Rust Server DDoS Protection: Wipe Day, RCON and Ports

Run a public Rust server for a few wipes and a pattern can appear: quiet all week, then lag spikes or a full disconnect in the first hours after the map resets, just as players choose where to spend the cycle. Rust server DDoS protection is mostly about that window. Floods have to be dropped before they reach your link, and what an attacker can reach without a flood — RCON, the query port, a website on the same address — has to be closed by you.

This post covers why wipe day draws attacks, what Noded's included 100 Gbps of Layer 3/4 protection removes and what stays your job, Rust server ports and a matching firewall, RCON security, sizing and the null-route rule, and a wipe-day checklist. Ports and convars come from Facepunch's wiki; for general sizing, see our Rust and Palworld hosting post.

Why Rust servers get hit hardest around wipe day

Rust runs in wipe cycles: weekly, biweekly or monthly, the map resets and everyone starts again with nothing. Once a month Facepunch forces a wipe with its update, and the wiki's wipe timer defaults to that slot: 19:00 London time on the first Thursday. Three things make the hours after a wipe expensive:

• Population is decided early. Players pick a server for the cycle in the first hours. One that is unreachable at wipe loses them to whichever server is up.
• Raids create grudges. A group that lost its base, a banned cheater, a clan that wants the map to itself: Rust produces people with a reason to knock a server offline.
• Rival servers compete for the same players. In Cloudflare's 2025 Q2 DDoS report, 63% of customers who identified their attacker named a competitor, "especially common in the Gaming, Gambling and Crypto industries".

There is no public dataset on wipe-day timing, so treat this as reasoning. But Facepunch's own hidden-server guide exists to help owners avoid denial-of-service attacks.

What included Rust server DDoS protection removes, and what stays your job

Every Noded KVM VPS and dedicated server comes with 100 Gbps of always-on DDoS protection at Layers 3 and 4, at no extra cost. Attack traffic is filtered upstream, before it reaches your server's port, while clean traffic keeps flowing. It covers UDP floods, DNS and NTP amplification and SYN floods, with nothing to enable and no ticket to open.

Most attacks are small, and it still matters. Cloudflare's H1 2026 report found 96.62% of network-layer attacks stayed under 500 Mbps and 90.60% ended within ten minutes. Small is relative: 500 Mbps is more than twice a VPS IV's 220 Mbps ceiling, and ten minutes is a lost raid, over before anyone could read a ticket.

What the included tier does not do is understand Rust. It is not game-aware or Layer 7, so these stay with you:

• The host firewall: which ports answer, and a rate limit on the query port.
• RCON: a guessed or sniffed password is full control, no flood required.
• Plugins, cheaters and griefers: Oxide/uMod or Carbon, admin tools, bans. No plugin stops a flood; a flood fills the link before the game sees a packet.
• Capacity: real players still have to fit your VPS's network ceiling and CPU.

Rust server ports, and a firewall that opens only those

A Rust server uses four ports. Two defaults are derived from the others, so changing one moves the rest; set all four explicitly.

Convar	Default	Protocol	Used for	Who should reach it
server.port	28015	UDP	Game traffic	Everyone
server.queryport	1 + the larger of server.port and rcon.port	UDP	Server browser, Steam queries	Everyone, rate-limited; nobody on a private server
rcon.port	Same number as server.port	TCP	Remote console (WebRCON)	Nobody from outside
app.port	67 + the larger of server.port and rcon.port (28082 if untouched)	TCP	Rust+ companion app	Everyone, if you use Rust+

The query port must differ from the game port, and Facepunch's Rust+ companion server page says the app port must be 10000 or higher; +app.port 1- switches Rust+ off entirely. Install with SteamCMD as app 258550, anonymous login, as the wiki's Creating a server page shows, then pin the ports on the RustDedicated line of the runds.sh script it installs:

./steamcmd.sh +force_install_dir /home/rust/server +login anonymous +app_update 258550 validate +quit

./RustDedicated -batchmode \
  +server.port 28015 +server.queryport 28017 \
  +rcon.ip 127.0.0.1 +rcon.port 28016 +rcon.web 1 +rcon.password "long-random-secret" \
  +app.port 28082 +server.identity main -logfile rust.log

On Debian with nftables, this /etc/nftables.conf opens SSH, the game, the query port and Rust+, nothing else. Lock SSH to keys first, as in our server hardening checklist.

