How to Use Web RCON on a Rust Server (WebSocket Setup, Ports, and Troubleshooting)

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Godlike.Host offers hosted Rust servers with its own game panel, SFTP access and free DDoS protection, if you would rather not host it yourself.

Enable Rust Web RCON by adding +rcon.web 1, an unused TCP port, and a strong password to the server’s startup arguments, then restart the server. A typical configuration is +rcon.port 28016 +rcon.password "<strong-secret>" +rcon.web 1. Open the same TCP port in the host firewall and any router or cloud security group, then connect with a WebSocket-capable RCON client using the exact password.

This guide explains the complete setup, browser connection process, network requirements, protocol differences, security controls, and fixes for the most common connection failures.

#	Preview	Product	Price
1		Rust Key Cards, Rust Red Key Card, Cobalt Restricted Access Cards, Rust Gift For Gamers, Blue Key...	$25.00	Buy on Amazon
2		Rust Video Game Notebook	$15.00	Buy on Amazon
3		Rust Game Props Large Furnace (S)	$14.99	Buy on Amazon

What Web RCON does on a Rust server

RCON (remote console) lets an administrator send server-console commands without joining the game. Rust’s Web RCON implementation uses WebSockets, so a compatible client or browser dashboard can maintain a live connection to the server’s console endpoint.

The server must be started in WebSocket mode. Facepunch’s WebRCON documentation states: “If you’re running a Rust server you need to add “+rcon.web 1” to the command line to enable web based Rcon.” The setting is a startup argument, not a command you can reliably apply to a running process; changes take effect after the server restarts.

#1 Best Overall

Rust Key Cards, Rust Red Key Card, Cobalt Restricted Access Cards, Rust Gift For Gamers, Blue Key Card, Green Key Card (ALL THREE)

• Inspired by the Rust Video Game – These cards replicate the iconic keycards found in Rust (Red, Blue, Green).
• High Quality PVC Plastic – Printed on both sides, durable and water-resistant. Not a sticker.
• Great Rust Gift Idea – Perfect for fans of Rust, whether for cosplay, loot-themed gifts, or collection.
• Wallet-Size Replica – Standard 3.375x2.125 inches, 30 mil thick—fits in any wallet.
• NOT a sticker*

$25.00

Buy on Amazon

Web RCON is independent of the game’s player and query services. RCON listens on TCP, while Rust’s game and query ports are configured separately and commonly use UDP. Opening the game port does not make RCON reachable, and opening the RCON port does not make the game server available to players.

Before you configure it

Choose an unused TCP port

Use a TCP port that is not occupied by another service. Official examples commonly use 28016, but that number is an example rather than a universal requirement. The port in +rcon.port, the firewall rule, router forwarding rule, and client connection must all match.

Create a dedicated administrator password

rcon.password is an administrator credential. Generate a long, unique secret that is not used for the game panel, operating-system account, or any other service. Do not copy the example password letmein. Keep the value out of public screenshots, chat, tickets, paste sites, and shared configuration files.

Know where startup arguments are managed

On a self-hosted server, the arguments normally belong in the launch script or service definition. On managed hosting, use the panel’s startup-argument or command-line field. Editing a configuration file that the panel overwrites will not work unless the panel’s startup settings are changed.

Enable Web RCON step by step

1. Stop the Rust server cleanly. Do not edit startup arguments while the process is still running if your panel may rewrite them on shutdown.
2. Add the three RCON arguments. Use this pattern, replacing the port and password with your values:
   +rcon.port 28016 +rcon.password "<strong-secret>" +rcon.web 1
3. Save the launch script or panel settings. Keep the password exactly as entered, including capitalization. Quoting the password is useful when the value contains shell-sensitive characters.
4. Start or restart the server. The current convar reference identifies rcon.web as a startup setting that applies after a restart. A simple in-console change will not switch an already-running listener from legacy mode to WebSocket mode.
5. Check the startup log. A current reference describes a line similar to WebSocket RCON Started on :28016 as a quick confirmation. Log wording can vary by Rust build, so verify that the process starts a WebSocket RCON listener on the port you selected rather than relying on an exact phrase.

