A query port that answers everyone
Rust answers Steam's server queries on a port you set with +server.queryport. It has to answer strangers, or the server disappears from the in-game list.
Rust DDoS protection
Rust is covered by a port preset, not a protocol validator. The preset opens the game port and RCON with a packet ceiling on the game port, and every packet still passes the address and transport checks and the behavioural engines. Prism does not read the Rust protocol itself, and this page says exactly what that means.
- Ports the preset opens
- UDP 28015, TCP 28016
- Protocol validation
- No. Port preset only
- One-click preset
- Rust
- Upstream capacity
- 17 Tbps, the same on every plan
- What it costs
- Included on every plan
The ports, and who should reach each one. The defaults; open whichever you actually configured.
| Port | What it carries | Exposure | In the preset |
|---|---|---|---|
| UDP 28015 | Game traffic, set with +server.port. | Open to players | Yes |
| UDP You set it | Steam server queries, set with +server.queryport. It has no fixed default. | Open only if you use it | Add it yourself |
| TCP 28016 | RCON, set with +rcon.port. | Restrict to your own addresses | Yes |
| TCP You set it | Rust+ companion app, set with +app.port, only if you use it. | Open only if you use it | Add it yourself |
A rule is TCP or UDP, never both.
What a Rust server exposes. Our Rust guide does not document attack patterns specific to Rust, so this page does not invent any.
These are the surfaces the guide does describe.
RCON is a plain administrative channel
Admin tools, Discord bots and web panels talk to the server over RCON on TCP 28016. Treat it like SSH: a long password, and the port restricted to the addresses that need it.
Peak load is the hours after a wipe
Facepunch forces a wipe on the first Thursday of each month and population is a sawtooth. If your server is going to fall over, that is when, attack or not.
What Prism checks on a Rust rule. Layers 3 and 4, your ceilings and the engines that need no validator. There is no Rust protocol validator.
Every rule the Rust preset writes
The diagram stops where the checking stops.
- UDP 28015Layer 3 Address and packet sanityLayer 4 pps_limit 30000Layer 7 No validator
- TCP 28016Layer 3 Address and packet sanityLayer 4 No ceiling as shippedLayer 7 No validator
Layer 3, the address
Blocked sources and structurally malformed packets end here, at the lowest cost, exactly as on every other port.
Layer 4, the transport, and your ceilings
Spoofed and stateless floods are separated from traffic belonging to a real conversation, and the packet-rate ceilings on each rule apply. The preset ships UDP 28015 with a whole-port ceiling; TCP 28016 has none until you set one.
Signature (zero-day) engine on UDP rules
Learns the payload pattern of an in-progress attack and blocks it, without a rule being written first. It needs no validator.
TCP fingerprint on TCP rules
SYNs whose TCP stack fingerprint looks forged are dropped on the RCON rule.
Behavioural scoring
Timing regularity, reputation and tier demotion judge how a source behaves rather than what its payload says, which is why they work on a port with no validator.
Protocol validation for Rust
No validator ships for Rust. On a Rust rule the Protocol validation (L7) switch renders dim and reads "This service has no protocol validator. No effect on this one." A flood that uses the right port, stays under your ceilings and looks like nothing the behavioural engines recognise can reach your server.
Checked on every Rust ruleNot checked
The Rust preset. One click writes the rules, added to yours exactly as if you had written them by hand.
What one click writes
One click writes UDP 28015 for the game and TCP 28016 for RCON. The query port and Rust+ are not part of the preset, so add those as rules of your own. A preset that did not open your query port is behaving correctly.
Applying a preset adds its rules, it never replaces yours, and applying it twice adds a second copy. A server holds 15 inbound rules, so check the table afterwards.
| Protocol | Port | Policy | Status |
|---|---|---|---|
| UDP | 28015 | 30K pps | Enabled |
| TCP | 28016 | No extra limits | Enabled |
Quick setup: apply a preset for a common workload
Rust2 rulesApplied
Restrict RCON after applying the preset
The preset opens TCP 28016 so your tools can reach it. Edit that rule to allow only the addresses your panel and bots connect from.
