The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →To keep a Rust dedicated server running while removing it from the public browser, assign a separate UDP query port, then block inbound traffic to that port in your host or provider firewall. Leave the game port open for players who connect directly. Facepunch’s hidden-server guidance says the Steam query port must remain blocked; otherwise Steam and Rust listings can discover the server.
Playing with friends? Godlike.Host runs hosted Rust servers from 10 data-center locations, with free DDoS protection.
This hides discovery, not access. Give trusted players the server’s IP address and game port, and add explicit access controls if the server must be private.
As an Amazon Associate I earn from qualifying purchases.
What you are changing
A Rust server uses separate network endpoints for gameplay and browser discovery. server.port carries player connections. server.queryport is used by Rust and third-party tools to ask for listing information such as the server name, player count, map and active-player data.
Rust browser discovery has two stages. The client first asks Steam for Rust server addresses, then sends Source A2S queries to those addresses. A server appears when the query endpoint answers. Blocking inbound UDP traffic on the query port interrupts that discovery path while leaving the game endpoint available for a direct connection.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Do not treat the query port as another game port. Facepunch’s server-creation documentation requires server.port and server.queryport to be reachable UDP ports and says they cannot be the same. If server.queryport is omitted, Rust derives a default relative to server.port or rcon.port, depending on the configuration. Set it explicitly so your firewall rule targets a known value.
Before you begin
- Administrative access to the dedicated server’s startup parameters or
server.cfg. - Permission to create an inbound firewall rule on the server host or in the hosting provider’s network firewall.
- The public IP address and UDP game port that direct-connect players will use.
- A planned, unused UDP query-port number that is different from the game port.
- A way to restart the server after changing its configuration.
The example port below is illustrative. Replace it with an unused value suitable for your host; the exact number is not prescribed by Facepunch.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How to hide the server step by step
1. Identify the game port and choose a separate query port
Record the value assigned to server.port. Then choose a second UDP port for server.queryport. Keep the values different, and avoid selecting a port already used by another service on the same machine.
For example, if the game listens on server.port 28015, you might select 28017 for the query endpoint. The number itself does not make a server hidden; the firewall behavior does.
2. Set server.queryport explicitly
You can set the convar in the launch command or in the server configuration file. A launch-parameter example is:
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
+server.port 28015 +server.queryport 28017
In server.cfg, the corresponding setting is:
server.queryport 28017
Use the syntax appropriate to the way your server is started, and make sure there is only one active value. Changing a panel field without changing the actual startup configuration can leave the process listening on a different port than the one you intend to block.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors3. Restart with the new configuration
Restart the dedicated server so the explicit query-port setting is loaded. The game port remains the endpoint players use for play; the query port is the endpoint whose unsolicited inbound access you will deny.
4. Reject inbound traffic to the query port
Create an inbound firewall rule that rejects UDP traffic destined for the selected server.queryport. You can apply the rule in the operating system firewall, the hosting provider’s network firewall, or both when your setup has two independent filtering layers.
- Protocol: UDP.
- Direction: inbound.
- Destination: the explicitly configured query-port number.
- Action: reject or deny.
- Game port: leave reachable for direct player connections.
Facepunch’s hidden-server guide says the Steam query port should be blocked at all times. A temporary test block followed by reopening the port defeats the purpose because the server can be discovered whenever the endpoint answers.
5. Give players the direct-connect details
Players who are allowed to join need the server’s public IP address and server.port, not the query-port number. In Rust’s client console, Facepunch documents the hidden-server connection form:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
client.connecthidden IP:PORT
Replace IP with the server address and PORT with the game port. A hidden server does not need to appear in the browser for this command to work; the game endpoint still has to be reachable.
6. Test from an allowed client
Run the direct-connect command from a trusted player account. If it succeeds, the game path is open while browser discovery is being suppressed. Test from a client that is not using a saved browser result when checking visibility, and do not use the query port in the connection command.
Hide visibility versus restrict access
Blocking discovery is not authentication. Anyone who learns the IP address and game port can still attempt a direct connection unless the server applies another access rule.
For a private server, Facepunch documents setting server.maxplayers 0 and granting approved users skip-queue access through global.skipqueueid. Configure the approved IDs using the current Facepunch procedure for your server version. The important distinction is that visibility and authorization are separate controls:
- The firewall rule prevents the Steam and Rust browsers from obtaining server metadata.
server.maxplayers 0and approved skip-queue identities provide an access policy for the people you intend to admit.- Neither setting substitutes for the other. A listed server can still be restricted, and a hidden server can still be open to anyone who discovers its address.
