Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesFor a normal public Rust dedicated server using Facepunch’s documented defaults, forward UDP 28015 for player connections and UDP 28017 for server-browser queries. Forward TCP 28016 only if you use RCON for remote administration, and forward TCP 28082 only when Rust+ is enabled. Every rule must send traffic to the server’s stable LAN address, and the host firewall must allow the same protocol and port.
Playing with friends? Godlike.Host runs hosted Rust servers from 10 data-center locations, with free DDoS protection.
Only UDP 28015 is required for people who already know the server address. The query, RCON and Rust+ ports serve different purposes, so opening all four by habit creates unnecessary exposure and can make troubleshooting harder.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rust’s ports at a glance
Rust separates gameplay, server discovery, administration and companion-app traffic. The defaults below apply when you have not changed the corresponding launch settings.
| Function | Setting | Default or derived port | Protocol | Open or forward it when |
|---|---|---|---|---|
| Player game traffic | server.port |
28015 | UDP | Always for players connecting from outside your LAN |
| Steam/server-browser queries | server.queryport |
28017 with the default game and RCON ports | UDP | The server should appear in Rust’s browser |
| Remote administration | rcon.port |
28016 | TCP | Only when an RCON client will administer the server |
| Rust+ companion service | app.port |
28082 with unchanged defaults | TCP | Only when Rust+ is enabled |
Facepunch’s dedicated-server documentation identifies server.port as the UDP port used by players and gives 28015 as its default. It identifies rcon.port as the TCP port used by RCON clients and gives 28016 as its default. The other two values are derived or feature-specific rather than additional gameplay ports.
#1 Best Overall
- 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝐖𝐢-𝐅𝐢 𝟕 - Optimize performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, Samsung Galaxy S24 Ultra, and PS5 Pro with the latest WiFi 7 technology with Multi-Link Operation, Multi-RUs, 4K-QAM, and up to 320 MHz channels.◇△
- 𝟕-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐁𝐄𝟗𝟕𝟎𝟎 𝐓𝐫𝐢-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐒𝐩𝐞𝐞𝐝𝐬 - Delivers smooth 4K/8K streaming, immersive AR/VR gaming, and blazing-fast downloads with speeds up to 5,765 Mbps on the 6 GHz band, 2,882 Mbps on the 5 GHz band, and 1,032 Mbps on the 2.4 GHz band.⌂
- 𝐌𝐚𝐱𝐢𝐦𝐢𝐳𝐞𝐝 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 - Up to 2,600 sq. ft. coverage for up to 120 devices at a time. 6 optimally positioned antennas and Beamforming technology focus Wi-Fi signals toward hard-to-cover areas for stronger coverage-—ideal for those seeking the best WiFi router for large homes.
- 𝟏𝟎 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭 𝐟𝐨𝐫 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠𝐚𝐛𝐢𝐭 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐯𝐢𝐭𝐲 - Features 1x 10 Gbps WAN/LAN port, 1x 2.5 Gbps WAN/LAN port, and 3x 2.5 Gbps LAN ports. Integrate with a multi-gig modem for fast, wired gig+ internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
What each Rust port actually does
UDP 28015: player connections
server.port carries the game traffic required to join and play. A remote player’s client contacts your public IP address and this UDP port; the router then translates or forwards the packet to the machine running the server. If this mapping is missing, points to the wrong computer, uses TCP instead of UDP, or is blocked by the host firewall, outside players cannot connect even if the process is running correctly.
Facepunch’s guidance treats this as the only port required for direct connection and gameplay. Players can use the server’s public address and port without the server being listed in the in-game browser, which is useful for testing a new setup before adding discovery or administration features.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
UDP 28017: server-browser queries
server.queryport handles the UDP queries that let Rust and Steam obtain listing information. It is what makes a server discoverable in the browser; it is not the channel that carries a player’s actual game session.
When you leave server.queryport unset, Facepunch documents a derived default: one above whichever is greater, server.port or rcon.port. With the unchanged defaults of 28015 and 28016, the documented query-port value is 28017. The query port must differ from the game port. If you change either base port, check the resulting value in your configuration and forward that actual UDP port rather than assuming 28017 still applies.
