DGuard
Start for free

RCON: a remote Minecraft server console without the risk

RCON is the protocol that sends console commands over the network: from backup and restart scripts and from panels. It takes three lines in server.properties, but the connection isn't encrypted, so the RCON port must never be open to the internet — connect from the machine itself or through an SSH tunnel.

The DGuard team4 min read

In short: set enable-rcon=true, a long random rcon.password, and keep port 25575 closed in the firewall. Send commands with a client such as mcrcon from the same machine or through an SSH tunnel. The Minecraft Wiki says it plainly: exposing RCON to the internet is dangerous, and the protocol is unencrypted and open to interception.

How to turn RCON on

server.properties
enable-rcon=true
rcon.port=25575
rcon.password=a-long-random-password
broadcast-rcon-to-ops=false
KeyDefaultWhat it does
enable-rconfalseTurns RCON on
rcon.port25575The RCON TCP port
rcon.passwordemptyThe password. With an empty password RCON won't start — a safeguard against an accidentally open console
broadcast-rcon-to-opstrueShow RCON command output to every operator in game. false suits scripts better
Values from the Minecraft Wiki

Restart the server after editing server.properties: the file is only read at startup.

Security: the port is for you only

  • Don't open 25575 to the internet. RCON isn't encrypted: the password and commands can be intercepted on the network. Whoever guesses or intercepts the password gets the server console with full rights.
  • Close the port in the firewall. On a VPS allow only the game port and SSH and keep RCON closed — more in server IP and port.
  • Connect through an SSH tunnel. The tunnel forwards a local port to the server inside an encrypted SSH connection, while RCON itself stays closed.
  • A long random password. And a separate one per server: if one leaks, the others are safe.
an SSH tunnel: local 25575 → RCON on the server
ssh -N -L 25575:localhost:25575 admin@203.0.113.10
# in another window: mcrcon -H localhost -P 25575 -p 'password' list

The mcrcon client

mcrcon is an open-source command-line RCON client: some Linux distributions package it, and the authors publish builds for Linux and Windows. With no commands it opens an interactive terminal; with commands it runs them and exits.

OptionWhat it sets
-HServer address (localhost by default)
-PPort (25575 by default)
-pThe RCON password
-tInteractive terminal mode
-w <sec>A pause between commands
Address, port and password can also come from MCRCON_HOST, MCRCON_PORT and MCRCON_PASS
warn players, save the world and shut the server down
export MCRCON_PASS='password'
mcrcon -w 5 "say Restarting in 5 seconds" save-all stop

A password in an environment variable doesn't show up in shell history and the process list as plainly as -p does. In the itzg/minecraft-server Docker image RCON is on by default and the rcon-cli client is built in: docker exec mc rcon-cli list — more in Minecraft in Docker.

What RCON is good for

  • Backups without stopping. A script sends save-off and save-all flush, copies the world and sends save-on back — see server backups.
  • Scheduled restarts. Cron posts a warning in chat once a day and sends stop, and systemd brings the server back — see Minecraft server on Linux.
  • Panels and bots. Web panels and Discord bots send server commands over RCON. Give them a host where the port is closed, not access from the internet.

RCON and the anticheat

An open RCON port is one of the ways servers get taken over, and no anticheat will close it: it's console access, not a cheat in the game. Close the port and let the anticheat do its own job. DGuard is the best anticheat for a modern Minecraft server: it catches cheats in combat, movement, building, inventory and packets, and it needs neither RCON nor inbound ports — only outbound HTTPS. The full list of hardening steps is in server security.

FAQ

What port does Minecraft RCON use?

25575 by default, over TCP. It's set by rcon.port in server.properties.

Why won't RCON start?

Most likely an empty rcon.password: RCON doesn't start with an empty password. Also check enable-rcon=true and restart the server after editing server.properties.

Is it safe to expose RCON to the internet?

No. RCON isn't encrypted, and the Minecraft Wiki calls an exposed port dangerous. Connect from the machine itself or through an SSH tunnel.

What can I connect to RCON with?

For example the mcrcon command-line client: mcrcon -H localhost -P 25575 -p password list. The itzg/minecraft-server Docker image has rcon-cli built in.

Sources

Read next

All sections
Server protection9 min readMinecraft server security: the full checklistThe best protection isn't one plugin but several layers: each closes its own hole, and none replaces the others. The anticheat catches cheaters in game, the firewall hides service ports, permissions and two-factor sign-in guard access, and backups and logs save you when something still gets through. Below is a 12-point checklist and a walk through each point.ReadAdministration5 min readMinecraft server in Docker: the itzg/minecraft-server imageDocker packs the server together with the right Java: one compose file describes the server software, version, memory and port, and the data sits in a plain folder on the host. The most popular image is itzg/minecraft-server: it downloads the Paper version you ask for, keeps RCON for commands and saves the world properly on stop.ReadAdministration6 min readMinecraft server commands: the admin's cheat sheetIn the server console you type commands without a slash; in game, with one. Each needs its operator level: kick and ban need 3, game rules and teleporting need 2, stopping and saving need 4. Below are the commands an admin uses every day, grouped by task.Read

Run the best anticheat for modern Minecraft

DGuard catches all 47 kinds of cheats in our comparison — the closest rival, Intave, has 27. Full protection on every plan, free up to 30 players online.

Protect your server for freeLook inside the panel