How to Use Web RCON on a Rust Server (WebSocket Setup, Ports, and Troubleshooting)

Enable Rust’s WebSocket-based remote console by starting the server with +rcon.web 1, an unused TCP port, and a strong password. A typical launch line is:

Godlike.Host offers hosted Rust servers with its own game panel, SFTP access and free DDoS protection, if you would rather not host it yourself.

+rcon.port 28016 +rcon.password "replace-this-with-a-long-unique-secret" +rcon.web 1

Restart the server, allow that TCP port through the host firewall (and router or cloud firewall when applicable), then enter the server address, port, and exactly matching password in a WebSocket-capable RCON client or dashboard. The game’s UDP ports are separate from the RCON listener.

#	Preview	Product	Price
1		Rust Key Cards, Rust Red Key Card, Cobalt Restricted Access Cards, Rust Gift For Gamers, Blue Key...	$25.00	Buy on Amazon
2		Rust Video Game Notebook	$15.00	Buy on Amazon
3		Rust Game Props Large Furnace (S)	$14.99	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

What Web RCON is and when to use it

RCON (remote console) lets an administrator send console commands to a running Rust server without opening the game console in person. Rust’s current web mode uses WebSockets, a persistent connection that a browser-based dashboard can maintain for command entry, responses, and reconnects.

Facepunch’s WebRCON guidance states that a Rust server must include +rcon.web 1 on its command line to enable web-based RCON. Without that startup argument, a browser client expecting WebSockets cannot complete a session. Vanilla Rust supports Web RCON directly; uMod or Oxide is not required unless you also need plugins or mod-specific administration.

#1 Best Overall

Rust Key Cards, Rust Red Key Card, Cobalt Restricted Access Cards, Rust Gift For Gamers, Blue Key Card, Green Key Card (ALL THREE)

• Inspired by the Rust Video Game – These cards replicate the iconic keycards found in Rust (Red, Blue, Green).
• High Quality PVC Plastic – Printed on both sides, durable and water-resistant. Not a sticker.
• Great Rust Gift Idea – Perfect for fans of Rust, whether for cosplay, loot-themed gifts, or collection.
• Wallet-Size Replica – Standard 3.375x2.125 inches, 30 mil thick—fits in any wallet.
• NOT a sticker*

$25.00

Buy on Amazon

Web RCON is useful when the server runs headless, in a data center, or behind a hosting panel. It can be more convenient than logging into the operating system, but it is also an administrator credential endpoint. Expose it only as broadly as necessary.

Prerequisites before changing the server

• Control of the Rust server’s launch script, service definition, or hosting-panel startup arguments.
• Permission to open a TCP port in the server host firewall and, if relevant, a cloud security group or router/NAT rule.
• A WebSocket-capable RCON client or browser dashboard.
• A long, unique password that is not used for the game panel, operating system, database, or any other service.
• The server’s reachable public address, or its private address when the client is on the same network.

If a hosting provider does not expose startup arguments or firewall controls, ask whether it supports WebSocket RCON and which port it assigns. Do not assume that a panel’s game-port field also opens the RCON listener.

Rust Web RCON launch arguments explained

Do not copy the illustrative password letmein or any password published in documentation. Generate a fresh secret for each server and store it in the hosting panel’s protected variable or another access-controlled secret store.

Enable Web RCON in a launch script or hosting panel

Using a launch script

1. Open the script or service definition that starts the Rust server. Keep the existing game-port, query-port, world, identity, and map arguments intact.
2. Add the three RCON arguments. For example:

   ./RustDedicated -batchmode -nographics 
     +server.identity "myserver" 
     +server.port 28015 
     +rcon.port 28016 
     +rcon.password "use-a-long-random-secret" 
     +rcon.web 1

3. Save the file with permissions that prevent ordinary users from reading the password. If the script is stored in source control or a shared folder, move the secret to the platform’s secret-variable facility instead of committing it.
4. Stop and restart the Rust server. Changing the convar in a running console does not substitute for restarting because the current reference treats rcon.web as a startup argument.

Using a hosting panel

1. Open the server’s Startup, Launch parameters, or similarly named configuration page.
2. Set the RCON port field, if the panel provides one, to an unused TCP port. Otherwise add +rcon.port 28016 to the additional arguments field.
3. Set the RCON password in the panel’s protected variable field. If the panel only offers a plain-text command line, restrict panel access and rotate the secret after any suspected exposure.
4. Add +rcon.web 1 as an additional startup argument.
5. Apply or save the configuration, then perform a full restart rather than a map wipe or soft reload.

