Skip to main content

Restrict Factorio RCON access to an approved management path

Factorio RCON lets a remote tool send management commands to the server. Enable it only for a defined integration with an approved connection path. Your allocated game connection and an RCON management listener serve different purposes; making the game reachable does not establish that RCON should be public.

Identify the actual requirement

Write down which tool needs RCON and which commands it will send. If you only need to use the game panel console yourself, check whether that already meets the requirement. Avoid adding another listener for a tool nobody maintains.

You need ownership of the service and access to its startup settings. Network restrictions and extra allocations may require support. A game-panel customer should not attempt host firewall changes or bind to an unassigned port.

Factorio’s upstream command-line reference lists separate RCON bind, port and password options. The exact fields exposed by your CloudExa template can differ. Ask support to confirm the effective command if the panel only shows a subset.

Plan the route before enabling it

  1. Record the integration’s trusted source and whether it can use a private management network or another approved restricted path.
  2. Ask support to confirm the permitted destination address, allocation and source restrictions. Do not assume a default port belongs to your service.
  3. Generate a strong, unique secret using a password manager and store it in the integration’s secret field.
  4. Keep screenshots, command examples and support messages free of the password. A startup command can reveal secrets if you paste it in full.
  5. Schedule a restart if the startup configuration needs changing. Preserve the previous configuration before making the change.

Verify management access without changing the factory

After startup, inspect the log for binding errors. Use the approved management client to send a harmless information or help request supported by your installed version. Record the response and time. Do not test with a destructive command, an arbitrary script or a password-reset action.

Have support verify that an unauthorised source cannot reach or authenticate to the management interface, using the agreed network policy. A failed connection from one laptop does not prove the listener has no other public path.

Confirm that normal players can still connect through the game allocation and that the integration can reconnect after a planned server restart. If a tool retries aggressively, set a reasonable retry delay through its supported options so an outage does not create unnecessary load.

Retire unused access

If the integration is no longer needed, remove or disable its RCON startup configuration using the template’s supported controls. Restart during a maintenance window and ask support to verify that the listener stopped. Revoke the secret in the external tool as well.

For a failed rollout, restore the recorded startup configuration and keep the connection error for support. Do not broaden the bind address or remove source restrictions until the team identifies the failed part of the route. Document who owns the integration and when to review its access again.

Official references

No comments to display