How to port forward a Rust server
Rust needs its game port on UDP and, if you want to appear in the server browser, the query port two numbers above it. People connect over UDP only — a TCP rule on the game port is a rule that nothing will ever use.
Your setup
Pick the firmware family, not the exact model — the menus are identical across a range.
Default is 28015. If you changed it, it is the value of +server.port.
The private address of the machine running the server — ipconfig on Windows, ip addr on Linux. It starts with 192.168, 10. or 172.
Open these
This firmware accepts ranges, so each line below is a single rule.
- 28015 UDP
- 28017 UDP
28015UDPGame trafficRust is UDP-only for gameplay. A TCP-only rule looks correct in the router and connects to nothing.28017UDPServer browserserver.queryport, which defaults to game port + 2. Without it your server never appears in the browser, though people can still connect directly.
Only if you want them
The server works without these. Every port you open is a port someone can knock on, so skip anything you do not need.
- 28082 TCP
28082TCPRust+ companion appOnly if you want the mobile app to pair. Safe to leave closed.
Do not open these
These are administrative sockets. Plenty of guides list them next to the game ports; opening them puts a remote console for your server on the public internet.
28016TCPRCONrcon.port. A forwarded Rust RCON port is scanned within hours — it is one of the most actively probed ports in gaming.
If you need remote administration, reach the machine over SSH or a VPN and talk to the port from there. The port stays closed to everyone else.
Step by step: your router
- 1
Give the server a fixed local IP
A forward points at one address. If the server picks up a different one after a reboot, the rule silently starts pointing at nothing — this is why forwards "stop working" on their own.
On this router:look for DHCP Reservation, Address Reservation, Static Lease or Manually Assigned IP
- 2
Open the router admin page
Try these addresses in a browser on the same network:
- 192.168.0.1
- 192.168.1.1
- 192.168.2.1
- 10.0.0.1
Almost always printed on a sticker on the router itself.
- 3
Find the port forwarding page
Port Forwarding, Virtual Server, NAT, Applications & Gaming, or Port Mapping
Vendors use at least six names for the same feature. Whatever it is called, the page you want is the one asking for a port, a protocol and a device on your network. If the external and internal port fields both exist, set them to the same number.
- 4
Create one rule per line
a description field, if there is one External / WAN / Public / Service port Internal / LAN / Private port Protocol Internal IP / Device / Server IP Rust 28015 28015 UDP your server’s local IP Rust 28017 28017 UDP your server’s local IP External and internal port are the same number here. Changing the external port is possible, but then everyone connects on the new one, so keep them matched unless you have a reason.
- 5
Let the server through its own firewall
The router now sends traffic to the machine, and the machine can still refuse it. Windows Defender Firewall in particular blocks a freshly installed dedicated server by default, which looks exactly like a failed forward.
Take it with you
Rust — port forwarding rules ---------------------------- 28015 UDP -> <server local IP> 28017 UDP -> <server local IP>
Check whether it worked
Test from outside your own network. Connecting from a machine in the house proves nothing — that traffic never leaves the LAN and never touches the rule you just wrote.
What usually goes wrong
The port one above your game port is RCON, and it should stay closed. Rust RCON is one of the most heavily scanned services in gaming: a newly exposed one typically starts receiving login attempts within hours. If you need remote administration, reach the machine over SSH and connect to RCON from there, so the port is never open to anyone else.
Not forwarding at all
Rust servers are demanding enough that most people who get past the port forwarding stage run into the next wall immediately, which is that a home connection's upload bandwidth cannot carry a populated wipe. Hosting on a machine with a real uplink removes both problems at once.