What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a normal public Rust dedicated server, forward UDP 28015 for player traffic and UDP 28017 for server-browser queries. TCP 28016 is the default RCON port and is optional; TCP 28082 is the derived default for the Rust+ companion service. Forward only the features you use, send each rule to the server’s stable LAN address, and allow the same protocol through the host firewall.
Playing with friends? Godlike.Host runs hosted Rust servers from 10 data-center locations, with free DDoS protection.
Rust port map at a glance
These are Facepunch’s documented defaults for a single server whose game and RCON settings have not been changed. The values below reflect the official documentation checked on October 15, 2026.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Function | Setting | Default or derivation | Protocol | Forward it when |
|---|---|---|---|---|
| Player game traffic | server.port |
28015 | UDP | Always for players connecting from outside your LAN |
| Steam/server-browser queries | server.queryport |
28017 with the default game and RCON ports | UDP | The server should appear in the public browser |
| Remote administration | rcon.port |
28016 | TCP | Only when you use an RCON client |
| Rust+ companion service | app.port |
28082 with unchanged defaults | TCP | Rust+ is enabled |
The game and query ports must be different. Facepunch describes the query-port default as one above whichever is greater, server.port or rcon.port. With 28015 and 28016, that calculation produces 28017. Rust+ uses a separate calculation: the game port plus 67 or the RCON port plus 67, whichever is larger. The default result is 28082.
What each Rust port actually does
Player connections: server.port
This UDP endpoint carries the game traffic used by players. It is the only port required to connect and play on an externally reachable server. If this rule is missing, points to the wrong machine, or is blocked by a firewall, outside players cannot join even if the server process is running normally.
#1 Best Overall
- 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝐖𝐢-𝐅𝐢 𝟕 - Optimize performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, Samsung Galaxy S24 Ultra, and PS5 Pro with the latest WiFi 7 technology with Multi-Link Operation, Multi-RUs, 4K-QAM, and up to 320 MHz channels.◇△
- 𝟕-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐁𝐄𝟗𝟕𝟎𝟎 𝐓𝐫𝐢-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐒𝐩𝐞𝐞𝐝𝐬 - Delivers smooth 4K/8K streaming, immersive AR/VR gaming, and blazing-fast downloads with speeds up to 5,765 Mbps on the 6 GHz band, 2,882 Mbps on the 5 GHz band, and 1,032 Mbps on the 2.4 GHz band.⌂
- 𝐌𝐚𝐱𝐢𝐦𝐢𝐳𝐞𝐝 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 - Up to 2,600 sq. ft. coverage for up to 120 devices at a time. 6 optimally positioned antennas and Beamforming technology focus Wi-Fi signals toward hard-to-cover areas for stronger coverage-—ideal for those seeking the best WiFi router for large homes.
- 𝟏𝟎 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭 𝐟𝐨𝐫 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠𝐚𝐛𝐢𝐭 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐯𝐢𝐭𝐲 - Features 1x 10 Gbps WAN/LAN port, 1x 2.5 Gbps WAN/LAN port, and 3x 2.5 Gbps LAN ports. Integrate with a multi-gig modem for fast, wired gig+ internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Server-browser listing: server.queryport
The query endpoint answers the requests used by Rust’s server browser. A server can accept a direct connection while remaining absent from the listing if this UDP port is not forwarded, is blocked, or is accidentally the same as the game port. Opening it makes the server discoverable and allows query responses such as its name, player count, map information and active-player data to be returned.
RCON administration: rcon.port
RCON is a TCP control channel for remote configuration and administration. It is not needed for gameplay. Exposing it increases the attack surface, so forward it only if remote administration is part of your setup. Use a strong, unique RCON password and apply source-address restrictions when your router or firewall supports them.
Rust+ companion service: app.port
Rust+ uses a separate TCP service so the companion backend can reach your server. The port must be reachable from the internet and must be at least 10000. If Rust+ is disabled, there is no reason to create this forwarding rule.
Requirements before you create a forwarding rule
- A stable LAN address: Reserve an address for the server in the router’s DHCP settings, or configure a static address on the host. A rule tied to a changing DHCP address will eventually point at the wrong device.
- The actual Rust configuration: Check the launch script, service file or command line for
+server.port,+server.queryport,+rcon.portand+app.port. Forward the values Rust is using, not assumed defaults. - Router control: You need administrator access to the internet-facing router. If another router sits upstream, both devices may require rules.
