Rust Server DDoS Protection: Ports, Filters and Limits

VYKIX Rust hosting includes VxShield. We manage the protection rules for managed servers; on Game VPS and bare metal, you control those rules. VxShield combines upstream mitigation with filtering on our network, using the appropriate profile for each exposed service.

Rust uses separate endpoints for gameplay and browser queries. One can work while the other is unreachable, so test a player join and a query reply after setting the rules. This guide maps the game, query, RCON and Rust+ ports to their VxShield filters.

Map the services you use

Rust sends game and query traffic over UDP. RCON and the Rust+ companion service use TCP. The table gives common example ports; configure the rules with the values assigned to your server.

Service	Example port and protocol	What to check
Game	28015/UDP	Confirm the public address and port players join
Steam query	28017/UDP	Find the query port, which differs from the game port
RCON	28016/TCP	Decide whether you need remote administration and who may use it
Rust+	28082/TCP	Check whether the companion service is enabled and which port it uses

Rust can derive an unset query port from its game/RCON configuration. Read the running values before opening a port. For the companion service, follow the Rust+ instructions and run app.info. Facepunch server setup, Rust+ server documentation

Leave RCON disabled unless you need it for administration. When using it, set a unique secret and restrict who can connect where your setup allows. Remove secrets before sharing screenshots or logs. If support needs credentials, use the secure channel agreed with the provider.

Separate query reachability from gameplay

The browser obtains server details through queries. If that route is blocked, the listing can disappear even though players can join by address. After getting a query reply, test gameplay too: the game process still has to handle the playing session. Facepunch’s browser troubleshooting

During an incident, capture:

• A connection attempt to the public game endpoint and its result.
• A browser query and whether it returns current details.
• CPU, memory and plugin activity at the same time.
• The last port, protection-rule or server update before the failure.

Use the server-list guide for a missing listing, and the Rust lag guide to investigate gameplay symptoms. Ask the provider to check the traffic before attributing either fault to an attack.

What a protection claim needs to tell you

Packet rate and protocol behavior affect filtering as well as the volume of traffic. The server’s workload and legitimate demand also affect play during an attack. Ask what a provider means by “generic” or “game-aware” protection on your service.

Get answers to these questions:

1. Filter coverage: which rules apply to game, query and enabled TCP endpoints?
2. Player access: who tests joins and queries after changing a rule?
3. Capacity scope: does the advertised number describe shared network capacity, a port limit or a contractual commitment?
4. Disruption: when might the provider rate-limit, drop or null-route traffic, and how will it notify you?
5. Past incidents: which game, date and traffic class does a report describe, and what happened during it?
6. Rule ownership: who investigates a changed port or false positive and makes the correction?

Save the answers with your order. Query caching and filtering can still leave packet loss or disruption during an attack; get the provider’s limits in writing.

VxShield’s published Rust configuration

These are the VxShield filters we document for Rust. Use the Rust protection documentation to match each rule to your assigned ports:

Service	Published rule
Game UDP port	Rust
Query UDP port	A2S Query Cache
RCON TCP port	Generic TCP
Rust+ TCP port	Generic TCP

To use the preset, select the protected IP, add the rule, confirm its ports and save it. The VxShield firewall guide walks through that process. Then test a player join and query reply, along with RCON or Rust+ if you enabled them.

We maintain the rules for managed Rust hosting. On Game VPS and bare metal, you maintain them. Those services begin with VxShield ports closed, so align the upstream rules with your OS firewall.

The advertised 17 Tbps is aggregate protection-network capacity shared across the network, with no reserved allocation for an individual server. Attack-related packet loss, latency and null-routing remain possible under the service terms.

For an account of an A2S campaign against a DayZ community, see the KarmaKrew incident report. Its measurements and outcome cover that DayZ incident.

Check the service before committing

On a new server, start with a normal player join and browser query. Arrange any controlled resilience test with the provider and obtain authorisation before sending test traffic. An informal attack against a trial server is outside those checks.

VYKIX’s managed Rust PC plan includes VxShield, file access, Oxide/Carbon support, maintenance schedules and three same-server backup slots. Check current availability and the order total, including applicable taxes and fees.

The free PC trial runs for 48 hours. A valid card is required for fraud verification, with no charge or automatic paid conversion. Service is suspended at 48 hours, and active data is deleted seven calendar days after suspension. Export your needed files before expiry. To continue, place a separate paid order; the paid configuration can use different hardware from the trial.

If you want to move an existing server, confirm eligibility and the scope of complimentary, best-effort migration with us. The seven-day switching bonus has qualifying conditions. Trial and migration terms

Compare Rust hosting and its trial terms. To check a particular port, ask VYKIX on Discord which filter applies and who maintains it.