How to Enable WebRCON on a Rust Dedicated Server

If you run a Rust dedicated server — especially on Linux — you need RCON. The Linux server console is not interactive like the Windows version, so without a remote console connection you have no way to send admin commands to your server. The fix is three launch parameters and an RCON client. Here is the whole setup.

Step 1: Add the three RCON launch parameters

RCON is enabled at launch time. Add these to your server's startup command, alongside your existing +server.* parameters:

+rcon.port 28016 +rcon.password letmein +rcon.web 1

What each one does:

• +rcon.port — the port the RCON service listens on. 28016 is the value used in the official example startup command, one above the default game port.
• +rcon.password — the password an RCON client must present to connect.
• +rcon.web 1 — switches RCON to websocket mode. The official Facepunch wiki explicitly suggests using rcon.web 1, and it is what modern RCON tools expect.

A server that boots with these parameters is listening for websocket RCON connections on port 28016.

Step 2: Change that password

Do not ship letmein. The wiki's own example flags that value with "Change this value!!!" — it appears in every copy-pasted startup script on the internet, and anyone who can reach your RCON port with the password has full administrative control of your server. Use a long, unique password that appears nowhere else.

Step 3: Open the right firewall port — it's TCP

Here is the detail that trips people up: the Rust game port (28015 by default) is UDP, but the RCON port is TCP. If you copy your game-port firewall rule and only change the port number, RCON connections will fail. You need two distinct rules:

If you only administer the server from one machine, consider restricting the TCP rule to that machine's IP rather than opening it to the world.

Step 4: Connect with an RCON client

With the server running, connect a client to your-server-ip:28016 using your RCON password. Both standalone RCON applications and web-based consoles exist. Facepunch provides its own online web console, with one documented caveat worth knowing before you use it: it is not served over HTTPS. If that matters for your threat model — for example, administering over untrusted networks — prefer a standalone client.

Step 5: Learn the sv prefix for console-only commands

Command syntax differs depending on where you are sending the command from. Some commands are designed for the server console, and when you issue them from a connected client with admin you prefix them with sv:

• sv say your message here — broadcasts a message to in-game chat from the server.
• sv quit — saves and shuts down the server. Note the distinction: plain quit closes your client, while sv quit stops the server itself. Mixing these up is a classic way to accidentally take your server down.

Step 6: Verify it works

After launching with the new parameters, do a quick end-to-end check: connect your RCON client, send a harmless broadcast such as a say command, and confirm the message appears in the in-game chat. If it shows up, your RCON pipeline — parameters, firewall rule, client, and password — is working, and you can administer the server remotely from here on.

Quick reference

+rcon.port 28016
+rcon.password <your-unique-password>
+rcon.web 1

Game port: UDP. RCON port: TCP. Change the password. Test with a broadcast. That's the whole setup.