- A publicly reachable connection: Carrier-grade NAT (CGNAT), a second upstream router, or an ISP restriction can prevent unsolicited inbound traffic even when your local rule is correct.
- Host-firewall access: The operating system firewall must permit the same inbound protocol and port as the router rule.
Facepunch’s routing model is straightforward: an outside player contacts your public IP and port; the router translates that request and sends it to the selected LAN IP. Port forwarding therefore has two separate parts—destination selection in the router and packet acceptance on the server.
How to forward the ports
- Reserve the server’s LAN address. In the router, open the DHCP or LAN section, locate the server by hostname or MAC address, and create a reservation. Rebooting the server should not change the reserved address.
- Create the game rule. In the router’s Port Forwarding, NAT, or Virtual Server page, add an inbound rule for the configured
server.port, choose UDP, set the destination IP to the reserved server address, and use the same destination port. This is the rule external players need. - Add the query rule for browser visibility. Create a second rule for
server.queryport, also UDP, aimed at the same LAN address. Skip this rule if you intentionally want a direct-connect or private server that is not listed. - Add RCON only when required. Forward
rcon.portas TCP to the server. Do not select “both” or “all” protocols when the router lets you choose the exact protocol. Restrict the source addresses to your administration network or VPN range if possible. - Add Rust+ only when enabled. Forward
app.portas TCP. Confirm that the chosen value is 10000 or higher and that no other application already owns it. - Save and apply. Some routers restart the firewall or NAT service after saving. Wait for that change to complete before testing.
- Permit the same traffic on the host. Add inbound firewall rules for the enabled UDP and TCP ports. A router rule cannot override a packet dropped by Windows, Linux, or another host firewall.
Use the router’s exact labels—some firmware calls the feature “Port Forwarding,” while others use “NAT Rules” or “Virtual Server.” Keep the external and internal port numbers identical unless you have a specific reason to translate them; if you do translate a port, players and every client must use the public value while Rust listens on the internal value.
Example configuration and startup values
A default-style launch command can explicitly show the intended values:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #3
- 𝐀𝐂𝟏𝟐𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢𝐅𝐢 𝐑𝐨𝐮𝐭𝐞𝐫 𝐟𝐨𝐫 𝐇𝐨𝐦𝐞 — Ideal for gaming, 4K streaming, downloading and more with Wi-Fi speeds up to 1.2 Gbps (867 Mbps on 5 GHz band and 300 Mbps on 2.4 GHz band)
- 𝐅𝐮𝐥𝐥 𝐆𝐢𝐠𝐚𝐛𝐢𝐭 𝐏𝐨𝐫𝐭𝐬— The Gigabit WiFi Router with 3 Gigabit ports, ideal for any internet plan and allow you to directly connect your wired devices creates fast, reliable wired connections for your PCs, Smart TVs, and gaming consoles
- 𝐒𝐭𝐫𝐨𝐧𝐠 𝐖𝐢𝐅𝐢 𝐒𝐢𝐠𝐧𝐚𝐥 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞— Equipped with Four Powerful 6dbi Antennas and Beamforming technology, wireless router AC6 delivers high speed internet throughout your home
- 𝐄𝐚𝐬𝐲 𝐒𝐞𝐭𝐮𝐩 𝐢𝐧 𝐦𝐢𝐧𝐮𝐭𝐞𝐬 𝐰𝐢𝐭𝐡 𝐀𝐏𝐏 — The Tenda Wi-Fi APP helps you to setup, monitor, & manage your home or guest network easily & quickly. You can monitor the network status & schedule Internet access for your children via built-in parental controls
- 𝐀𝐜𝐜𝐞𝐬𝐬 𝐏𝐨𝐢𝐧𝐭 𝐌𝐨𝐝𝐞 — Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
+server.port 28015 +server.queryport 28017 +rcon.port 28016 +app.port 28082Do not paste this blindly into a server that already defines different values. The forwarding rules must follow the effective settings loaded at startup. If server.queryport is omitted, Rust calculates it from the larger of the game and RCON ports; setting it explicitly can make the router configuration and troubleshooting easier.
