts the socket to loopback.

If you cannot identify the correct LAN-facing address from the commands above, provide the output of ip -4 -br addr (Linux) or ipconfig (Windows) so the correct +ip value can be confirmed.