Rust Port Forwarding: Ports 28015, 28017 & Server Setup
Forward Rust UDP ports 28015 and 28017, fix a server that friends cannot join or find, and choose stable VPS or VPN hosting.
Quick answer
Forward UDP 28015 for Rust game traffic and a separate UDP query port—this guide uses 28017—to the host PC's reserved local IPv4 address. Allow both ports in the host firewall, launch RustDedicated with +server.port 28015 +server.queryport 28017, then test from another connection with F1 client.connect PUBLIC-IP:28015. For a world that should remain public and online, a VPS is the stronger route: Rust starts with a 12 GB free-RAM requirement, public listing needs two reachable UDP ports, and home hosting adds residential upload limits, CGNAT, changing IPs, router resets, and a PC that must stay awake. A VPS replaces those failure points with a stable public IPv4 address, an always-on service, predictable networking, and snapshots. A port-forwarding VPN is the lighter alternative when keeping the existing world on the home PC matters most.
Rust server ports: 28015, 28017, 28016, and 28082
A public Rust server needs two distinct UDP paths: 28015 for game traffic and a separate query port for Steam discovery. This guide sets UDP 28017 explicitly, which avoids an auto-selected query port changing when RCON settings change.
| Use | Protocol | Port | What to do |
|---|---|---|---|
| Game traffic | UDP | 28015 | Forward and allow; players connect here |
| Steam server query | UDP | 28017 | Forward and allow for the public server list |
| RCON (optional) | TCP | 28016 | Allow only from trusted administrator IPs |
| Rust+ companion app (optional) | TCP | 28082 | Open only when Rust+ is enabled |
Do not test the query port as if it were the game port
VPS, home forwarding, or a VPN?
Put a VPS first for Rust. Facepunch lists 12 GB of free RAM as the starting requirement and public discovery needs at least two inbound UDP ports. A VPS turns that into one stable public IPv4 address, an always-on process, predictable upload capacity, provider-side networking, and snapshots—without leaving a gaming PC awake or recovering rules after router and ISP changes. Home forwarding still fits a short private session; a port-forwarding VPN keeps that home-hosted world reachable behind CGNAT while hiding the residential IP.
| Path | Best fit | Concrete value | Join address |
|---|---|---|---|
| VPS dedicated server | A public or persistent Rust world | Stable public IPv4, 24/7 process, provider network, snapshots, and no residential upload bottleneck | VPS-IP:28015 |
| Home port forwarding | A short private session with public IPv4 | Keep the current machine and avoid a hosting bill | HOME-PUBLIC-IP:28015 |
| Port-forwarding VPN | Keeping the world at home behind CGNAT | A reachable VPN address without exposing the residential IP | VPN-IP:forwarded-port |
How to port forward a Rust server
Keep the launch arguments, firewall, router destination, and public join address aligned. The six-step path below also separates direct-connect failures from server-list failures.
Reserve the Rust host address
Create a DHCP reservation such as 192.168.1.50 so router rules continue to reach the correct PC after a reboot.
Allow both UDP ports in the firewall
Allow inbound UDP 28015 for players and UDP 28017 for Steam queries. Add TCP 28016 only if remote RCON is required.
Create two router mappings
Map external UDP 28015 and 28017 to the same internal ports at the reserved host address. Do not combine TCP and UDP unless the router forces it.
Set the game and query ports explicitly
Launch RustDedicated with +server.port 28015 and +server.queryport 28017. Explicit values prevent the query port from shifting with another service.
Test from outside the home network
Keep RustDedicated running and have a friend use F1 client.connect PUBLIC-IP:28015. A same-Wi-Fi public-IP test can fail without NAT loopback.
Publish and monitor the server
Keep the query port reachable for server-browser discovery, then monitor CPU, memory, disk, and upload during player peaks and wipe day.
Router rules
Replace the example host address.
Name: Rust Server Game
External port: 28015
Internal port: 28015
Protocol: UDP
Destination: 192.168.1.50
Name: Rust Server Query
External port: 28017
Internal port: 28017
Protocol: UDP
Destination: 192.168.1.50Windows firewall
Run in an elevated PowerShell.
New-NetFirewallRule -DisplayName "Rust UDP 28015 28017" -Direction Inbound -Protocol UDP -LocalPort 28015,28017 -Action AllowUbuntu firewall
Allow both required UDP paths.
sudo ufw allow 28015/udp && sudo ufw allow 28017/udpRust server not showing or friends cannot connect
A working LAN server, a working direct public connection, and a public server-list entry prove different layers. Match the symptom before changing a rule that already works.
Friends time out on client.connect
Confirm RustDedicated is listening on UDP 28015, the host firewall allows it, and the router rule still targets the reserved LAN address.
Direct IP works but the server is not listed
Keep the working game-port rule and correct UDP 28017, +server.queryport, server identity, and public-list configuration.
