Whether you are kicking a cheater at 3 AM, saving the map before a restart, or teleporting a stuck player out of a rock, you do it through the same place: the Rust server console. There are two ways to reach that console — the in-game F1 console and remote RCON — and once you understand how they connect, the entire administration surface of a Rust dedicated server opens up. This is a complete, no-fluff reference to Rust’s WebRCON system, the convars that make it work, and the day-to-day commands every admin needs.
WebRCON: how Rust’s remote console actually works
Unlike most Source-engine games, Rust does not use the legacy TCP-based Source RCON protocol. Instead, it ships WebRCON — a WebSocket-based remote console. Facepunch maintains the official, open-source web client at facepunch.github.io/webrcon (source on the Facepunch/webrcon GitHub repo). You point it at your server’s IP address, RCON port, and RCON password, and it opens a persistent websocket to the server. Because the connection details are embedded in the URL, you can hand that URL to a co-admin, who is then prompted for the password before they can issue commands.
Three convars govern whether RCON works at all. Get these right and you can administer the server from any browser; get them wrong and you are locked out of remote management entirely.
| Convar | Default / Example | What it does |
|---|---|---|
rcon.port | 28016 | The TCP port the WebRCON websocket listens on. Default is equal to server.port — in practice that means server.port + 1, which is why 28016 pairs with the default game port 28015. |
rcon.password | (none — must set) | The password the WebRCON client must supply. The wiki’s exact note here is “Change this value!!!” — if you leave it empty, RCON is effectively unusable and insecure. |
rcon.web | 1 | Selects the protocol. 1 = WebSocket/WebRCON mode (the recommended setting); 0 = legacy mode. The wiki explicitly suggests rcon.web 1. |
server.port | 28015 | The UDP port for actual game traffic. This is separate from the RCON port — players connect here, admins connect to the RCON port. |
One critical networking detail: server.port (28015) is UDP for game traffic, while rcon.port (28016) is a TCP/WebSocket port. If your firewall or hosting panel only forwards one of them, you will see the symptom of “players can join but RCON won’t connect” (or vice versa). Both must be open.
F1 console vs RCON: same commands, different door
This trips up a lot of new admins, so let’s be precise. The in-game F1 console and RCON share the same command surface. A command like status, server.save, or a kick/ban works identically whether you type it into F1 while logged into the game with an auth level, or send it through a WebRCON client.
- F1 console — requires you to be in-game with an admin/owner auth level. Convenient for quick in-the-moment fixes while you’re playing.
- RCON — lets you run those same commands remotely, without ever loading into the game. This is how you manage the server from your phone, a panel, or a script.
There’s an equally important distinction between where you set convars. The official guidance is blunt: “Set only necessities like ports or rcon on the command line. If you want to change a bunch of variables a good option is creating a server.cfg file.” The server reads server.cfg at startup, and it takes priority over command-line settings. The takeaway that catches people out: server.* convars are set via the command line or server.cfg, NOT typed into in-game chat.
Here is the canonical launch line from the wiki, showing how ports and core world settings are passed at startup:
RustDedicated.exe -batchmode +server.port 28015 +server.level "Procedural Map"
+server.seed 1234 +server.worldsize 4000 +server.maxplayers 10
+server.hostname "Name of Server" +server.description "Description"If you’d rather not wrangle launch flags by hand, a managed Rust server hosting plan exposes these convars in a control panel and handles WebRCON port forwarding for you — but everything below works identically on a self-hosted box.
The essential server.* convars
These are the convars you’ll touch most, almost all of them set in server.cfg or on the launch line:
server.hostname— the server name shown in the browser.server.description— the description shown on the server’s info panel.server.maxplayers— the player slot cap (wiki example:10).server.identity— creates the server’s directory/save structure (wiki example:"server1"). Changing this effectively points the server at a different save folder.server.seed— the procedural map seed, any integer.server.worldsize— the map dimensions.server.level— the map type to load.server.port— the UDP game port.
Two convars you’ll see referenced elsewhere — server.tickrate and server.saveinterval — are not documented on the official “Creating a server” wiki page. They do exist (tickrate is discussed under performance below), but treat any exact default you read for them with healthy skepticism and confirm against current docs.