If your host uses a single command-line field, enter the arguments in the same order as the example. If it provides separate fields for RCON port, password, and Web RCON, fill those fields and let the panel generate the command line. Do not configure two different RCON implementations on the same port.

Open the network path

Host firewall

Create an inbound rule allowing TCP traffic to the selected RCON port. For the example above, allow TCP port 28016 to the Rust server process or the server machine. A rule for UDP 28016 will not help because Web RCON is a TCP listener.

Cloud security groups

Virtual servers often have a second firewall at the provider level. Add an inbound TCP rule there as well. If possible, restrict the source to the fixed public IP addresses from which administrators connect instead of allowing every Internet address.

Router or NAT forwarding

If the Rust server is behind a home or office router, forward the chosen external TCP port to the server’s private IP address and the same internal port. Reserve the private address with a DHCP reservation or static configuration so the forwarding rule does not break after a lease change.

Do not confuse this rule with Rust’s player or query-port forwarding. Those services are separate, and the Rust server guide identifies them separately as UDP services. A server can be playable while its RCON port remains closed.

Rank #2

Rust Video Game Notebook

$15.00

Buy on Amazon

Confirm that the server is listening

Test from outside the server’s local network when possible. Testing from inside the same LAN can produce misleading results if the router does not support NAT loopback.

Windows PowerShell

Test-NetConnection -ComputerName <server-ip> -Port <rcon.port>

Replace <server-ip> with the public address or hostname and <rcon.port> with the configured TCP port. A successful test reports TcpTestSucceeded : True. This verifies that a TCP connection can reach the port; it does not authenticate you or prove that the client is using the correct WebSocket protocol.

Linux, macOS, or another Unix-like system

nc -zv <server-ip> <rcon.port>

A successful result indicates that the TCP port is reachable. A timeout usually means that traffic is being dropped somewhere between the client and server. A refusal usually means the host is reachable but no service is accepting connections on that port, or a firewall is actively rejecting the request.

Connect from a browser or dashboard

1. Open a client that explicitly supports Rust WebSocket RCON. A legacy Source RCON client cannot communicate with a server running rcon.web 1.
2. Enter the server’s public IP address or DNS name.
3. Enter the RCON TCP port, such as 28016 if that is the value in your startup arguments.
4. Enter the exact value of rcon.password.
5. Connect and issue a harmless read-only command first, such as one that displays server status, to confirm that authentication and command delivery work.

Browser dashboards generally save the server address, port, and matching password in their connection settings. Treat those settings as sensitive: anyone who can retrieve the stored credential may gain console-level control.

Some WebRCON interfaces represent the password in a URL path. In that case, avoid URL-reserved characters such as #, ?, /, %, and spaces unless the specific client documents correct encoding. A long password made from characters the client handles predictably is safer than a theoretically complex value that gets truncated or misinterpreted.

Diagnose a failed connection

1. Verify the process first

Confirm that the Rust server is running and that you are testing the machine that actually hosts it. A stopped process, crash loop, or restart into a different installation makes all network tests fail.

2. Verify WebSocket mode

Look at the effective startup arguments and confirm +rcon.web 1. If the argument is absent, set to 0, or placed in a field the panel does not use, the server may expose deprecated Source RCON instead. Restart after correcting it.

3. Verify the port at every layer

Confirm that the listener port in the log matches rcon.port, then test that same TCP port externally. Check the operating-system firewall, cloud security group, router forwarding, and any provider-level network ACL. A single missing layer is enough to cause a timeout.

4. Verify the credential

Copy the password from the same configuration that launches the server. Watch for smart quotes, trailing spaces, capitalization changes, and shell escaping. If the password has appeared in a log, screenshot, chat message, or shared file, replace it and restart the server.

Rank #3

Rust Game Props Large Furnace (S)

• Acrylic Painting Pla Plastic

$14.99

Buy on Amazon

5. Check for competing RCON implementations

A second RCON implementation can attempt to use the same port. Older uMod support discussions report conflicts when OxideRcon is enabled on the same port; treat that as version-specific community troubleshooting rather than a universal rule. If you use a modded server, disable the competing listener or assign distinct ports, then restart and retest.