Testing in the right order
- Test direct player access first. From a device outside the server’s LAN—such as a different internet connection—connect using the public IP and game port. A successful join proves the game path, NAT rule and host firewall are working together.
- Check browser visibility next. If direct access works, search for the server in Rust’s browser. Absence at this stage points to the query setting, its UDP rule, or a query port that duplicates the game port.
- Test RCON independently. Use your RCON client with the public address, configured TCP port and password. Keep this test separate from gameplay so a successful join is not mistaken for working administration.
- Test Rust+ last. Verify that the companion service is enabled, its TCP rule is active, and the backend can reach the selected port from the internet.
Testing from the same LAN can produce misleading results because some routers do not support NAT loopback. When an internal test fails, repeat it from an external network before changing a working rule.
Troubleshooting by symptom
Players cannot connect
- Confirm the running server’s
server.portand protocol. The game path is UDP, not TCP. - Check that the router forwards that UDP value to the current reserved LAN address, with no typo in either port field.
- Inspect the host firewall for an inbound UDP allow rule tied to the server application or port.
- Look for CGNAT or double NAT. If the router’s WAN address is private or differs from the public address shown by an external service, inbound forwarding may stop at the ISP or an upstream router.
- Check for another router, modem-router combination, mesh gateway or managed firewall between the server and the public internet. Each routing layer must either be bridged or configured to pass the traffic onward.
Players can connect, but the server is missing from the browser
- Verify that
server.queryportis set or correctly derived and is different fromserver.port. - Forward the query value as UDP to the same server address.
- Allow that UDP traffic through the host firewall.
- If privacy is intentional, do not treat non-listing as a fault: blocking the query port is the documented way to reduce discoverability.
RCON does not work
- Confirm the RCON service is enabled and that the client is using the configured
rcon.port. - Use TCP in both the router and host-firewall rules; a UDP rule will not carry RCON sessions.
- Recheck the password and any
rcon.websetting used by the server configuration. - Make sure the router rule is actually enabled and reaches the host running Rust. Restricting the source network too aggressively can also block your own client.
Rust+ remains offline
- Confirm
app.portis enabled, uses TCP, and is at least 10000. - Forward it to the Rust host and permit it through the host firewall.
- Check for CGNAT, double NAT or an upstream firewall that prevents the Rust+ backend from initiating a connection.
- Ensure another service is not already using the selected companion port.
Public, private and LAN-only configurations
| Configuration goal | Player access | Discoverability | Administration | Companion features |
|---|---|---|---|---|
| Public community server | Forward the game UDP port | Forward the query UDP port for browser listing | Expose RCON TCP only if needed; protect it | Forward Rust+ TCP only if enabled |
| Private internet server | Forward the game UDP port | Use a nonstandard setup and block the Steam queryport as recommended by Facepunch’s hidden-server guidance | Keep RCON local or restrict its source addresses | Enable only if the companion service is required |
| LAN-only server | No internet port forwarding; players use the LAN address | No public browser exposure | Administer locally unless you deliberately add a protected remote path | No internet rule unless Rust+ is required |
A private server is not made private merely by changing numbers. Nonstandard ports reduce casual discovery, but firewall source restrictions, blocking the query service and limiting administrative access provide the meaningful controls. Facepunch notes that query responses can reveal the server name, player count, map information and active players.
Rank #4
- 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 𝐰𝐨𝐫𝐤𝐡𝐨𝐫𝐬𝐞 𝐭𝐡𝐚𝐭'𝐬 𝐫𝐞𝐚𝐝𝐲 𝐟𝐨𝐫 𝐭𝐨𝐦𝐨𝐫𝐫𝐨𝐰 – Delivering high-capacity tri-band lanes, the Wi-Fi 7 Archer BE770 combines 10 internal antennas, an open 6 GHz band, and a future-ready 10G WAN/LAN port for busy, connected homes.
- 𝐁𝐄𝟏𝟖𝟎𝟎𝟎 𝐭𝐫𝐢-𝐛𝐚𝐧𝐝 𝟏𝟎-𝐬𝐭𝐫𝐞𝐚𝐦 𝐖𝐢-𝐅𝐢 𝟕 𝐫𝐨𝐮𝐭𝐞𝐫 - Delivers up to 11528 Mbps (6 GHz), 5764 Mbps (5 GHz), and 688 Mbps (2.4 GHz) speeds for 4K/8K streaming, AR/VR gaming & more.◇**△ Performance varies by conditions, distance, & obstacles such as walls.