TCP 28016: RCON
rcon.port is for remote console access, not player traffic. An RCON client uses TCP to send administrative commands and receive responses. The documented default is 28016.
Do not expose this port merely because the server uses the default number. Forward it only when remote administration is part of your operating plan. Set a strong, unique RCON password, enable the RCON mode your server uses, and apply router source restrictions if your equipment supports them. A port-forward rule without a working RCON configuration or valid password will not provide access, but it still enlarges the attack surface.
Free tools Windows power users keep installed
One-click scans. No signup required.
TCP 28082: Rust+ companion service
Rust+ uses a separate companion-service port. Facepunch’s Rust+ documentation gives 28082 when the normal game and RCON defaults are unchanged and requires the companion port to be reachable from the internet. The documentation also states that app.port must be at least 10000 for the Rust+ backend.
The companion port is TCP. It is independent of browser queries and RCON, so opening 28017 or 28016 will not make Rust+ work. If you alter your game or RCON ports, verify the resulting app.port value in the server configuration instead of carrying over 28082 automatically.
Rank #3
- 𝐀𝐂𝟏𝟐𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢𝐅𝐢 𝐑𝐨𝐮𝐭𝐞𝐫 𝐟𝐨𝐫 𝐇𝐨𝐦𝐞 — Ideal for gaming, 4K streaming, downloading and more with Wi-Fi speeds up to 1.2 Gbps (867 Mbps on 5 GHz band and 300 Mbps on 2.4 GHz band)
- 𝐅𝐮𝐥𝐥 𝐆𝐢𝐠𝐚𝐛𝐢𝐭 𝐏𝐨𝐫𝐭𝐬— The Gigabit WiFi Router with 3 Gigabit ports, ideal for any internet plan and allow you to directly connect your wired devices creates fast, reliable wired connections for your PCs, Smart TVs, and gaming consoles
- 𝐒𝐭𝐫𝐨𝐧𝐠 𝐖𝐢𝐅𝐢 𝐒𝐢𝐠𝐧𝐚𝐥 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞— Equipped with Four Powerful 6dbi Antennas and Beamforming technology, wireless router AC6 delivers high speed internet throughout your home
- 𝐄𝐚𝐬𝐲 𝐒𝐞𝐭𝐮𝐩 𝐢𝐧 𝐦𝐢𝐧𝐮𝐭𝐞𝐬 𝐰𝐢𝐭𝐡 𝐀𝐏𝐏 — The Tenda Wi-Fi APP helps you to setup, monitor, & manage your home or guest network easily & quickly. You can monitor the network status & schedule Internet access for your children via built-in parental controls
- 𝐀𝐜𝐜𝐞𝐬𝐬 𝐏𝐨𝐢𝐧𝐭 𝐌𝐨𝐝𝐞 — Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
Which ports to forward for common server types
Public server listed in the browser
Forward UDP server.port and UDP server.queryport. With unchanged defaults, that means UDP 28015 and UDP 28017. Add TCP 28016 only if administrators need RCON, and TCP 28082 only if Rust+ is active.
Direct-connect or LAN-only server
For players on the same LAN, you normally do not need internet port forwarding. For direct connections from outside the network, forward only UDP 28015 (or your configured server.port). A browser listing is optional, so the query port can remain closed when players receive the address through another channel.
Private, intentionally hidden server
Facepunch’s hidden-server guidance recommends nonstandard ports and blocking the Steam query port. Query responses can reveal the server name, player count, map information and active players, and an open query port can make a server discoverable in listings. A privacy-oriented setup therefore keeps the game port reachable only for the people who need it, blocks query responses at the router or firewall, and avoids exposing RCON or Rust+ unless those services are required.
Server with remote administration
Keep the gameplay and query rules appropriate to your visibility choice, then add TCP rcon.port. Restrict the source addresses to an administrator network or VPN range when possible. If your router cannot restrict sources, consider leaving RCON unforwarded and administering from the server’s LAN instead.
Rank #4
- 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 𝐰𝐨𝐫𝐤𝐡𝐨𝐫𝐬𝐞 𝐭𝐡𝐚𝐭'𝐬 𝐫𝐞𝐚𝐝𝐲 𝐟𝐨𝐫 𝐭𝐨𝐦𝐨𝐫𝐫𝐨𝐰 – Delivering high-capacity tri-band lanes, the Wi-Fi 7 Archer BE770 combines 10 internal antennas, an open 6 GHz band, and a future-ready 10G WAN/LAN port for busy, connected homes.
