rcon.port (Rust server ConVar)

rcon.port is the TCP port the server's RCON listener opens. RCON tools, bots and panels connect to it to run console commands. The server's help text: "Port to listen for RCON connections".

Set it on the command line

Pass it as a startup argument, next to the other ports:

+server.port 28015 +rcon.port 28016 +rcon.web 1

The listener starts once, early in boot. On our test server the log prints WebSocket RCON Started on :28016 once per start, about two seconds after Server Config Loaded. We treat a new RCON port as a restart: change the argument, restart, and connect to the port in that log line. The Facepunch wiki also says to keep ports and RCON settings on the command line. server.writecfg does not save any rcon. value; our test server's serverauto.cfg has none.

TCP, not UDP

The game port and the query port are UDP. rcon.port is TCP. A firewall rule or port forward for the wrong protocol is the classic reason a tool times out without an error. Check what the server really opened:

ss -ltnp | grep 28016

Keep this port closed to the internet. WebRCON as Panelra and common tools use it is plain ws:// with the password in the URL, so use it from the host, over an SSH tunnel, or allow only fixed IPs of a tool that needs it.

It moves other defaults

The Facepunch wiki gives the default RCON port as equal to server.port, which is one reason to always set it. It also feeds two other defaults:

• the query port defaults to one above the higher of server.port and rcon.port;
• the Rust+ port (app.port) defaults to 67 above the higher of the two.

So moving RCON to a high number without setting +server.queryport and +app.port can move those ports too, and your firewall rules no longer match. Set all four explicitly.

Several servers on one host

Every server needs its own RCON port; the second process cannot open a port the first one holds. In Panelra the game, RCON, query and Rust+ ports are under Settings > Network ports, marked as needing a restart. The agent writes them into the server's systemd unit and rewrites the unit on the next start when they change.