Day-to-day admin commands
Seeing who’s online: status, players, playerlist, users
The workhorse is status. It prints a server header (hostname, version, map, player counts) followed by one row per connected player. The columns are:
- ID — the player’s SteamID64 (a 17-digit number such as
76561197854018763). - Name — Steam profile name.
- Ping · Connected (seconds) · Addr (IP address).
- Owner — auth level · Violation — anti-cheat violation level · Kicks.
You have three more ways to list players, each suited to a different job:
players— a tabular list with columns ID, Name, Ping, Snap, Update, Posi, Dist. Names over 15 characters are truncated to 14.playerlist— returns an array of hashes (JSON-like), built for web apps. Per-player keys include SteamID, OwnerSteamID, DisplayName, Ping, Address, ConnectedSeconds, ViolationLevel, CurrentLevel, UnspentXp, and Health. The Owner auth value is2for owner and1for moderator.users— connected players in the format:" "
A note on a command you may see floating around forums: global.players is not a reliable, documented way to list players. Stick to the four verified commands above. For a deeper walkthrough of reading the output and spotting suspicious connections, see our guide on how to see who is on your Rust server.
Saving, kicking, banning, and ownership
The SteamID64 in the ID column is the key to almost every moderation action. Owner and moderator assignment both key off it:
# Force a world save (always do this before a restart)
server.save
# Grant / remove owner-level admin by SteamID64
ownerid 76561197854018763 "PlayerName" "reason"
removeowner 76561197854018763
# Kick and ban
kick "PlayerName"
ban "PlayerName"Run server.save before any planned restart so progress isn’t lost between the last autosave and shutdown. The teleportpos family of commands moves a targeted player to a coordinate — handy for extracting someone stuck inside terrain. The exact vanilla moderator-assignment command beyond ownerid/removeowner varies, so if you want a tiered staff structure, that’s usually handled through the permissions system of a modding framework rather than raw convars.
Changing the map via console
The world your server generates is controlled by four convars. Note the verified ranges — out-of-range values either fail or behave unpredictably.
| Convar | Value / Range | Notes |
|---|---|---|
server.seed | 0 – 2147483647 | Any integer in this range. The seed shapes the procedural terrain layout. |
server.worldsize | 1000 – 6000 (wiki example 4000) | Roughly km² scaling — a 3000 worldsize is about 9 km². 4500 is a popular community choice but is not a documented default. |
server.level | map name string | Documented value is "Procedural Map". In practice "Barren", "HapisIsland", "SavasIsland" (and SavasIsland_koth) also work. CraggyIsland is a legacy/dev map and is generally not recommended for live servers. |
server.levelurl | direct .map download URL | Used for custom maps instead of seed/worldsize. |
Custom maps have strict rules. server.levelurl is described as “the most important server parameter” for them — the server downloads the map from that URL, and so do clients (not from the game server itself), so it must be a direct download link hosted on a publicly accessible, 24/7 server. A click-through landing page won’t work. Crucially, when using a custom map you must remove server.worldsize and server.seed from your config, because they conflict with custom map loading. The local form file:///path/to/cool.map works for single-machine testing but prevents other players from connecting.
Does changing the map wipe the server? Altering server.seed, server.worldsize, server.level, or server.levelurl changes the generated/loaded world, which invalidates the existing map save — every structure, deployable, and placed entity is effectively wiped because they no longer correspond to valid terrain. Player blueprints, however, are a separate save and are not necessarily reset by a map change alone; they survive unless you also clear the blueprint/player data. The full step-by-step is in our dedicated guide on changing the map on your Rust server.