- 𝐁𝐄𝟏𝟖𝟎𝟎𝟎 𝐭𝐫𝐢-𝐛𝐚𝐧𝐝 𝟏𝟎-𝐬𝐭𝐫𝐞𝐚𝐦 𝐖𝐢-𝐅𝐢 𝟕 𝐫𝐨𝐮𝐭𝐞𝐫 - Delivers up to 11528 Mbps (6 GHz), 5764 Mbps (5 GHz), and 688 Mbps (2.4 GHz) speeds for 4K/8K streaming, AR/VR gaming & more.◇**△ Performance varies by conditions, distance, & obstacles such as walls.
- 𝟏𝟎 𝐆𝐛𝐩𝐬 𝐬𝐭𝐚𝐲𝐬 𝐚𝐡𝐞𝐚𝐝 𝐚𝐬 𝐲𝐨𝐮𝐫 𝐢𝐧𝐭𝐞𝐫𝐧𝐞𝐭 𝐠𝐫𝐨𝐰𝐬 - Features a 10 Gbps WAN/LAN port to maximize multi-gig internet plans. An additional 10 Gbps WAN/LAN port and four 1 Gbps LAN ports provide fast connections to PCs, consoles, NAS, and switches.§
- 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐟𝐨𝐫 𝐞𝐯𝐞𝐫𝐲 𝐜𝐨𝐫𝐧𝐞𝐫 - Covers up to 3,600 sq. ft. for up to 150 devices at a time. 10 internal antennas and beamforming technology focus Wi-Fi signals toward hard-to-reach areas. Seamlessly connect phones, TVs, and gaming consoles.△
- 𝐒𝐢𝐦𝐩𝐥𝐞 𝐬𝐞𝐭𝐮𝐩 & 𝐞𝐚𝐬𝐲 𝐜𝐨𝐧𝐭𝐫𝐨𝐥 - Quickly set up and manage your Archer BE770 with the free Tether App. Keep your WiFi performing at its best by keeping the firmware updated through the App. All Wi-Fi routers require a separate modem.
How to forward the ports correctly
- Find the server’s LAN address. Give the host a stable address by creating a DHCP reservation on the router or assigning a static address on the machine. A forwarding rule tied to a changing address will eventually send traffic to the wrong device.
- Confirm the values Rust is using. Check the startup configuration for
+server.port,+server.queryport,+rcon.portand+app.port. If a setting is omitted, apply the documented default or derived value rather than guessing from an old router rule. Ensure the game and query ports are different. - Create the game rule. In the router’s port-forwarding or NAT section, make an inbound rule for the configured game port, select UDP, enter the server’s stable LAN address as the destination, and use the same destination port. Do not select “both” or “all” when a UDP-only rule is available.
- Create the browser-query rule when listing is wanted. Add the configured query port as a separate UDP rule to the same LAN address. Keeping it separate makes it possible to disable discovery without interrupting direct game connections.
- Create the RCON rule only when needed. Add the configured RCON port as TCP, not UDP. Set and test the RCON password and relevant web or RCON configuration before exposing the rule. Apply an allowed-source restriction if supported.
- Create the Rust+ rule only when enabled. Add
app.portas TCP and verify that its value is at least 10000. The companion backend must be able to reach this port from the internet. - Allow matching traffic on the host. Add inbound operating-system firewall rules for each enabled port and protocol. A correct router rule cannot bypass a local firewall that drops the packet.
- Test from outside the LAN. Have a player on another network connect to the public address first. Test browser listing, RCON and Rust+ separately so a failure identifies one service rather than several simultaneous changes.
The routing model is straightforward: a client targets your public IP and port, the router receives that traffic, and the forwarding rule sends it to the correct private LAN address. Port forwarding does not move the server onto the internet by itself; the server process must be listening on the selected port and the local firewall must permit it.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Why a server still fails after forwarding
Players cannot connect at all
- Confirm the server is listening on the configured
server.port, not an old default. - Check that the router rule is UDP and forwards to the current LAN address.
