The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Playing with friends? Godlike.Host runs hosted Rust servers from 10 data-center locations, with free DDoS protection.
For a normal public Rust server using Facepunch’s documented defaults, forward UDP 28015 for player connections and UDP 28017 for server-browser queries. Forward TCP 28016 only if you use RCON for remote administration, and TCP 28082 only if Rust+ is enabled. Every forwarded port must target the server’s stable LAN address, and the host firewall must allow the same protocol.
You need only the game port to let external players join directly. The query port controls browser visibility; RCON and Rust+ are separate services with different security implications.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →
Rust’s ports at a glance
| Function | Setting | Default value | Protocol | Forward it when |
|---|---|---|---|---|
| Player game traffic | server.port |
28015 | UDP | Always for players connecting from outside your LAN |
| Steam/server-browser queries | server.queryport |
28017 with the unchanged defaults | UDP | When the server should appear in the in-game browser |
| Remote administration | rcon.port |
28016 | TCP | Only when an RCON client will connect remotely |
| Rust+ companion service | app.port |
28082 with the unchanged defaults | TCP | Only when Rust+ is enabled |
These defaults come from Facepunch’s official dedicated-server and Rust+ documentation, current as of 15 October 2026. If you changed a setting, forward the configured value instead of the default shown here.
What each port actually does
UDP 28015: the player connection
server.port carries the game traffic used when a player joins and plays. Facepunch documents 28015 as the default and specifies UDP. A direct connection can work with this port alone, provided players know the server’s public address and your router and host firewall pass the traffic.
#1 Best Overall
- 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝐖𝐢-𝐅𝐢 𝟕 - Optimize performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, Samsung Galaxy S24 Ultra, and PS5 Pro with the latest WiFi 7 technology with Multi-Link Operation, Multi-RUs, 4K-QAM, and up to 320 MHz channels.◇△
- 𝟕-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐁𝐄𝟗𝟕𝟎𝟎 𝐓𝐫𝐢-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐒𝐩𝐞𝐞𝐝𝐬 - Delivers smooth 4K/8K streaming, immersive AR/VR gaming, and blazing-fast downloads with speeds up to 5,765 Mbps on the 6 GHz band, 2,882 Mbps on the 5 GHz band, and 1,032 Mbps on the 2.4 GHz band.⌂
- 𝐌𝐚𝐱𝐢𝐦𝐢𝐳𝐞𝐝 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 - Up to 2,600 sq. ft. coverage for up to 120 devices at a time. 6 optimally positioned antennas and Beamforming technology focus Wi-Fi signals toward hard-to-cover areas for stronger coverage-—ideal for those seeking the best WiFi router for large homes.
- 𝟏𝟎 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭 𝐟𝐨𝐫 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠𝐚𝐛𝐢𝐭 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐯𝐢𝐭𝐲 - Features 1x 10 Gbps WAN/LAN port, 1x 2.5 Gbps WAN/LAN port, and 3x 2.5 Gbps LAN ports. Integrate with a multi-gig modem for fast, wired gig+ internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
UDP 28017: browser discovery
server.queryport handles Steam/server-browser queries. It is separate from the game port and also uses UDP. Facepunch says the query port is required for the server to appear in the game’s browser. When you do not set it explicitly, it is one higher than whichever is greater: server.port or rcon.port. With 28015 and 28016, that produces 28017.
The game and query ports must be different. If you move the game or RCON port, recalculate the derived query value or set server.queryport explicitly, then forward that exact number.
TCP 28016: optional RCON administration
rcon.port is the TCP endpoint for RCON clients. Facepunch lists 28016 as the default. It is not needed for ordinary gameplay or browser listing. Leaving it unforwarded keeps remote administration inside your network; forwarding it makes remote control possible but increases the attack surface.
TCP 28082: optional Rust+
The Rust+ companion service uses app.port over TCP. Facepunch documents its default as the larger of the game port or RCON port, plus 67. With 28015 and 28016 unchanged, the result is 28082. The companion port must be reachable from the internet, and app.port must be at least 10000 for the Rust+ backend.