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
  set rust_query {
    type ipv4_addr
    flags dynamic
    timeout 10s
    size 65536
  }

  chain input {
    type filter hook input priority 0; policy drop;
    iif "lo" accept
    udp dport 28017 add @rust_query { ip saddr limit rate over 20/second burst 40 packets } counter drop
    ct state established,related accept
    ct state invalid drop
    meta l4proto { icmp, ipv6-icmp } accept
    tcp dport 22 accept
    udp dport { 28015, 28017 } accept
    tcp dport 28082 accept
  }
}

Load it with sudo systemctl enable --now nftables. The query rule sits above the conntrack line because a UDP flow counts as established once the server replies, and would skip the limit. Twenty a second per address is deliberately loose, since carrier-grade NAT puts many players behind one address; if players can't find the server in the browser, raise it. On ufw, the equivalent goes in /etc/ufw/before.rules, above the ESTABLISHED line:

-A ufw-before-input -p udp --dport 28017 -m hashlimit --hashlimit-name rustq --hashlimit-mode srcip --hashlimit-above 20/second --hashlimit-burst 40 -j DROP

Don't put a global cap on the query port: in a spoofed flood it would drop real players' queries too, and that flood is upstream filtering's job. Don't rate-limit the game port either; players send packets continuously, and Rust has its own per-client limits in the server.maxpacketspersecond convars.

Rust RCON security and the addresses you give away

RCON is full control: any console command, the owner and ban lists, the save. With rcon.web 1, which the wiki suggests, it is a WebSocket over TCP, and Facepunch's web console connects to ws://address/password, password in the URL, unencrypted.

• Bind it to loopback with +rcon.ip 127.0.0.1, as above, and reach it through ssh -N -L 28016:127.0.0.1:28016 rust@your-server, pointing your RCON client at 127.0.0.1:28016. A WireGuard tunnel works too.
• Use a long random rcon.password, not the wiki's example letmein, and rotate it when staff leave.
• If a hosted tool must reach RCON, allow only the addresses its operator gives you. A Discord player-count bot in query mode, or one on the same VPS using loopback, needs no open RCON.
• Add a second lock on Oxide: uMod's Limit RCON plugin refuses RCON connections from unlisted addresses. Access control, not flood protection.

The game address itself is public by design: the server browser, trackers such as BattleMetrics and players' Steam profiles show it. The goal is making it the only thing on that address.

• Website and store elsewhere. A site on the game VPS points DNS straight at it, and HTTP floods are Layer 7, outside the included tier. Host it separately, behind a reverse proxy or CDN.
• Private and staging servers stay private. The hidden-server guide suggests non-standard ports, a blocked query port to stay out of the Steam master list, staff set to Invisible on Steam, and streamers joining via a client.connecthidden keybind.
• Give players a name. The wiki's DNS records page pairs an A record with a _rust._udp SRV record and server.favoritesEndpoint, so favourites survive a move to a new address.

Sizing, the null-route rule and when a paid tier helps

Facepunch asks for 12 GB of free RAM, notes a 6k map uses more and that population matters, and wants 15 GB of disk. Memory also climbs through a wipe as bases go up. On our VPS line:

Shape	RAM / vCPU / SSD	Network ceiling	Bucharest	Warsaw or Amsterdam	Sofia or Ashburn
VPS IV: standard map, light plugins	16 GB / 4 / 80 GB	220 Mbps	€16	€24	€26
VPS V: 6k map or heavy plugins	24 GB / 6 / 100 GB	260 Mbps	€30	€42	€44
VPS VI: big modded map, or two small servers	32 GB / 8 / 120 GB	300 Mbps	€58	€74	€78

Prices are monthly; the network figure is a per-shape burst ceiling on a shared 1 Gbps node uplink, with unmetered traffic. The wiki ties player count to CPU speed, and our VPS guest CPU is an older Intel generation (Broadwell), so a wipe night with 200 or more players belongs on a dedicated server.