- 𝟏𝟎 𝐆𝐛𝐩𝐬 𝐬𝐭𝐚𝐲𝐬 𝐚𝐡𝐞𝐚𝐝 𝐚𝐬 𝐲𝐨𝐮𝐫 𝐢𝐧𝐭𝐞𝐫𝐧𝐞𝐭 𝐠𝐫𝐨𝐰𝐬 - Features a 10 Gbps WAN/LAN port to maximize multi-gig internet plans. An additional 10 Gbps WAN/LAN port and four 1 Gbps LAN ports provide fast connections to PCs, consoles, NAS, and switches.§
- 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐟𝐨𝐫 𝐞𝐯𝐞𝐫𝐲 𝐜𝐨𝐫𝐧𝐞𝐫 - Covers up to 3,600 sq. ft. for up to 150 devices at a time. 10 internal antennas and beamforming technology focus Wi-Fi signals toward hard-to-reach areas. Seamlessly connect phones, TVs, and gaming consoles.△
- 𝐒𝐢𝐦𝐩𝐥𝐞 𝐬𝐞𝐭𝐮𝐩 & 𝐞𝐚𝐬𝐲 𝐜𝐨𝐧𝐭𝐫𝐨𝐥 - Quickly set up and manage your Archer BE770 with the free Tether App. Keep your WiFi performing at its best by keeping the firmware updated through the App. All Wi-Fi routers require a separate modem.
Changing the defaults without breaking connectivity
Changing ports is useful when several Rust servers share one public IP, when another service already occupies a value, or when you want a less predictable external layout. Every server still needs a unique game port, and its query port must remain different from its game port.
- Choose an unused value for each service and record the protocol beside it.
- Set the values in the server’s startup parameters or configuration.
- Calculate or explicitly set
server.queryport; do not assume the old derived value remains valid. - For Rust+, keep
app.portat 10000 or higher and recalculate it if you rely on the documented default formula. - Update the router and host-firewall rules to match the new values.
- Restart the server, then repeat external tests for gameplay, listing, RCON and Rust+ separately.
For multiple servers behind one public address, each instance needs distinct externally reachable game and query endpoints. RCON and Rust+ values must also be unique where services would otherwise collide. A forwarding rule aimed at the wrong instance can look like a firewall failure even though the packets are arriving.
Network edge cases that forwarding cannot solve alone
CGNAT
With CGNAT, the ISP shares one public IPv4 address among customers and does not give your router control of the inbound translation. You can create local rules correctly and still receive no outside connections. Ask the ISP for a public address, request a suitable service option, or run the server on infrastructure that permits inbound forwarding.
Double NAT and multiple routers
If a modem, gateway and personal router all perform NAT, the first device may need to forward the traffic to the second, which then forwards it to the server. Putting the upstream device in bridge mode is often simpler when supported. Verify which device owns the public address before editing rules.
Recommended Free Tools
Changing LAN addresses
A working rule can silently fail after a DHCP lease changes. A reservation is preferable to repeatedly editing the destination IP, especially for a server that should remain available through wipes or restarts.
Quick Recap
Security checklist
- Open only the services you use. Gameplay does not require RCON or Rust+.
- Use UDP for the game and query services, and TCP for RCON and Rust+.
- Set a strong, unique RCON password and avoid publishing it in scripts, screenshots or chat.
- Limit RCON source addresses or place administration behind a VPN where your equipment supports it.
- Keep the server operating system, router firmware and Rust server software updated.
- Review router rules after changing hosts, ports or server instances; remove stale entries.
- For a private server, block the query service and use nonstandard ports as part of a broader access-control plan.
Quick decision checklist
- Need players from the internet? Forward the configured game port as UDP.
- Need the public server browser? Add the distinct query port as UDP.
- Need remote console administration? Add the RCON port as TCP, then restrict and protect it.
- Need Rust+? Add the companion port as TCP, keep it at least 10000, and confirm internet reachability.
- Only playing on a home network? Use the LAN address and avoid public forwarding.
- Rules look correct but nothing is reachable? Investigate CGNAT, double NAT, the host firewall and the server’s actual startup parameters before changing ports.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