Choose the smallest configuration that meets your goal
| Goal | Ports to expose | What players or administrators get |
|---|---|---|
| Direct connections only | UDP game port | Players can join by address, but the server is not necessarily listed in the browser |
| Public browser listing | UDP game port and UDP query port | Players can join and discover the server through listings |
| Remote administration | Previous ports plus TCP RCON port | RCON clients can manage the server remotely |
| Rust+ companion features | Previous ports plus TCP app port | The Rust+ backend can reach the companion service |
| Private or LAN-only play | No internet forwarding, unless remote players are deliberately allowed | Access is restricted to local networking or another private network path |
For a private server, Facepunch’s hidden-server guidance recommends nonstandard ports and blocking the Steam query port. Query responses can reveal the server name, player count, map information and active players, and can make the server discoverable in listings. A nonstandard port is not a replacement for authentication or firewall rules, but it reduces casual discovery when combined with those controls.
Prepare the server and network before creating rules
1. Give the host a stable LAN address
Port forwarding points to an internal address such as 192.168.1.50. If the router later gives the machine a different address, the rule still points to the old device and stops working. Create a DHCP reservation in the router, or assign a static address that fits your network’s addressing plan. Record the address before proceeding.
Recommended Free Tools
2. Confirm which values Rust is using
Check the server startup parameters or configuration for server.port, server.queryport, rcon.port and, when applicable, app.port. Do not assume the defaults if you inherited a configuration, installed a management panel, or run more than one server. The router rules must match the values actually bound by the process.
3. Check whether the internet connection is reachable
You need an internet-reachable public address for unsolicited inbound connections. CGNAT, a second router, or an upstream modem-router can prevent a normal forward from reaching the host. Look at the WAN address shown by your router and compare it with the public address reported by an external service. If the router shows a private or carrier-grade range, contact the ISP about a public IPv4 option or use a hosting arrangement that permits inbound traffic.
Forward the ports in your router
Facepunch describes the path as public address and port to router, then router forwarding to the correct LAN IP. Router labels differ, but the required fields are the same: protocol, external port, internal or destination port, and destination LAN address.
- Open the router’s port-forwarding page. It may be under NAT, Advanced networking, Virtual server or Port forwarding.
- Create the game rule. Set protocol to UDP, external port to the configured
server.port(28015 by default), destination address to the reserved server IP, and destination port to the same number. - Create the query rule when listing is required. Set protocol to UDP and forward the configured
server.queryport(28017 with unchanged defaults) to the same destination port on the server. - Create an RCON rule only if needed. Select TCP and forward
rcon.port(28016 by default). If the router supports source-IP restrictions, allow only your office, home or VPN address range rather than the entire internet. - Create the Rust+ rule only when enabled. Select TCP and forward the configured
app.port(28082 with unchanged defaults). It must be externally reachable and at least 10000. - Save and apply the rules. Some routers restart networking or require an explicit Apply button. Avoid selecting “both” or “all” protocols when a rule needs only UDP or TCP; Facepunch recommends choosing the specific protocol.
Use the same destination port internally unless you have a deliberate reason to translate it. A public port can differ from the internal one, but mismatched values make troubleshooting harder and are unnecessary for a straightforward installation.
Rank #3
- 𝐀𝐂𝟏𝟐𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢𝐅𝐢 𝐑𝐨𝐮𝐭𝐞𝐫 𝐟𝐨𝐫 𝐇𝐨𝐦𝐞 — Ideal for gaming, 4K streaming, downloading and more with Wi-Fi speeds up to 1.2 Gbps (867 Mbps on 5 GHz band and 300 Mbps on 2.4 GHz band)
- 𝐅𝐮𝐥𝐥 𝐆𝐢𝐠𝐚𝐛𝐢𝐭 𝐏𝐨𝐫𝐭𝐬— The Gigabit WiFi Router with 3 Gigabit ports, ideal for any internet plan and allow you to directly connect your wired devices creates fast, reliable wired connections for your PCs, Smart TVs, and gaming consoles
- 𝐒𝐭𝐫𝐨𝐧𝐠 𝐖𝐢𝐅𝐢 𝐒𝐢𝐠𝐧𝐚𝐥 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞— Equipped with Four Powerful 6dbi Antennas and Beamforming technology, wireless router AC6 delivers high speed internet throughout your home
- 𝐄𝐚𝐬𝐲 𝐒𝐞𝐭𝐮𝐩 𝐢𝐧 𝐦𝐢𝐧𝐮𝐭𝐞𝐬 𝐰𝐢𝐭𝐡 𝐀𝐏𝐏 — The Tenda Wi-Fi APP helps you to setup, monitor, & manage your home or guest network easily & quickly. You can monitor the network status & schedule Internet access for your children via built-in parental controls
- 𝐀𝐜𝐜𝐞𝐬𝐬 𝐏𝐨𝐢𝐧𝐭 𝐌𝐨𝐝𝐞 — Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
Allow the same traffic through the host firewall
Router forwarding and firewall permission are separate gates. On the server operating system, add inbound rules for the exact configured ports and protocols:
- Allow UDP for
server.port. - Allow UDP for
server.queryportif browser listing is required. - Allow TCP for
rcon.portonly when RCON is enabled. - Allow TCP for
app.portonly when Rust+ is enabled.