WebSocket RCON versus legacy Source RCON

The two modes are not interchangeable. If a client reports an immediate protocol error while the TCP test succeeds, check this setting before changing firewall rules. A reachable port only proves that something accepted TCP; it does not prove that the service speaks the protocol your client expects.

Do you need uMod or Oxide?

No. Vanilla Rust Web RCON is enabled with the server’s own startup arguments and does not require uMod or Oxide.

uMod is an optional Rust modification platform used when you need plugins or mod-specific administration. Its Rust documentation covers installation, updates, commands, permissions, and RCON-related behavior. OxideMod’s owner guides cover server setup, commands, permissions, plugins, and configuration. Install a modding platform only when the server needs those capabilities; adding it solely to obtain vanilla Web RCON introduces another component to maintain and another possible source of port conflicts.

On a modded server, document which component owns RCON, which port it listens on, and whether the client expects WebSocket or legacy Source RCON. Keep only one intended listener per port.

Secure the RCON endpoint

• Use a unique secret. RCON grants remote administrative control, so do not reuse a password from a hosting panel, email account, or game account.
• Limit source addresses. Where the host firewall, cloud security group, or router allows it, permit TCP RCON traffic only from trusted administrator IP addresses.
• Do not publish the endpoint. Avoid posting the address, port, and password together in documentation, screenshots, chat, or public issue reports.
• Rotate exposed credentials immediately. Change rcon.password and restart if the value appears in logs, screenshots, chat, a support ticket, or a shared configuration file.
• Protect dashboard storage. A browser dashboard that stores the credential can become an alternate path to the console. Secure the dashboard account and workstation as carefully as the server.
• Use network controls in addition to obscurity. A nonstandard port can reduce automated noise, but it is not access control. Keep a firewall or equivalent allow-list in place.
• Review command permissions. If a hosted or self-hosted dashboard offers per-role command allow-lists, configure least privilege and review the audit history regularly.

Because some WebRCON endpoints place the password in a URL path, URL-reserved characters can create accidental disclosure or parsing problems. Avoid #, ?, /, %, and spaces when the client’s URL format does not document reliable encoding.

Choose a Web RCON client or service

The most important requirement is protocol support: the client must speak WebSocket RCON when the server runs rcon.web 1. After that, compare how it handles credentials and administration rather than choosing solely by appearance.

For example, a dashboard such as RustTools documents command history, audit logging, and per-role command allow-lists. Treat those as product-specific features and confirm their current behavior before relying on them for operations or compliance.

Quick Recap

Bestseller No. 1

Rust Key Cards, Rust Red Key Card, Cobalt Restricted Access Cards, Rust Gift For Gamers, Blue Key Card, Green Key Card (ALL THREE)

Wallet-Size Replica – Standard 3.375x2.125 inches, 30 mil thick—fits in any wallet.; NOT a sticker*

$25.00

Bestseller No. 2

Rust Video Game Notebook

$15.00

Bestseller No. 3

Rust Game Props Large Furnace (S)

Acrylic Painting Pla Plastic

$14.99

A repeatable operating procedure

1. Record the intended TCP port, server address, and the administrator responsible for the credential.
2. Generate a unique password and store it in an approved password manager rather than in chat or a public note.
3. Set +rcon.port, +rcon.password, and +rcon.web 1 in the actual launch configuration used by the host.
4. Open the TCP port only to trusted source addresses where practical, and configure NAT forwarding if required.
5. Restart the server and verify the RCON startup entry in the log.
6. Run an external TCP reachability test.
7. Connect with a WebSocket-capable client and issue a harmless status command.
8. Record the final port and client configuration without recording the password in the same document.
9. After any password, mode, port, firewall, or router change, restart when required and repeat the reachability and authentication tests.

Quick reference

• Enable Web RCON: add +rcon.web 1 to the startup command.
• Set the listener: use +rcon.port <unused-tcp-port>.
• Set authentication: use +rcon.password "<strong-secret>".
• Apply changes: restart the Rust server.
• Network type: RCON is TCP; do not substitute the game’s UDP ports.
• Client type: use a WebSocket RCON client when rcon.web 1 is enabled.
• First checks on failure: server process, effective startup arguments, external TCP test, firewall/NAT path, then exact password.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.