How to Use RCON on Your CS 1.6 Server
RCON lets you run server console commands remotely from a game client or external tool. Set a strong password, know the commands, and lock it down against brute-force attacks.
Set the RCON Password
In cstrike/server.cfg:
rcon_password "YourStrongPasswordHere"
Use something long and random. RCON traffic is plaintext UDP — anyone packet-sniffing the connection can see the password. Don't reuse a password you care about.
Using RCON from the CS 1.6 Client
Open your CS 1.6 console while connected to the server (or from the main menu — you don't have to be on the server):
rcon_password "YourStrongPasswordHere"
rcon status
rcon changelevel de_dust2
rcon kick "PlayerName"
The rcon prefix sends the command to the server console instead of running it locally. First set the password, then issue commands.
Using RCON from External Tools
Any HL1-compatible RCON client works. Common options:
- HLSW — classic standalone server management tool with a full UI
- AHL-Admin — browser-based RCON console
- Any tool that supports Source RCON protocol on HL1 servers
Connect to your-server-ip:27015 with the RCON password. Once connected you get a remote console — everything you type runs on the server.
Common RCON Commands
rcon status // list connected players with Steam IDs
rcon changelevel de_inferno // change map
rcon kick "PlayerName" // kick a player
rcon banid 0 STEAM_0:0:12345 kick // permanent ban
rcon sv_cheats 0 // ensure cheats are off
rcon exec server.cfg // reload server config
rcon mp_timelimit 30 // change time limit live
rcon say "Server message to all" // broadcast a message
rcon amx_map de_dust2 // AMX map change (if AMX installed)
Brute-Force Protection with reHLDS
Vanilla HLDS has no protection against someone scripting repeated RCON password guesses. reHLDS adds configurable lockout:
rcon_minfail 5 // start counting after 5 failed attempts
rcon_maxfail 20 // lock out the IP after 20 total failures
rcon_banpenalty 60 // lock out for 60 seconds
Add these to server.cfg. With these settings, an attacker gets 20 attempts before their IP gets temporarily blocked. Adjust rcon_banpenalty upward (e.g., 3600 for an hour) if you want harder lockouts.
Firewall Best Practice
RCON runs on the same UDP port as game traffic (default 27015). You can't firewall it from game traffic without blocking players too.
What you can do:
- Use a strong, unique password
- Enable the reHLDS brute-force protection above
- Monitor your logs for repeated RCON failure messages — they look like
Bad rcon_password command from - If your admin team all connects from known IPs, consider using iptables rules to rate-limit port 27015 for connections that aren't in your player range
RCON vs AMX Mod X
RCON gives you access to the raw server console — it's powerful but dumb. AMX Mod X gives in-game admins a structured permission system with specific commands they can run.
For most admin actions, use AMX commands (amx_kick, amx_ban, etc.) rather than raw RCON. Reserve RCON for server restarts, config reloads, and emergencies.