- Check the host firewall for an inbound UDP exception on the same port.
- Test using the public address from a genuinely external network; testing your own public address from inside the LAN can be affected by the router’s hairpin-NAT behavior.
- Check for carrier-grade NAT (CGNAT), an upstream modem/router, or double NAT. If another device owns the public address, the first device must pass the traffic to the second, and the second must forward it to the server. With CGNAT, the ISP may not give you an inbound-routable IPv4 address, so ordinary forwarding cannot work without an ISP-supported public address or another hosting arrangement.
Players connect, but the server is absent from the browser
- Verify that
server.queryportis set or derived to the value you actually forwarded. - Use UDP for the query rule and keep it distinct from
server.port. - Check the query-port rule and host firewall independently from the working game-port rule.
- Remember that a deliberately private server may be hidden by design; blocking query traffic prevents browser discovery even though direct connections continue to work.
RCON does not respond
- Confirm the RCON client is targeting the configured
rcon.port, not the game or query port. - Use TCP for both the router rule and host-firewall exception.
- Verify the RCON password and the server’s
rcon.webconfiguration. - Make sure RCON is enabled and the process has restarted after configuration changes.
- Check source-address restrictions and any upstream firewall before opening access more broadly.
Rust+ remains offline
- Confirm Rust+ is enabled and that the server’s
app.portmatches the forwarded TCP port. - Verify the port is at least 10000 and reachable from the internet.
- Check the host firewall, router rule and any second NAT device for TCP filtering.
- Do not substitute the query or RCON port; the companion service has its own endpoint.
Public and private configurations compared
| Decision axis | Public configuration | Private configuration |
|---|---|---|
| Player access | Game UDP port forwarded from the public internet | LAN-only, or game port shared only with selected players |
| Discoverability | Query UDP port forwarded so the browser can list the server | Query port blocked or not forwarded to reduce discoverability |
| Administration | RCON TCP port exposed only when needed, preferably source-restricted | RCON kept local or reachable through a private administration path |
| Companion features | Rust+ TCP port forwarded when enabled | Rust+ disabled or kept inaccessible if companion features are unnecessary |
| Network topology | Requires an inbound-routable public address and correct NAT path | Can operate entirely inside the LAN without public forwarding |
| Security posture | Open only required protocols and ports; monitor and restrict administrative access | Use nonstandard ports where appropriate, block queries, and limit firewall sources |
Changing the default ports safely
Nonstandard ports can reduce casual scanning and are specifically recommended in Facepunch’s hidden-server guidance, but changing a number does not replace authentication or firewall controls. Every dependent setting and every client connection must use the new value.
If you change server.port, update the player-forwarding rule and tell players the new address-and-port combination. If you leave server.queryport unset, its derived value can change because it is based on the larger of the game and RCON ports; set it explicitly when you need predictable firewall rules. Keep it different from the game port.
If you change rcon.port, update the TCP forwarding rule and RCON clients. Recheck the derived companion-port behavior as well, or set app.port explicitly when your Rust+ deployment requires a fixed value. After each change, restart the server if required by your configuration and test one service at a time.
A minimal opening strategy
Start with the smallest useful exposure. For a public browser-listed server, that means UDP game and query ports. Add TCP RCON only for remote administration and TCP Rust+ only for the companion app. For a direct-connect server, start with the UDP game port alone. For a private server, keep the query port blocked and expose administration only through a restricted path.
Record the configured values, protocol, destination address and reason for every rule. This simple inventory prevents a later administrator from opening all protocols “just in case” and makes it clear which rule to remove when a feature is disabled.
Quick Recap
Final checklist before inviting players
- The server host has a DHCP reservation or static LAN address.
server.portis known and forwarded as UDP.server.queryportis forwarded as UDP only if browser listing is wanted.rcon.portis forwarded as TCP only when RCON is enabled, with a strong password and restricted sources where possible.app.portis forwarded as TCP only when Rust+ is enabled and is at least 10000.- The operating-system firewall allows exactly the same enabled ports and protocols.
- The public address is tested from outside the LAN.
- CGNAT, double NAT and upstream firewalling have been ruled out.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
