Skip to content
LodgichostLodgichost
Back to Guides
8 min read

Remote Administration with RCON

Run Minecraft console commands over TCP with RCON, without logging into the game.

By Lodgichost Team · Last updated: August 19, 2026

RCON is the Minecraft remote console protocol: it lets you send console commands to a running server over TCP without being a player. It is useful for whitelisting a friend, running a save-all, executing an op command, or triggering a scheduled restart from a script. RCON is switched off by default. You enable it in server.properties with enable-rcon=true and you choose a port and a password. Because RCON grants full console access, a guessed or leaked password lets an attacker stop the server or run arbitrary commands with operator rights. Keep the password strong, never share it, and restrict the management port to your own IP addresses with a firewall.

Enable RCON in server.properties

Open server.properties in the file manager of your Lodgichost panel and add or edit these three lines. The file sits in the same folder as your server jar, world data and logs. After saving, restart the server completely; RCON starts at boot and will not appear before a restart. The rcon.password value is stored in plain text in this file, so treat the file as sensitive.

enable-rcon=true
rcon.port=25575
rcon.password=px7Kq-m9Zw2!vR4t
  • Pick a port you are not using elsewhere; 25575 is the convention but nothing enforces it.
  • Use a long random password of at least 16 characters. Do not reuse your panel password.
  • Restart after every change to server.properties; the console logs 'RCON running on 0.0.0.0:25575' when it starts.

Restrict RCON to Your Own Network

Do not leave RCON reachable from the whole internet. Even with a strong password, firewall the management port so only your office or home IP can reach it. Ask support whether outbound filtering is available; many hosts offer a firewall zone you can apply. If you administer the machine yourself, allow only your address at the host level.

iptables -A INPUT -p tcp --dport 25575 -s 198.51.100.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 25575 -j DROP

Connect and Send Commands

mcrcon is the most common command-line client, available for Windows, Linux and macOS. Install it on your management machine and run it with the hostname, port and password. Commands you type are executed in the server console exactly as if you typed them into the console tab in the panel. End a single-session run with Ctrl+D or the quit command.

mcrcon -H play.example.com -P 25575 -p px7Kq-m9Zw2!vR4t "whitelist add Steve" "say Backups finished"
mcrcon -H play.example.com -P 25575 -p px7Kq-m9Zw2!vR4t list
  • Start read-only: run list, whitelist list or say before touching anything destructive.
  • Quote commands that contain spaces, and pass several commands as separate quoted strings on one line.
  • For scripts, read the password from a config file readable only by you, not from command-line history.

What RCON Is Good For

RCON is the same console the panel shows, so every console command works over it: whitelist add, ban, save-all, save-off/save-on, stop, or plugin commands such as Essentials' /broadcast. A common pattern is a cron job or a Discord bot that triggers a save-all or a scheduled restart through RCON while nobody is logged in. Because RCON is text over TCP on its own port, it uses no player slots and has negligible overhead.

Test Carefully: RCON Is Full Access

There is no confirmation prompt over RCON. The moment you send stop, the server begins shutting down. Test with harmless commands first and never chain destructive actions with logical operators. If you changed the password, restart the server so the new value is loaded. A leaked rcon.password is equivalent to handing someone the console, so rotate the password after any suspicious traffic on the management port.

  • Confirm the exact command syntax on the console tab before sending it over RCON.
  • Never run save-off followed by stop in one line; order matters and a crash mid-way loses chunks.
  • Monitor the management port and rotate the password after failed-login patterns you do not recognise.

Troubleshooting

  • Connection refused — RCON is not enabled, the server has not restarted since you changed server.properties, or a firewall drops the port. Check that the console log shows 'RCON running' and that your client uses the same rcon.port.
  • Authentication failed — The password in your client differs from rcon.password, or you edited the file before the last restart. RCON reads the password only at boot.
  • Commands are rejected as unknown — RCON accepts console commands, not chat text. Remove the leading slash; plugin aliases only work when the plugin is loaded.
  • The client connects but the panel console shows nothing — Some clients use a verbose protocol. Reconnect with the latest mcrcon or switch protocol if your client supports it.

FAQ

Is RCON the same as in-game chat?

No. RCON talks to the server console over TCP and your input arrives as console commands, not player chat. Use a command such as say to broadcast a message to players.

Which port should I choose for rcon.port?

25575 is the convention and what most tools expect by default, but any unused TCP port works. Avoid 25565, the game port, so admin traffic never collides with player connections.

Is the RCON password encrypted?

No. rcon.password sits in plain text inside server.properties and RCON transmits it unencrypted. That is another reason to firewall the port and use a strong value.

Does RCON slow the server down?

Practically no. It is a single lightweight TCP listener and command execution is identical to typing in the console. Heavy plugin commands run server-side exactly as they would from the console tab.

Can I use RCON from outside my local network?

Yes, that is its purpose, but only over a restricted path: a strong password plus firewall rules that limit the source IP. Do not expose the management port to the whole internet.

Related Guides

This site uses cookies to improve your experience. Learn more.