Scope rules to the Rust server executable or service where your firewall supports application rules. Keep RCON and Rust+ disabled or blocked when you do not use them. After changing firewall settings, restart the server service if it does not immediately bind the new configuration.
Start Rust with matching settings
Facepunch’s documented startup parameters use the +setting value form, such as +server.port 28015. The important point is consistency: the value in the startup command or server configuration must be the value forwarded in the router and permitted by the firewall.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11When changing ports, update all three layers in one maintenance window:
- Set the new Rust parameter, including an explicit
server.queryportwhen you do not want the derived value. - Restart the Rust server and confirm that it binds the intended ports without an address-in-use error.
- Change the router forwarding rules to the new numbers and protocols.
- Change the host firewall rules to match.
- Test from outside the LAN rather than relying on a local connection that may use hairpin NAT.
Test each service in a controlled order
- Test player access first. From a different internet connection, connect using the public address and game port. A working direct connection proves that the game port, UDP forwarding, firewall and basic routing are aligned.
- Test browser visibility second. Wait for the listing to refresh, then search by the server’s name or filter. If direct connections work but the listing does not, focus on the query port rather than changing the game port.
- Test RCON separately. Use the configured RCON client, TCP port and password. Do not infer RCON health from a successful player connection; it is a different protocol and rule.
- Test Rust+ last. Verify the companion service is enabled, the TCP app port is reachable and its value is at least 10000. The Rust+ backend must be able to reach that port from the internet.
Perform tests from outside the server’s LAN. Many routers do not support NAT loopback, so a test from inside the same network can fail even when external players can connect, or appear to work through a local path that says nothing about internet reachability.
Rank #4
- 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 𝐰𝐨𝐫𝐤𝐡𝐨𝐫𝐬𝐞 𝐭𝐡𝐚𝐭'𝐬 𝐫𝐞𝐚𝐝𝐲 𝐟𝐨𝐫 𝐭𝐨𝐦𝐨𝐫𝐫𝐨𝐰 – Delivering high-capacity tri-band lanes, the Wi-Fi 7 Archer BE770 combines 10 internal antennas, an open 6 GHz band, and a future-ready 10G WAN/LAN port for busy, connected homes.
- 𝐁𝐄𝟏𝟖𝟎𝟎𝟎 𝐭𝐫𝐢-𝐛𝐚𝐧𝐝 𝟏𝟎-𝐬𝐭𝐫𝐞𝐚𝐦 𝐖𝐢-𝐅𝐢 𝟕 𝐫𝐨𝐮𝐭𝐞𝐫 - Delivers up to 11528 Mbps (6 GHz), 5764 Mbps (5 GHz), and 688 Mbps (2.4 GHz) speeds for 4K/8K streaming, AR/VR gaming & more.◇**△ Performance varies by conditions, distance, & obstacles such as walls.