Read the guideWhat no network filter can see
A guessed RCON password arrives as a valid login on a port you opened. A long, unshared password and a restricted port close that; Prism cannot.
Read the guideWhich plan for a Rust server. Bigger plans add cores, memory and disk, not clock speed.
Rust is one of the heaviest games you can self-host. Memory scales with map size, player count and the entities players place, so a server that fits on wipe day can be a very different machine two weeks later. The main loop is largely single-threaded.
Deploy in
Pro VPS
One busy server. Memory is what Rust runs out of first, and it climbs through each wipe as players build. Start with headroom and check the RustDedicated process at the end of a cycle.
- vCPU
- 6
- Memory
- 12 GB
- NVMe
- 120 GB
- Traffic
- 8 TB
MicroCore VDS
A server that must never share a core. The main loop is largely single-threaded, so one fast core does more than several slow ones, and here that core is never shared. Check its memory against your end-of-wipe figure first: memory is the limit Rust hits first.
- Dedicated cores
- 2
- Memory
- 8 GB
- NVMe
- 100 GB
- Traffic
- 8 TB
How to size it
Our Rust guide gives no memory figure, because there is no fixed one. Size for the end of a wipe cycle, not the start: watch the resident memory of RustDedicated across a full cycle, then pick the plan whose memory sits above it. A smaller map and a lower player cap are the two knobs that cut the load directly.
- Processor on every plan
- AMD EPYC 4584PX, up to 5.7 GHz
- Memory and disk
- DDR5 and NVMe
- Port
- 1 Gbit/s
- DDoS protection
- Included, always on
- Billing
- Monthly, prices exclude GST
Guides for running it. Step by step, in the help center, written against the same panel you will use.
Running a Rust server
docs.clouduxe.com/game-servers/rust-overview
Installing a Rust server on Linux
docs.clouduxe.com/game-servers/rust-install
Wiping a Rust server
docs.clouduxe.com/game-servers/rust-wipes
Which ports each game server needs
docs.clouduxe.com/game-servers/game-server-ports
Game presets
docs.clouduxe.com/ddos-protection/game-presets
What every Rust server on Clouduxe starts with.
- Boost clock, the same on every plan
- 5.7GHz
- Written by the Rust preset in one click
- 2rules
- Upstream mitigation, every plan
- 17Tbps
- Port on every plan
- 1Gbit/s
- Server uptime in the SLA, attacks excluded
- 99.99%
- Mumbai, Singapore and Limburg
- 3regions
Rust protection questions
Is the Rust protocol validated?
No. Rust has a port preset, not a protocol validator. Its rules get the layer 3 and layer 4 checks, your packet-rate ceilings, the zero-day signature engine on UDP and the behavioural engines. The Protocol validation switch has no effect on a Rust rule.
Does Rust DDoS protection cost extra?
No. The same filter and the same upstream capacity protect every plan in every region.
Which ports does a Rust server need?
UDP 28015 for the game, a UDP query port you set with +server.queryport, and TCP 28016 for RCON. Rust+ needs its own TCP port only if you use it.
Why is my server missing from the server list when players can connect directly?
The query port your server uses is not the one you opened. Set +server.queryport explicitly in your start script and add a rule for that exact port.
Should the RCON port be open to everyone?
No. Restrict it to the addresses your panel and bots connect from, on the rule and on the server firewall, and use a long password you use nowhere else.
Which region should a Rust server use?
The one closest to your players: Mumbai for India, Singapore for Southeast Asia, Limburg for Europe. Protection is identical in all three.
Every Rust rule gets the full layer 3 and layer 4 filter.
The same 17 Tbps upstream and the same filter on every plan, in every region, enabled from the first boot.