Going further: Oxide, Carbon, and permissions
Vanilla convars only take you so far. To do anything beyond the built-in command set — custom kits, economies, gather rates, GUI admin menus — you install a modding framework. There are two:
- Oxide / uMod — the long-established framework with the largest plugin library (1,400+ plugins on uMod). Plugins live in
oxide/plugins/(.csfiles), configs inoxide/config/(.json), data inoxide/data/, logs inoxide/logs/. - Carbon — a modern framework that the official wiki describes as “a modern modding framework… responsible for handling background operations and running custom plugins and extensions with maximum performance.” It offers “seamless migration from Oxide with identical folder structure and automatic data migration tools” and “uses Harmony and does not require any additional patches to run existing Oxide plugins.” Because the folder structure is identical, plugins go in the Carbon equivalents of the Oxide paths. Community testing reports ~99% Oxide-plugin compatibility and dynamic hook loading for lower RAM/CPU use.
Permissions work the same in both. Two default groups are created automatically — admin (where admins land) and default (everyone else) — and permission nodes follow the format pluginname.permission (e.g. vanish.allow). The core command syntax:
# Grant / revoke to a USER (player name OR SteamID64)
oxide.grant user 76561197854018763 vanish.allow
oxide.revoke user PlayerName vanish.allow
# Grant / revoke to a GROUP
oxide.grant group admin coolplugin.use
oxide.revoke group admin coolplugin.use
# Create / delete a group, set title+rank, set inheritance
oxide.group add supporters
oxide.group set supporters "[Server Supporters]" 1
oxide.group parent tier_2 tier_1
# Add / remove a user to/from a group
oxide.usergroup add PlayerName supporters
oxide.usergroup remove PlayerName supporters
# Inspect
oxide.show groups
oxide.show group admin
oxide.show perms supportersCarbon accepts the exact same oxide.* command surface and adds the short o. alias (e.g. o.grant, o.reload), which also works on Oxide; Carbon’s native reload is carbon.reload. Wildcard syntax like pluginname.* is used in practice but behaves on a per-plugin basis, so verify it for each plugin rather than assuming. Our full breakdown lives in the guide to setting plugin permissions on your Rust server, and our top admin plugins roundup covers staples like AdminMenu, Vanish, and RemoverTool.
Frequently asked questions
What is the default Rust RCON port?
The default RCON port is 28016. By default rcon.port equals server.port, and since the default game port (server.port) is 28015, the RCON port lands at 28016 in practice. Remember that 28015 is a UDP game port while 28016 is a TCP/WebSocket port — both must be open in your firewall.
How do I connect to Rust RCON from a browser?
Use Facepunch’s official WebRCON client at facepunch.github.io/webrcon. Enter your server IP, the RCON port (28016 by default), and your rcon.password. Make sure rcon.web 1 is set on the server so it speaks the WebSocket protocol. The resulting connection URL can be shared with another admin, who will be prompted for the password.
What’s the difference between the F1 console and RCON?
They run the same commands. The F1 console requires you to be in-game with an admin auth level, while RCON lets you send those commands remotely without loading into the game. One key rule applies to both: server.* convars are set via the command line or server.cfg at startup, not typed into chat.
How do I see a list of players and their SteamID64s?
Run status for the most complete view — its ID column is the SteamID64 (a 17-digit number) you’ll use for owner/ban actions. players gives a compact table, playerlist returns JSON-like data ideal for web apps, and users outputs global.players — it isn’t a documented, reliable command.
How do I change the gather rate through RCON?
You can’t with vanilla convars — Rust has no built-in gather-rate multiplier. You must install a plugin, with GatherManager being the de facto standard. Its commands take the form gather.rate , for example gather.rate dispenser Wood 10. See our guide on modifying the gather rate for the full setup.
My plugins stopped loading after an update — what happened?
A Facepunch update (such as the monthly force wipe) overwrites Oxide and Carbon files, so you must reinstall the framework after every update before plugins will load again. On force-wipe day Carbon is typically patched within hours, which matters for capturing the first-online player rush. Our coverage of the Built Different update for server admins walks through the post-wipe reinstall sequence.
For panel-specific steps, port forwarding, and screenshots of the WebRCON workflow on a live server, see our Rust hosting documentation. Master status, server.save, and the permission commands above, and you’ll handle the vast majority of admin work without ever leaving the console.
Free Rust Tools
Speed up your server with our free Rust tools:
Ready to play?
Run your own Rust server with XGamingServer
Spin up an always-on Rust server your friends can join in minutes — no port-forwarding, no tech headaches.