- 𝟏𝟎 𝐆𝐛𝐩𝐬 𝐬𝐭𝐚𝐲𝐬 𝐚𝐡𝐞𝐚𝐝 𝐚𝐬 𝐲𝐨𝐮𝐫 𝐢𝐧𝐭𝐞𝐫𝐧𝐞𝐭 𝐠𝐫𝐨𝐰𝐬 - Features a 10 Gbps WAN/LAN port to maximize multi-gig internet plans. An additional 10 Gbps WAN/LAN port and four 1 Gbps LAN ports provide fast connections to PCs, consoles, NAS, and switches.§
- 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐟𝐨𝐫 𝐞𝐯𝐞𝐫𝐲 𝐜𝐨𝐫𝐧𝐞𝐫 - Covers up to 3,600 sq. ft. for up to 150 devices at a time. 10 internal antennas and beamforming technology focus Wi-Fi signals toward hard-to-reach areas. Seamlessly connect phones, TVs, and gaming consoles.△
- 𝐒𝐢𝐦𝐩𝐥𝐞 𝐬𝐞𝐭𝐮𝐩 & 𝐞𝐚𝐬𝐲 𝐜𝐨𝐧𝐭𝐫𝐨𝐥 - Quickly set up and manage your Archer BE770 with the free Tether App. Keep your WiFi performing at its best by keeping the firmware updated through the App. All Wi-Fi routers require a separate modem.
Troubleshoot by symptom
Players cannot connect at all
- Confirm the running server’s
server.portand protocol are UDP. - Check that the router forwards the same UDP number to the current reserved LAN address.
- Check the host firewall for an inbound UDP rule.
- Verify the server is listening and has no port conflict with another process or server instance.
- Investigate CGNAT, double NAT or an upstream router. Every router between the public internet and the host needs a route, or the upstream device must be placed in bridge mode.
Players can connect, but the server is missing from the browser
- Verify that
server.queryportis configured and is not equal toserver.port. - Forward that query value as UDP to the server’s LAN address.
- Allow the same UDP value through the host firewall.
- Allow time for browser data to refresh after a restart or configuration change.
RCON does not work
- Confirm that RCON is enabled, the client uses TCP, and the client’s port matches
rcon.port. - Check the password and any
rcon.webconfiguration used by your setup. - Ensure the router rule is actually enabled and targets the current server IP.
- If local RCON works but remote RCON fails, inspect the WAN path and source-IP restrictions rather than the game port.
Rust+ remains offline
- Confirm that
app.portis TCP, externally forwarded and at least 10000. - Check the host firewall and any upstream router for the same TCP rule.
- Make sure the companion service is running and that the configured port follows the service’s current value, not merely the default.
Security practices for an internet-facing server
- Expose only the services you use. The game port is required for external play; query, RCON and Rust+ are optional.
- Use a strong, unique RCON password and restrict source addresses when possible.
- Prefer VPN or local-only administration over an unrestricted RCON exposure when your environment permits it.
- Keep the operating system, Rust server and router firmware updated.
- For a private server, use nonstandard ports, block the query port and apply firewall restrictions so discovery and access are intentional.
- Document every custom value. A short record of the game, query, RCON and app ports prevents accidental reuse and makes future troubleshooting faster.
Public, private and complicated network layouts
Public server on one router
This is the simplest case: one public IPv4 address, one router, a reserved LAN address and forwarding rules for the services you selected. The game and query services use UDP; RCON and Rust+ use TCP.
Double NAT or multiple routers
If an ISP gateway feeds a second router, the first device may receive the public address while the second owns the server’s LAN. Forward the required ports through both devices, or put the gateway into bridge mode and let one router perform NAT. A rule on only the inner router cannot receive traffic that the outer router never forwards.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteCGNAT
With carrier-grade NAT, the ISP shares an address among customers and does not deliver unsolicited inbound traffic to your router. Conventional port forwarding will not solve that limitation. Ask the ISP for a public IPv4 address, use a network service that provides an inbound tunnel or relay, or move the server to infrastructure with controllable networking.
Bottom line
Start with UDP 28015 for players. Add UDP 28017 for browser listing, TCP 28016 for RCON and TCP 28082 for Rust+ when those features are enabled and those defaults remain unchanged. Forward each configured value to a stable LAN address, allow the identical protocol through the host firewall, and test from outside your network. If direct play works but listing, administration or Rust+ does not, troubleshoot that service’s own port rather than opening every protocol on every port.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