If you only want friends to join, send them the direct-connect address privately and use the access controls appropriate to your administration model. Do not publish the address in a stream overlay, public chat or community page unless unrestricted direct access is acceptable.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
What remains exposed and what no longer works
| Configuration | Browser visibility | How players connect | Administrative work | Metadata exposure |
|---|---|---|---|---|
| Query port reachable | Discoverable in Steam and Rust listings | Browser or direct connection | Normal firewall maintenance | A2S queries can return server name, player count, map and active-player information |
| Query port blocked | Not discoverable through the normal browser query path | Direct connection using the game IP and port | One explicit query-port firewall rule, plus normal game-port maintenance | Browser-based A2S discovery is interrupted; the game endpoint still exists |
| Query port blocked plus access controls | Not discoverable through the normal browser query path | Direct connection by approved users | Firewall configuration and permission or queue administration | Discovery is suppressed and unauthorized access is separately managed |
| Facepunch delisting | Removed or sanctioned by platform policy | Depends on the server’s remaining network access and policy status | Investigate policy and server health, not just local firewall settings | Not necessarily equivalent to an administrator-controlled hidden server |
Why blocking the query port works
The browser does not need a player to know your address in advance. Steam supplies candidate Rust servers, and the client then performs Source A2S queries against the returned addresses. Those queries ask the endpoint for the information displayed in the browser. If the query port does not accept inbound traffic, the discovery exchange cannot complete, so the server does not answer the normal listing request.
The game connection remains a different flow. A direct client connects to the game port, which is why the firewall rule must target only server.queryport. Blocking both ports would make the server unreachable rather than merely hidden.
Common mistakes and fixes
The server still appears in the browser
- Confirm that the configured value and the firewall rule use the same port number.
- Confirm the rule is for UDP inbound traffic. A TCP-only rule does not block the UDP query path.
- Check the provider-level firewall as well as the operating system firewall. A rule in only one layer may not match the traffic path you are using.
- Verify that
server.queryportis not being overwritten by a second launch parameter or configuration file. - Make sure the query port is blocked continuously, then check visibility again from a client that is not relying on an old browser view.
Friends cannot connect directly
- Use the game port, not the query port, in
client.connecthidden IP:PORT. - Check that the game port is reachable UDP and was not included accidentally in the deny rule.
- Verify the public IP address and the port currently used by the running server.
- If access controls are enabled, confirm that the player has the approved identity or permission required by your configuration.
The server is hidden, but strangers can still join
That result is expected when the firewall is the only control. Hiding removes the normal listing path; it does not create a whitelist. Add the documented access controls if direct connections must be limited.
The server vanished when you wanted it listed
First determine whether the disappearance is intentional. Check query-port reachability, the server’s responsiveness to Source A2S queries and the current Facepunch community-server policy status. An administrator firewall block and a platform policy delisting are different causes and require different remedies.
The query port was changed but discovery behavior did not change
Review the effective startup configuration and firewall destination together. Rust may derive a query-port default when you leave the convar unset, so blocking an assumed number can protect the wrong endpoint. Set the convar explicitly, restart, and then align the firewall rule with that value.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Privacy precautions for a direct-connect server
Direct connection requires sharing an address, so hiding the browser listing does not make the network identity secret. Facepunch recommends that Steam users set their presence to Invisible when operating a hidden server. It also warns that streams can expose IP and port details. If you demonstrate the server publicly, use an off-screen keybind for the direct-connect command when appropriate and keep the address out of visible overlays.
These measures reduce accidental disclosure; they do not replace the firewall or authorization settings. Anyone who obtains the address can attempt the same direct-connect command unless your access controls reject them.
Operational checklist
- Write down the active
server.port. - Select an unused UDP number that is different from the game port.
- Set
server.queryportexplicitly in startup parameters orserver.cfg. - Restart the server with that configuration.
- Reject inbound UDP traffic to the query port in the relevant firewall layer or layers.
- Leave inbound UDP traffic to the game port available.
- Give trusted players the public IP and game port.
- Test with
client.connecthidden IP:PORT. - If the server is private, configure the documented
server.maxplayers 0and approvedglobal.skipqueueidaccess model. - Keep Steam presence Invisible when appropriate, and prevent streams or overlays from revealing the connection details.
Administrator hiding versus Facepunch delisting
A hidden server is an intentional network configuration: the administrator blocks the query endpoint while keeping the game endpoint available. Facepunch policy is a separate authority. Community-server rule breaches can lead to browser delisting or other sanctions, and a policy action is not fixed by changing a local firewall rule.
When a previously listed server disappears, establish which situation you have. If you deliberately blocked the query port, the missing listing is the expected result. If you did not, inspect the port and firewall path, confirm that the server answers A2S queries, and review policy status before changing unrelated server settings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