The null-route rule. On the included tier, attacks under 100 Gbps don't count. Attacks above 100 Gbps are still mitigated, up to five a month at no charge. From the sixth above 100 Gbps in a month, the attacked IP is null-routed until the attack stops or the server moves to a higher tier, and then your players can't reach it either. A weekly server has four or five wipe nights a month; someone bringing more than 100 Gbps to each, plus one test between, reaches six, probably on a wipe night. If big attacks recur, move up before the next wipe.

Paid tiers are the DDoS Protection option per server, from 500 Gbps at €156.45 a month to 10 Tbps with Layer 7 at €4,723.95, plus VAT where it applies. A tier raises capacity in front of the one server it is ordered with. It does not raise the VPS network ceiling, fix RCON, plugins or CPU, or cover a website elsewhere.

A Rust wipe day DDoS checklist

1. Update, then mods. Stop the server, run the SteamCMD update, then update Oxide or Carbon; the wiki says Oxide needs updating after every server update.
2. Back up off the box. Copy server/main/, including companion.id. Our VPS have no backups included.
3. Restart clean, and keep scheduled restarts through the cycle to clear memory creep.
4. Audit what listens. ss -tulpn should show 28015 and 28017 on UDP, 28082 on TCP, and RCON on 127.0.0.1:28016 only.
5. Check who has power. Review owner and moderator entries in users.cfg; rotate the RCON password if staff changed.
6. Know your normal. Watch vnstat -l on a quiet evening, then keep it open on wipe night beside the query-limit counter.
7. Write the attack plan now: who posts in Discord, where the DNS name points, when to contact us. Log start and end times of anything odd.

What this is not

It is not managed Rust hosting: Noded does not sell that (our sister brand ZeroPing.Cloud does), so you run RustDedicated yourself with full root, and updates, plugins, RCON and firewall are yours. The protection is Layer 3/4 and not game-aware; Layer 7 comes only with the 10 Tbps tier. It does not raise a VPS's 100 to 300 Mbps network ceiling. On the included tier, the sixth attack above 100 Gbps in a month gets the attacked IP null-routed until it stops or you move up. And nobody, us included, can promise no downtime from attacks.

How Noded Can Help

For a community Rust server, order a VPS IV from the VPS hosting page: 16 GB RAM, 4 vCPU and a 220 Mbps ceiling for €16 a month in Bucharest, €24 in Warsaw or Amsterdam, or €26 in Sofia or Ashburn, with unmetered traffic and 100 Gbps of always-on DDoS protection included. Step up to a VPS V at €30 for a 6k map or heavy plugins. Hourly billing (€0.0222 an hour, €5 of credit, billed until destroyed) lets you rehearse a wipe first. Add a paid tier, from €156.45 a month per server, only once attacks above 100 Gbps are routine. For other games, see our DDoS-protected game server hosting guide; for a second opinion, open a ticket.

FAQ

How do I protect a Rust server from DDoS?

Put it behind always-on upstream filtering, because floods must be dropped before they reach your link; on Noded, 100 Gbps at Layers 3 and 4 is included. Then open only the game, query and Rust+ ports, rate-limit the query port per address, bind RCON to loopback and keep websites off the game address.

What ports does a Rust server use?

Four: the game port (server.port, default 28015 UDP), the query port (server.queryport, UDP, one above the larger of the game and RCON ports), RCON (rcon.port, TCP) and Rust+ (app.port, TCP, 28082 with untouched defaults). A common explicit layout is 28015 for the game, 28016 for RCON, 28017 for queries and 28082 for Rust+.

What is the Rust server query port for?

It answers the Steam queries that the server browser and third-party tools use to read your server's name, map and player count. Without it players can still connect directly, but the server won't be listed. It must differ from the game port; rate-limit it per address on a public server and block it on a private one.

Should Rust RCON be open to the internet?

No. RCON gives full control of the server, and Facepunch's WebRCON console sends the password unencrypted in the connection URL. Bind it to 127.0.0.1 with rcon.ip, reach it through an SSH or WireGuard tunnel, use a long random password, and allow only named addresses if a hosted tool must connect.

What happens if my Rust server is hit above 100 Gbps on Noded?

On the included tier, attacks above 100 Gbps are still mitigated, up to five in a month at no charge. From the sixth in the same month, the attacked IP is null-routed until the attack stops or you move the server to a higher tier, starting at €156.45 a month per server for 500 Gbps.