Setting Up and Using RCON on Your IW4x Server

Setting Up and Using RCON on Your IW4x Server

RCON (Remote Console) lets you execute server commands from outside the server process — from an IW4x game client, a third-party admin tool like IW4MAdmin, or a custom script. It's the primary interface for live server management.

Enabling RCON on the Server

RCON is controlled by a single cvar in userraw/server.cfg:

set rcon_password "YourSecurePassword"

Rules for the password:

• It must be a non-empty string. An empty rcon_password disables RCON entirely.
• Avoid spaces in the password (use underscores or mixed case instead).
• Change the default from anything like "changeme" or "password" — RCON allows full server control.

Restart the server after setting this. RCON uses the same port as game traffic (UDP 28960 by default), so no additional firewall rules are needed.

Using RCON from the IW4x Game Client

You can send RCON commands directly from the IW4x console while connected to your server or even from the main menu.

1. Open the console with the tilde key (~).
2. Authenticate with your RCON password:

   rcon_password YourSecurePassword
   

3. Send a command by prefixing it with rcon:

   rcon status
   rcon map mp_rust
   rcon g_gametype dom
   

The rcon_password is stored in your client config for the session. You don't need to re-enter it for subsequent commands until you restart the game.

Common RCON Commands

To find a player's slot number, run rcon status first and read the numbers from the left column.

Using RCON with IW4MAdmin

If you're running IW4MAdmin, it handles RCON authentication automatically using the rcon_password you provide in its configuration. You generally don't need to use raw RCON when IW4MAdmin is running — use IW4MAdmin's chat commands (!kick, !ban, !map, etc.) instead.

See the IW4MAdmin setup guide and the IW4MAdmin commands reference for details.

Using RCON with External Scripts

IW4x RCON is UDP-based. You can send commands from any scripting language that supports UDP sockets. Here's a Python example:

import socket
import struct
import hashlib

def send_rcon(host, port, password, command):
    header = b"\xff\xff\xff\xff"
    packet = header + f"rcon {password} {command}".encode("ascii")
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(2)
    sock.sendto(packet, (host, port))
    try:
        response, _ = sock.recvfrom(4096)
        return response[10:].decode("ascii", errors="replace")
    except socket.timeout:
        return "(no response)"
    finally:
        sock.close()

# Example usage:
print(send_rcon("127.0.0.1", 28960, "YourSecurePassword", "status"))

This uses the standard Quake-style RCON packet format that IW4x inherits from the IW4 engine.

IW4x Safe RCON (Encrypted)

Standard RCON sends the password in plaintext over UDP, which is a known security concern on public networks. IW4x supports an enhanced "safe RCON" mode that uses RSA key pairs for authentication, preventing password sniffing.

To enable safe RCON:

1. Both the server and client must be running a sufficiently recent version of IW4x (post-2021 builds support it).
2. The server generates an RSA key pair on first start; the public key is broadcast in server info packets.
3. Clients that support safe RCON use the server's public key to encrypt the RCON challenge response.

For most server operators using IW4MAdmin on the same machine (localhost RCON), the standard RCON mode is acceptable. Safe RCON matters most when you're administering a remote server from a different network.

Troubleshooting RCON

Related

• IW4x server.cfg Complete Configuration Guide
• Installing and Configuring IW4MAdmin for IW4x
• Host an IW4x (MW2) server with DustBowl.Games