Secure a Rust server as a layered system, not as a single plugin or firewall rule. Use hosting with serious DDoS mitigation and fast IP replacement, expose only the UDP and TCP services you actually need, keep RCON behind a restricted management path, assign staff the narrowest permissions possible, and maintain the server, plugins, configuration files, and policy compliance as Rust changes.
Playing with friends? Godlike.Host runs hosted Rust servers from 10 data-center locations, with free DDoS protection.
The exact commands and controls can change with Rust updates. Check the current Facepunch server, hidden-server, and community-guideline documentation before applying a change, and test every firewall or permission change from a non-administrator account.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Define what you are protecting
A public Rust server has a different risk profile from a private event server. Public servers must remain discoverable and accept player traffic from the internet, while private servers should minimize discovery and admit only known Steam accounts. Both can be attacked through the network, through leaked administrative credentials, or through an unsafe plugin.
Use four security objectives when planning controls:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- Availability: keep the game service reachable during abuse or a DDoS attempt.
- Confidentiality: prevent RCON passwords, connection details, backups, and staff accounts from leaking.
- Integrity: stop unauthorized commands, permission changes, malicious plugins, and tampered configuration.
- Compliance: keep the server’s name, description, plugins, moderation, and monetization within the current Facepunch rules.
Write down whether the server is public, private, or temporary; who needs administrative access; whether browser listing is required; whether Rust+ is required; and which network addresses are allowed to manage it. Those decisions determine every later firewall and permission rule.
Choose hosting and a DDoS plan before opening the server
Why infrastructure matters
Facepunch’s hidden-server guidance is explicit that its purpose is to help owners avoid denial-of-service attacks and public discovery. It recommends a dedicated-server environment and a host with strong DDoS protection, no null routing, and the ability to change the server IP quickly when an attack occurs. A plugin cannot compensate for a provider that simply discards your traffic or leaves you unable to move the service.
Recommended Free Tools
Ask a host for concrete answers before paying:
- What traffic volume and attack types are covered by the mitigation service?
- Does the provider null-route an attacked address, or can it keep the service filtered and online?
- How quickly can you receive and activate a replacement IP?
- Can you create separate UDP and TCP firewall rules?
- Can RCON be restricted to your office, VPN, or other management addresses?
- Are automated backups available, and can you restore to a clean machine?
- Which operating systems and Rust server distributions are supported?
- Where are the facilities located relative to your players, and what latency should you expect?
Do not treat a marketing claim such as “DDoS protected” as a complete plan. Request the mitigation policy, escalation process, replacement-IP procedure, and recovery responsibilities in writing.
Managed hosting versus self-hosting
Neither model is automatically safer. Managed hosting can provide network filtering, patching, monitoring, and recovery, but you must verify how much control you retain. Self-hosting gives you control over the operating system, router, firewall, and backups, but you are responsible for every layer.
| Decision axis | Managed host | Self-hosted machine |
|---|---|---|
| DDoS mitigation | Verify capacity, filtering, and the no-null-routing policy in the contract. | You must arrange upstream mitigation; a local firewall cannot absorb an internet-scale attack. |
| IP rotation | Confirm how quickly a replacement address can be issued and switched. | Depends on your ISP, address allocation, DNS, and routing control. |
| Firewall control | Confirm separate UDP/TCP rules and access to the control panel. | You control the host firewall and router, but must configure and monitor both. |
| Backups and recovery | Check retention, restore testing, and whether backups are isolated from the server. | You must schedule, protect, and test your own copies. |
| Operating-system maintenance | Some tasks may be included; establish who patches what. | You own kernel, firewall, runtime, and account maintenance. |
| Monthly cost | Not stated; compare the complete service, mitigation, storage, and support costs. | Not stated; include hardware, bandwidth, electricity, transit, backups, and your time. |
Prepare an attack runbook
- Record the provider’s abuse or emergency contact, your server identifier, and the procedure for moving to a replacement IP.
- Keep a known-good copy of the server configuration, users file, plugin list, and startup command on offline or separately protected storage.
- Decide who can authorize an IP move and how players will be notified without publishing sensitive management details.