Keep the RCON port different from the game’s UDP server and query ports. Rust’s game and query traffic is documented separately as UDP; opening a UDP game port does not make a TCP RCON listener reachable.

Open the correct network path

Host firewall

Create an inbound rule for the selected TCP RCON port. On a Linux host using a firewall manager, allow the specific TCP port; on Windows, create an inbound TCP rule for the Rust server process or port. Limit the rule’s source addresses to your administration IP range when your firewall supports that control.

Cloud security groups

Cloud virtual machines commonly have a second firewall outside the operating system. Add the same TCP port to the instance’s security group or network ACL, again restricting source IPs where practical. A host rule alone cannot overcome a cloud rule that drops the connection.

Router or NAT forwarding

If the server is on a private address behind a router, forward the chosen external TCP port to the server’s private IP and TCP port. Reserve the server’s private address so the forwarding target does not change. Never forward the port to a different machine that happens to use the same internal address later.

Use the public address only when connecting from outside the local network. From the same LAN, some routers do not support hairpin NAT; the private server address may work even though the public address fails internally.

Rank #2

Rust Video Game Notebook

$15.00

Buy on Amazon

Restart and verify that Rust is listening

1. Stop the server cleanly and start it with the updated arguments.
2. Watch the startup log for an RCON listener message. A current reference gives WebSocket RCON Started on :28016 as an example confirmation, but exact wording can vary by Rust build and host wrapper.
3. Confirm that the port in the log is the same port opened in the host firewall, cloud security group, router, and client.
4. Check the operating system’s listening-socket view if the log is unclear. The process should listen on the selected TCP port; a UDP-only entry is not sufficient.

If no WebSocket startup message appears, recheck that the argument is spelled +rcon.web 1, that it is in the server’s actual launch command rather than an unused template, and that the server was restarted after saving the change.

Connect from a browser dashboard or WebSocket client

1. Open a client that explicitly supports Rust WebSocket RCON. A client designed only for legacy Source RCON will not negotiate the WebSocket protocol.
2. Enter the server’s reachable address. Use the public address for an external client, or the private address for a permitted local connection.
3. Enter the TCP RCON port, not the game’s UDP port. For the example configuration, this is 28016.
4. Enter the exact value of rcon.password. Do not add quotation marks unless the client’s password field specifically requires them; quotation marks in a launch command are normally delimiters, not part of the password.
5. Connect and issue a harmless read-only command first, such as a server information or player-list command supported by your Rust build. Confirm that the response arrives before using administrative commands.

Some dashboards save the password in their settings and may represent credentials in a connection URL. Treat that URL as a password-bearing secret: do not paste it into chat, screenshots, issue trackers, browser history shared with other administrators, or public documentation.

Test reachability before blaming the client

Test the path from the same network where the client runs. A successful test proves that something accepts the TCP connection; it does not prove that the password or WebSocket handshake is correct.

Windows PowerShell

Test-NetConnection -ComputerName <server-ip> -Port <rcon.port>

Replace the placeholders with the server address and numeric port. Look for TcpTestSucceeded : True.

Linux, macOS, or a diagnostic host with netcat

nc -zv <server-ip> <rcon.port>

A success message indicates that the TCP port is reachable. A timeout usually indicates filtering or missing forwarding; a refusal usually means the address is reachable but no process is listening on that port.

Troubleshoot connection failures by symptom

Check for competing RCON implementations

Older community support discussions describe conflicts when an OxideRcon component is enabled on the same port as another RCON implementation. Treat that report as version-specific rather than a universal rule, but if a refusal or bind error appears after installing a mod, disable duplicate RCON listeners or assign distinct ports and restart.

WebSocket RCON versus legacy Source RCON

The rcon.web convar selects the protocol. With 1, Rust exposes WebSocket RCON for browser-oriented clients. With 0, it selects the deprecated Source RCON implementation. These are not interchangeable transports: a WebSocket client cannot communicate with a server running only legacy mode, and a legacy client cannot communicate with the WebSocket listener.

Choose the mode based on the client you must support, then set the startup argument explicitly and restart. Do not troubleshoot a password or firewall until the protocol modes match; a perfect password cannot fix a transport mismatch.

