Nexardo

Rust Field guide

Rust WebRCON setup: remote administration and security

Configure secure WebRCON in Rust: enable rcon.web, bind to loopback, and reverse proxy WebSocket connections through Nginx with TLS encryption.

EugenePublishedUpdatedReading time3 min
Rust WebRCON setup: remote administration and security

The RCON remote administration protocol enables operators of Facepunch Rust dedicated servers to execute console commands, manage wipes, ban abusive players, and broadcast announcements without launching the full game client.

Modern Rust releases replace the legacy binary Source RCON protocol with WebRCON, an event-driven JSON protocol running over WebSockets. Exposing raw WebRCON directly to the public internet with an unencrypted password creates substantial security vulnerabilities: credentials travel in plaintext, and bots continuously scan port 28016 for brute-force attacks. This guide demonstrates how to configure WebRCON, bind it to localhost, and secure it with WSS encryption via an Nginx reverse proxy.

Configuring WebRCON startup parameters in Rust#

WebRCON is activated through command-line parameters supplied to the Rust server binary (RustDedicated).

Verify that your startup script invokes the following arguments:

bash
./RustDedicated -batchmode \
  +server.port 28015 \
  +rcon.port 28016 \
  +rcon.web 1 \
  +rcon.ip 127.0.0.1 \
  +rcon.password "STRONG_RCON_PASSWORD_HERE"

The critical security directive is +rcon.ip 127.0.0.1. It binds the RCON WebSocket listener exclusively to the local loopback interface, blocking direct access from external WAN interfaces.

Confirm that the socket is bound locally:

bash
ss -tulpn | grep 28016

Configuring an Nginx reverse proxy with WSS encryption#

To interact with WebRCON from remote web consoles (such as RustAdmin Web or external bots), traffic must be encrypted with TLS (WSS instead of raw WS).

Create an Nginx virtual host configuration:

bash
cat << 'EOF' | sudo tee /etc/nginx/sites-available/rust-rcon
server {
    listen 443 ssl http2;
    server_name rcon.example.com;

    ssl_certificate /etc/letsencrypt/live/rcon.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/rcon.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:28016;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
    }
}
EOF

Enable the site and reload Nginx:

bash
sudo ln -sf /etc/nginx/sites-available/rust-rcon /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

The proxy_set_header Upgrade and Connection "upgrade" headers are essential: without them, Nginx attempts to treat the request as standard HTTP, terminating the WebSocket handshake with a 400 Bad Request error.

Restricting administration access via IP allowlists#

To establish defense-in-depth, limit administrative access exclusively to static IP addresses used by your operations team.

Append allow and deny statements directly inside your Nginx location block:

bash
cat << 'EOF' | sudo tee -a /etc/nginx/sites-available/rust-rcon

# IP Whitelist example
# allow 203.0.113.50;
# deny all;
EOF

Alternatively, restrict access at the UFW firewall level:

bash
sudo ufw allow from 203.0.113.50 to any port 443 proto tcp

Understanding WebRCON payloads and connection testing#

WebRCON uses structured JSON to transmit commands and stream server output. Each message adheres to a defined schema:

  • Identifier: integer correlating request and response payloads.
  • Message: console command string (e.g. status, serverinfo, kick).
  • Name: sender label (conventionally WebRcon).

Test your local WebSocket listener using the wscat CLI utility:

bash
wscat -c "ws://127.0.0.1:28016/STRONG_RCON_PASSWORD_HERE"

Once connected, issue the serverinfo command to confirm the engine responds with active player counts and frame rate metrics.

For seamless server operations and automated scheduled events (wipes, bans, backups) without manual Nginx and certificate maintenance, teams rely on an integrated server management platform, where hardened console access is built directly into the UI.

Sources#