- During an attack, capture timestamps, traffic symptoms, console errors, and provider ticket numbers. Do not repeatedly reboot while an upstream mitigation team is diagnosing the event.
- After mitigation, rotate any credentials that may have appeared in logs, screenshots, chat, or support tickets and review administrative commands.
Reduce discoverability on private and event servers
Control admission with a whitelist
For a private or event server, install a maintained whitelist plugin through Oxide/uMod and grant access by SteamID. Give the plugin only the permissions it needs, test a permitted and an unpermitted account, and document who approved each SteamID. A whitelist limits admission; it does not hide an exposed IP or protect RCON.
Facepunch also documents a built-in skip-queue approach for selected uses. Choose one admission method deliberately rather than stacking several plugins that each alter connection behavior. After a Rust update, verify that the method still works before announcing the server.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Reduce Steam and stream leakage
The hidden-server guidance recommends setting Steam visibility to Invisible so the game, IP, and port are not displayed on a profile. This is an account privacy measure, not a network firewall, so apply it to every account that can reveal the server.
For streamers, use the hidden-connect keybind described in the current Facepunch instructions and rehearse it before going live. Hide console output, server browser results, chat messages, bookmarks, remote-administration windows, and browser tabs that could reveal an address or port. Never paste the connection string into public chat, a video description, a screenshot, or a support ticket visible to unauthorised people.
Mask player names from scrapers
The censorplayerlist true command can mask player names from third-party server-list scrapers. It reduces reconnaissance value but does not make a server private: an attacker can still discover a public address through other means, and current Rust behavior should be verified after updates.
Expose only the network paths you need
Understand Rust’s port split
Facepunch’s server-creation guide distinguishes the services by protocol. server.port and server.queryport use UDP. RCON and Rust+ use TCP. The game and query ports must be open and accessible, must be different from each other, and should never be assigned the same port.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →| Service | Protocol | When to expose it | Recommended boundary |
|---|---|---|---|
server.port |
UDP | Always required for normal player traffic. | Internet-facing, limited to the selected game port. |
server.queryport |
UDP | Required when browser listing or query-based discovery is needed. | Expose only when the server’s listing or monitoring needs it. |
| RCON | TCP | Only when remote administration is required. | Allow trusted management IPs or a private network; never leave it broadly reachable. |
| Rust+ | TCP | Only when the Rust+ feature is required. | Expose the configured service deliberately and remove it if unused. |
The last column is a least-exposure recommendation based on the documented protocol split. Exact rule syntax depends on your operating system, host firewall, router, and provider control panel.
Build the firewall policy
- Assign the server a stable address. On a home network, reserve a static LAN address in DHCP or configure one outside the dynamic pool.
- Create an allow rule for the game UDP port configured by
server.port. - Create a separate UDP rule for
server.queryportonly if browser listing or an approved monitoring system requires it. - Create a TCP rule for RCON only from trusted management addresses, a VPN subnet, or another private control plane.
- Create the Rust+ TCP rule only when the feature is enabled and needed.
- Deny unsolicited traffic to every other inbound port. Do not select “both” or “all” protocols when the service requires only UDP or TCP.
- Apply equivalent rules at the provider edge, host firewall, and router where those layers exist. A router rule alone does not protect a publicly reachable cloud host.
- Review the rules after every port change, migration, or plugin installation.
Forward ports safely on a home router
Forward each required port to the server’s static LAN address, with the correct protocol selected. Do not forward a range when one port is sufficient, and do not forward RCON to every internal device. Disable automatic port mapping if it allows applications to create broad rules without review. If your ISP uses carrier-grade NAT, inbound hosting may not work without a public address or an alternative network arrangement.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Verify from outside the network
Test from a separate internet connection, not only from the server’s LAN. Confirm that a legitimate player can connect through the game port, that query results appear only when intended, and that RCON and Rust+ are unreachable from an untrusted address. Keep a dated record of the test, the source address, and the observed result. A successful connection from inside the same LAN can be caused by hairpin NAT and does not prove internet exposure is correct.