Rank #3

Rust Game Props Large Furnace (S)

• Acrylic Painting Pla Plastic

$14.99

Buy on Amazon

Security hardening for a remote administrator endpoint

Protect the credential

• Use a randomly generated, unique secret long enough to resist guessing.
• Do not reuse the server-panel, operating-system, database, or personal account password.
• Do not place the secret in public launch scripts, screenshots, chat, paste sites, or shared documentation.
• Rotate it immediately if it appears in a log, browser URL, screen recording, or configuration file shared outside the administrator group.

Reduce network exposure

• Allow the TCP RCON port only from trusted administrator IP addresses or a private management network when possible.
• Prefer a VPN, bastion host, or provider access-control feature over an unrestricted Internet-wide rule.
• Do not assume that an obscure port number is security; scanning can find it.
• Keep the RCON port separate from public game and query ports so firewall rules remain understandable.

Be careful with URL-based credentials

Some WebRCON dashboards place the password in a URL path. Avoid URL-reserved characters such as #, ?, /, %, and spaces when the dashboard’s documentation warns that they can be parsed incorrectly. More importantly, treat the complete URL as a credential and never publish it. If a password containing such a character is already in use, change it through the server startup configuration and restart.

Limit administrative power operationally

Give access only to people who need console control. Where a dashboard supports roles, command allow-lists, audit logs, or command history, configure those controls and review them periodically. They are client features, not Rust server guarantees, so verify how the specific dashboard stores credentials and records commands.

When uMod or Oxide belongs in the setup

Vanilla Rust Web RCON works without a modding platform. Install uMod or Oxide only when the server needs plugins, plugin permissions, or mod-specific commands. Their guides cover installation, updates, commands, permissions, and configuration; those components add another software lifecycle and another possible source of port or command conflicts.

For a vanilla server that only needs remote console access, adding uMod solely to obtain Web RCON increases maintenance without solving a requirement. For a plugin-enabled server, keep the mod platform and plugins updated, document which component owns each RCON listener, and test the console after every major server or mod update.

How to choose a Web RCON client

Evaluate a client on capabilities that affect administration and security rather than on appearance alone:

Test with a non-destructive command, deliberately restart the Rust server, and confirm that the client reports the disconnect and reconnects only after the listener is available. A dashboard that hides a stale connection can make an administrator believe a command ran when it did not.

Routine maintenance and recovery

After changing the port

1. Change +rcon.port in the authoritative startup configuration.
2. Update host firewall, cloud security group, and NAT forwarding rules.
3. Restart the server and verify the new listening port in the log.
4. Update every client and remove the old port rule once no administrator needs it.

After changing the password

1. Replace the value in the protected startup configuration.
2. Restart because the server must load the new startup argument.
3. Update the client’s stored credential and test a harmless command.
4. Invalidate or delete old dashboard URLs and saved browser entries that contain the former credential.

If you lose access

Use the hosting console, operating-system console, or provider recovery interface to stop the server and inspect the effective launch arguments. Correct the port, password, or +rcon.web 1 setting, restore the matching network rule, and restart. Do not repeatedly expose additional ports as a guess; each extra rule increases attack surface and makes the configuration harder to audit.

Final pre-flight checklist

• +rcon.web 1 is present in the actual startup command.
• +rcon.port is an unused TCP port and is not confused with a UDP game port.
• +rcon.password is unique, private, and stored with appropriate permissions.
• The server was fully restarted after changing RCON settings.
• The host firewall, cloud security group, and NAT forwarding all allow the same TCP port.
• The client supports WebSockets and uses the exact server address, port, and password.
• External reachability has been tested with Test-NetConnection or nc.
• Access is restricted to trusted administrators, and any credential-bearing URL is treated as secret.

With those conditions met, Rust’s Web RCON endpoint should accept browser-based administration while keeping the game’s UDP traffic and the remote-console TCP path clearly separated.

Quick Recap

Bestseller No. 1

Rust Key Cards, Rust Red Key Card, Cobalt Restricted Access Cards, Rust Gift For Gamers, Blue Key Card, Green Key Card (ALL THREE)

Wallet-Size Replica – Standard 3.375x2.125 inches, 30 mil thick—fits in any wallet.; NOT a sticker*

$25.00

Bestseller No. 2

Rust Video Game Notebook

$15.00

Bestseller No. 3

Rust Game Props Large Furnace (S)

Acrylic Painting Pla Plastic

$14.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

RCON setupRust administrationRust serverserver troubleshootingWeb RCONWebSocket RCON