The Remote Console (RCON) protocol in Minecraft allows server operators to execute commands programmatically without maintaining an interactive shell session. This is indispensable for scheduled maintenance warnings, triggering atomic save flushes before snapshots, and integrating game servers with Discord automation bots. However, because Minecraft's implementation transmits credentials in unencrypted cleartext, misconfigured firewall rules present a critical attack vector.
This practical guide explores correct RCON configuration inside server.properties, securing port TCP 25575 with local firewall policies, sending shell commands via mcrcon, and automating tasks through Python scripts.
Configuring RCON in server.properties#
By default on vanilla servers and Paper/Purpur cores, RCON listeners are disabled. Inspect your server configuration to check active settings:
grep -E "rcon" /opt/minecraft/server.properties
Define the following directives inside /opt/minecraft/server.properties:
enable-rcon=true
rcon.port=25575
rcon.password=SuperSecretPassword987
broadcast-rcon-to-ops=false
enable-rcon=true— Activates the background RCON socket listener.rcon.port=25575— The standard TCP port designated for Minecraft RCON traffic.rcon.password— A high-entropy secret token (minimum 16–20 characters).broadcast-rcon-to-ops=false— Suppresses noisy server log notifications in player chat when automated maintenance scripts dispatch commands.
Firewall Isolation for Port TCP 25575#
Because Minecraft RCON packets transmit authentication tokens in plaintext, port 25575 must never be exposed unfiltered to the public WAN. Exposure invites brute-force credential stuffing and unauthorized server termination.
Enforce loopback socket isolation using Ubuntu's UFW:
sudo ufw allow from 127.0.0.1 to any port 25575 proto tcp && sudo ufw reload
If automation commands originate from an external monitoring instance, restrict ingress traffic strictly to that specific administrative IP address.
Installing the Lightweight mcrcon CLI Client#
For seamless integration within Linux shell pipelines and cron schedules, compile the high-speed C client mcrcon:
which mcrcon || (curl -sL https://raw.githubusercontent.com/Tiiffi/mcrcon/master/mcrcon.c -o /tmp/mcrcon.c && gcc /tmp/mcrcon.c -o /usr/local/bin/mcrcon && chmod +x /usr/local/bin/mcrcon)
Automating Management Routines via Python#
For teams orchestrating game infrastructure through web applications or Discord bots, Python scripts can dispatch commands programmatically:
import socket
def send_rcon(host, port, password, command):
# Lightweight socket execution demonstration
print(f"Connecting to {host}:{port} to execute: {command}")
send_rcon("127.0.0.1", 25575, "SuperSecretPassword987", "say [SERVER] Maintenance warning")
Forcing Atomic Save Flushes Before Backups#
A primary operational use case for RCON is synchronizing active world state to storage prior to snapshot generation:
mcrcon -H 127.0.0.1 -P 25575 -p "SuperSecretPassword987" "save-all flush"
This instructs the JVM to immediately write modified block chunks and entity registries to disk, guaranteeing clean .mca region files during subsequent tar compression.
If you prefer managing Minecraft worlds with built-in task schedulers, scheduled cloud snapshots, and intuitive web consoles without compiling CLI utilities, managed Minecraft server hosting delivers complete infrastructure control out of the box.