Protect RCON and startup secrets
Replace sample credentials immediately
Facepunch’s sample startup command includes +rcon.password letmein and immediately warns, “Change this value!!!” Treat that sample as deliberately unsafe. Generate a long, random, unique password; never reuse it for Steam, the operating system, a panel, or a plugin.
Keep the secret out of public repositories, screenshots, shell history, issue trackers, chat, and shared documents. Restrict file permissions on startup scripts and configuration files, and use a secret-management method appropriate to your operating system when available. If a secret has been exposed, change it rather than trying to conceal the leak.
Use the web mode carefully
The guide documents rcon.web 1 as the suggested web remote-connect mode. Enabling that mode does not make RCON safe by itself. Pair it with a firewall allow-list, a private VPN or management network where possible, strong authentication, and an RCON client that supports encrypted transport and useful audit logs.
Respond to a suspected RCON compromise
- Block public access to the RCON TCP port at the edge firewall.
- Change the RCON password from a trusted console or local session.
- Review console history, users, plugin permissions, startup scripts, and recent file changes.
- Remove unknown SteamIDs, accounts, plugins, and scheduled tasks.
- Restore from a known-clean backup if you cannot establish what changed.
- Reopen RCON only to approved management addresses and record the incident.
Apply least privilege to owners, moderators, and plugins
Use SteamID-based roles
Facepunch documents ownerid and moderatorid assignments by SteamID. Users can be managed through the server console, RCON, or users.cfg. Prefer SteamIDs over display names, because names can change and are not reliable identity controls.
Reserve owner access for the smallest possible number of people. Give moderators the routine abilities they need, and avoid using owner access as a shortcut for every administrative task. Keep a private roster with the SteamID, role, approver, date granted, and date reviewed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Use uMod groups and scoped permissions
uMod explains that permissions can be administered through a compatible RCON tool and that admin and default groups exist by default. Grant individual plugin permissions to a moderator group instead of placing every staff member in the unrestricted admin group. This lets staff monitor players or perform a defined moderation task without receiving every game-admin ability.
Before granting a permission, read what the plugin command does and whether it can affect inventories, ownership, teleportation, bans, or server configuration. Test the permission with a non-owner account. When someone leaves the team, remove their SteamID and plugin permissions in the same change window; do not rely on an eventual cleanup.
Separate duties
- One person can approve staff membership while another applies the permission change.
- Keep routine moderation commands separate from server-management commands.
- Require a second review for owner access, startup changes, RCON changes, and plugin installation.
- Log grants, removals, bans, unbans, and configuration edits with timestamps and the responsible SteamID.
Control configuration, plugins, and updates
Understand configuration precedence
The server guide places server.cfg in the server identity’s cfg directory. Rust reads it at startup, and the file takes priority over command-line settings. This precedence can make a command-line fix appear ineffective when an older value remains in server.cfg.
Back up and review both server.cfg and users.cfg. Keep a change record that identifies the old value, new value, operator, reason, and restart time. Remove obsolete settings instead of allowing several files or scripts to provide conflicting values.
Maintain a controlled plugin inventory
Install only plugins whose source, maintainer, update history, and required permissions you can evaluate. Record the plugin name, version, source, installation date, permissions, and the Rust server version it was tested against. Prefer plugins that do one administrative job over large bundles that silently alter unrelated behavior.
Facepunch notes that Oxide must be updated after server updates. Plan a maintenance window after each Rust patch: stop the server cleanly, back up data, update the server and framework, inspect plugin compatibility, start in a controlled state, and test login, moderation, RCON, query responses, and any Rust+ workflow. If a plugin fails, disable that plugin first rather than weakening the firewall or granting broader permissions.
Use sandbox and listing controls
uMod maintains separate security guidance, including the documented umod.sandbox control for supported installations. Confirm that the setting is supported by your current framework version before enabling it, and test plugins that need file, network, or process access.
uMod’s server-section guidance distinguishes allowed administrative tools from gameplay-altering modifications for Community listings. Check the current rules before relying on a plugin’s listing status. A plugin can be technically useful and still make the server ineligible for the category you want.
Back up for recovery, not just compliance
- Keep at least one backup separate from the live machine and protect it from the same administrative accounts.
