RCON without leaving it open to the internet

RCON is a remote console. Whoever can reach the port and knows the password runs commands as the server, with no further authentication and no audit trail beyond whatever the game itself logs.

It is also, on a large number of servers, open to the entire internet with a password the owner reuses elsewhere. The fix takes ten minutes and almost nobody does it, because the panel opened the port during setup and nothing has gone wrong yet.

What the protocol actually gives you

Source RCON is a small TCP protocol: connect, send the password, send commands, read replies. The password is sent as part of the exchange rather than as a derived proof, so anybody sitting between you and the server sees it.

That is the first reason not to use it across the internet. The second is that there is no rate limiting in the protocol itself — a client can attempt passwords as fast as the server will answer, and the server is happy to answer.

Minecraft's implementation is a near-copy with the same properties. Neither was designed for a hostile network; both were designed for a machine in the same rack.

The arrangement that is actually safe

Bind RCON to localhost and reach it over SSH.

rcon_bind_ip 127.0.0.1

Then, from your machine, forward a local port over SSH and point your RCON client at that:

ssh -N -L 27015:127.0.0.1:27015 you@server

Now the only thing exposed to the internet is SSH, which is designed for it, and which you are presumably already hardening as part of the security basics. RCON becomes unreachable from outside entirely — not firewalled, not password-protected, simply not listening on any address the internet can route to.

This is the whole recommendation. Everything below is what to do when it is not available.

If it has to be reachable

Two mitigations, in order of value:

Restrict by source address. A firewall rule allowing the RCON port only from your IP, or from a small set. On a dynamic residential IP this is annoying and still better than the alternative, and the rule belongs with the rest of the firewall, written into a file that survives a reboot.

Use a password that exists nowhere else. Long, random, stored in a password manager, and different from your panel password, your SSH key passphrase and your Discord. The specific failure this prevents is not somebody guessing it; it is somebody finding it in an unrelated breach and trying it here.

Changing the port helps marginally against untargeted scanning and not at all against anything else. Do it if it costs nothing, do not count it as a control.

One thing to check while you are in there: RCON and the query port are separate, and hiding one does not hide the other. The query port must stay reachable or nothing will list your server, which is the opposite mistake and just as common.

What an attacker does with it

This is worth being concrete about, because "RCON access" sounds abstract.

With console access a person can change the map, ban every player, alter permissions, and on many setups execute commands that touch the filesystem through plugins. On a server running a framework with SQL access from Lua or Sourcepawn, the reachable surface includes your database.

There is also no meaningful undo. A mass ban can be reversed if you have the records; a world modified through console commands generally cannot, which is the point at which a backup you have tested stops being housekeeping.

The logging gap

Most game servers log RCON commands poorly or not at all. Some log the command and not the source; some log neither.

That matters after the fact: if something has clearly been done through console and three people have the password, the server frequently cannot tell you which one. Where the software supports logging the source address, turn it on. Where it does not, reduce the number of people who have the password until the question is answerable.

Ten minutes, once

Bind to localhost. Forward over SSH when you need it. Give the password to as few people as the server can function with, and make it unique.

That is the entire job, and it moves RCON from the most dangerous thing on the box to something that cannot be reached at all, which is a better state than any amount of monitoring can give you, because there is nothing left to watch.