The ports still appear closed
Test while RustDedicated is running, then compare the router WAN IPv4 with the public IPv4 to reveal Double NAT or CGNAT.
The server stops working after a reboot
Restore the DHCP reservation, verify the host address, and run RustDedicated as a startup service with an automatic restart policy.
It works only on the same Wi-Fi
LAN play proves the game process works; the remaining path is the host firewall, router mapping, upstream NAT, or ISP edge.
RCON connects but players cannot join
RCON is TCP 28016 and does not carry game traffic. Players still need the separate UDP 28015 path.
Direct IP separates routing from discovery
client.connect PUBLIC-IP:28015 works, the game route is already healthy. Keep UDP 28015 unchanged and focus on UDP 28017, the explicit query-port argument, and public-list configuration.Host a Rust dedicated server on a VPS
A VPS gives Rust a stable endpoint and frees the home connection from continuous world traffic. Start above the official 12 GB free-memory floor, favor strong single-core performance and NVMe storage, then scale with players, entities, plugins, map size, and wipe-day demand.
| World | Starting CPU | Starting memory | Starting storage |
|---|---|---|---|
| Private test or small map | 4 fast vCPUs | 16 GB RAM | 50 GB NVMe |
| Small community server | 6 fast vCPUs | 24 GB RAM | 100 GB NVMe |
| Modded or late-wipe world | 8+ fast vCPUs | 32+ GB RAM | 200+ GB NVMe |
Minimal VPS launch path
Install with SteamCMD, open two UDP ports, and keep the process persistent.
- Deploy Ubuntu in a region near the players.
- Install Rust Dedicated Server with SteamCMD app ID 258550.
- Allow UDP 28015 and 28017 in the provider firewall and UFW.
- Launch with explicit game, query, RCON, identity, map, and world settings.
- Run through systemd, tmux, or Docker and schedule backups before updates and wipes.
SteamCMD and launch commands
Install or update first, then launch the named world.
steamcmd +force_install_dir ./rust +login anonymous +app_update 258550 validate +quit./RustDedicated -batchmode +server.port 28015 +server.queryport 28017 +rcon.port 28016 +server.identity "rust-main"Add +server.maxplayers, +server.hostname, map seed, world size, RCON password, and backup policy to the service configuration. Store secrets outside public repositories.
Best Rust server hosting VPS options
Choose Vultr first for broad regional coverage and a straightforward general-purpose cloud. Choose DMIT when China and Asia-Pacific routes matter most. Both give you the operating-system access needed for SteamCMD, Oxide/uMod, UFW, systemd, save transfers, and custom wipe schedules.
Vultr
- Founded in 2014 with more than 80 million cloud servers launched
- 33 global cloud data center regions for placing the server near players
- SOC 2 Type II and ISO/IEC 27001 compliance artifacts
- Public platform status page and incident history
DMIT
- Self-operated network with up to 7.6 Tbps of aggregate Tier 1 capacity
- Direct peering with China Telecom, China Unicom, and China Mobile International
- Current cloud instances advertise AMD EPYC processors and NVMe storage
- Los Angeles, Hong Kong, and Tokyo locations support regional deployment
Affiliate disclosure: We may earn a commission when you purchase through links on this page, at no extra cost to you.
Use a port-forwarding VPN while keeping Rust at home
A port-forwarding VPN creates an inbound route through CGNAT, keeps the existing world and plugins on the current PC, and replaces the residential IP players would otherwise receive. For a public server, PureVPN's selectable multi-port add-on can preserve separate game and query ports. Proton VPN and Private Internet Access provide an active assigned port that works well for a private direct-connect session when Rust is launched on that assigned port.
Proton VPN
- 100M+ accounts across the Proton privacy ecosystem
- Open-source VPN apps with public code
- Five consecutive annual independent no-logs audits
- 30-day prorated refund terms for eligible paid plans
PureVPN
- 3M+ users and 17+ years in cybersecurity
- Independent always-on no-log assessment model
- ISO/IEC 27001-certified information security program
- 31-day refund window for eligible initial purchases
Private Internet Access
- More than a decade in the VPN market
- Open-source desktop and mobile applications
- Three independent Deloitte no-logs reviews
- 30-day refund window for eligible purchases
Affiliate disclosure: We may earn a commission when you purchase through links on this page, at no extra cost to you.
Rust port forwarding FAQ
Direct answers to the port, protocol, server-list, dedicated hosting, CGNAT, and VPN questions people ask while getting a Rust world online.
Official and technical sources
Port, system-requirement, SteamCMD, firewall, and CGNAT details are grounded in publisher, platform, operating-system, and internet-registry documentation.
Official requirements, SteamCMD application ID, game/query/RCON ports, launch options, and connection commands
Authoritative Steam dedicated-server installation and update workflow
Authoritative Windows firewall administration guidance
Technical background from the Asia Pacific internet registry