Keep Factorio's administration listener private, then forward it through SSH when you need console access. This gives a Linux headless server owner a way to inspect players and save the factory without opening an administration port to the internet.
The example assumes a working dedicated server, SSH access to its Linux host, and permission to change its launch configuration. RCON uses a separate TCP connection; the usual game connection on UDP 34197 is another service. A successful RCON request does not prove that players can join.
Put the listener on the server's loopback interface#
First retain the existing startup configuration and confirm the save path. Add these settings to the server's existing launch arguments during a maintenance window:
--rcon-bind 127.0.0.1:27015
--rcon-password REPLACE_WITH_A_DISTINCT_RANDOM_SECRET
This is an argument fragment, not a complete launch command. Replace the example secret in the launch configuration; keep the current save, game port, mods, and server settings arguments. The Factorio parameter reference documents these flags. Use the executable's own --help if the installed version differs.
The RCON secret should differ from the password players use to join. Store the launch definition with access limited to the service owner and administrators. Do not paste the real secret into shell history or support messages. A protected unit file does not make a password passed as an argument invisible to users able to inspect that process. Check your host's account and process access policy.
After restarting through the existing service manager, inspect the socket on the server:
sudo ss -ltnp 'sport = :27015'
Check that the address is 127.0.0.1:27015 and the owning process is this Factorio instance. A listener on 0.0.0.0 or [::] does not match this plan. Correct the effective launch configuration before proceeding; adding another public firewall exception will not correct the bind address.
With Docker, loopback inside the container belongs to that container. A host SSH tunnel cannot reach it as the host's own loopback. Use a deliberately configured host-loopback port publication with a reachable container listener, or an administration process inside the container network. Do not copy direct-install flags blindly into a wrapper.
Open the tunnel from your computer#
Run this on the administrator's computer, substituting the SSH account and host. 203.0.113.10 is a documentation address:
ssh -N -o ExitOnForwardFailure=yes \
-L 127.0.0.1:27016:127.0.0.1:27015 \
admin@203.0.113.10
The first loopback address is your computer; the second is the SSH server's view of the destination. Port 27016 is only the local entrance. Keep this SSH session open while using RCON. Verify the host key through a trusted channel on first connection; an unexpected changed key needs investigation.
OpenSSH documents local forwarding. ExitOnForwardFailure catches a failure to establish the forwarding listener; it does not guarantee that Factorio will answer later connections. If local 27016 is occupied, choose another unused local port and update the RCON client to match. Do not evict another process.
Connect with a protected client configuration#
Use a client that supports Factorio's RCON implementation. One option is the community gorcon/rcon-cli client, whose executable is named rcon. Obtain a reviewed release for your platform and check its help; it is separate software from Factorio.
Create a private rcon.yaml outside a shared or version-controlled directory. On Linux/macOS restrict it to the owning account with mode 600. On Windows use an equivalent restrictive file ACL. Its example contents are:
default:
address: "127.0.0.1:27016"
password: "REPLACE_WITH_THE_SERVER_RCON_SECRET"
After replacing the placeholder privately, issue a read-only request from that directory:
rcon -c ./rcon.yaml "/players online"
Check that the response belongs to the intended server. Then, if you need a manual save:
rcon -c ./rcon.yaml "/server-save"
Wait for the server log to confirm that saving completed before stopping the service or copying its data. The console command reference distinguishes ordinary administration from Lua/script commands. Connectivity checks do not need /c; script commands can disable achievements for the save.
Diagnose the layer that failed#
A refused local connection suggests the SSH tunnel is absent or the client uses the wrong local port. An SSH forwarding error when the client connects points toward the remote destination: inspect the server listener and its namespace. An authentication error means you reached an RCON endpoint but must check its instance and secret. A command error after authentication calls for the command's syntax and permissions, rather than another firewall change.
Close the tunnel when finished. If a secret was disclosed, rotate it in the server launch configuration and every authorized client, restart under the normal maintenance process, and test again. Keep troubleshooting records free of credentials. If you manage your own infrastructure through a central interface, Nexardo's product overview explains that approach; this guide still requires checking the actual instance and administration path.