- Include the server identity, world data,
server.cfg,users.cfg, plugin configuration, startup parameters, and a plugin inventory. - Test restoration on another directory or machine so a backup is known to be usable.
- Retain a clean pre-update copy until the new version has passed player and administration tests.
Stay within Facepunch’s current policies
Facepunch’s Community Server and Hosting Guidelines warn that violations can lead to delisting or other sanctions. Review the current document after major Rust or platform changes, not only when the server is first created.
Check the server name and description, plugin behavior, moderation practices, rewards, and every monetization flow. Make sure staff know which actions are allowed, how bans and appeals are handled, and who can change the public description. A technically hardened server can still lose visibility or access if its operation violates platform policy.
Choose between vanilla administration and Oxide/uMod
Vanilla administration reduces the number of third-party components, while Oxide/uMod can provide granular permissions, moderation tools, and automation. The safer choice depends on your ability to update and audit the chosen stack.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems| Criterion | Vanilla administration | Oxide/uMod administration |
|---|---|---|
| Update lag after Rust patches | Fewer external components to coordinate. | Framework and plugin compatibility must be checked after updates. |
| Permission granularity | Built-in owner and moderator roles. | Built-in roles plus plugin-specific permissions and groups. |
| Logging and automation | Depends mainly on native console and server tools. | Can add tools and logs, but each plugin expands the trust and maintenance surface. |
| Plugin provenance | No plugin provenance question for native features. | Verify maintainer, source, update history, permissions, and behavior for every plugin. |
| Community listing status | Generally simpler to classify. | Check current rules for administrative versus gameplay-altering modifications. |
Whichever approach you use, keep owner access rare, update promptly, test changes on a staging copy when possible, and remove components you no longer need.
Operational checklists
Before launch
- Choose a host with documented DDoS mitigation, no-null-routing policy, and rapid IP-change capability.
- Record the recovery contact and test the backup and restore process.
- Assign a stable server address and write separate UDP and TCP firewall rules.
- Open only
server.port, the optionalserver.queryport, restricted RCON, and required Rust+ access. - Set a unique random RCON password and keep it out of public files and screenshots.
- Set up owner and moderator SteamIDs, then test each role with a separate account.
- Install only reviewed plugins, document their permissions, and confirm their current compatibility.
- For private servers, configure the whitelist or approved skip-queue method and set Steam visibility to Invisible.
- Test an allowed connection, a denied connection, RCON from an approved address, and RCON from an unapproved address.
- Review the current Community Server and Hosting Guidelines.
After every Rust or framework update
- Read the current server and framework change notes.
- Back up the live identity, configuration, users, world data, and plugin inventory.
- Update the server and Oxide/uMod in the order required by their current documentation.
- Start with nonessential plugins disabled if compatibility is uncertain.
- Test player login, query behavior, RCON, Rust+, whitelist behavior, owner and moderator permissions, and critical moderation commands.
- Review firewall rules and effective configuration, remembering that
server.cfgoverrides command-line settings. - Re-enable plugins one at a time and record any change.
If players report an outage or attack
- Distinguish a game-process crash, a host network problem, an RCON compromise, and a volumetric attack before changing settings.
- Check provider graphs and mitigation notices without publishing the server address or management details.
- Use the documented IP-change procedure if the provider confirms that moving the address is appropriate.
- Preserve logs and timestamps, communicate through a separate channel, and avoid posting unverified blame.
- After recovery, rotate exposed secrets and review permissions, plugins, and startup files.
What a secure Rust server looks like
A defensible setup has a provider that can absorb or filter attacks and move the address quickly; a firewall that distinguishes UDP game and query traffic from TCP RCON and Rust+; RCON reachable only from trusted management paths; SteamID-based owner and moderator roles; narrow uMod permissions where plugins are used; backed-up and reviewed server.cfg and users.cfg; and a repeatable update and incident process.
Security is maintained rather than completed. Recheck the current Facepunch documentation whenever Rust, Oxide/uMod, your host, or your server policy changes, and remove any exposure or permission that no longer serves a defined purpose.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
