Fix: RCON Works Locally but Not Remotely

RCON commands run fine when you are on the server machine, but from your desktop you get Bad rcon_password, a silent timeout, or Lost connection to server. Remote RCON in GoldSrc rides the same UDP port as game traffic and uses a challenge handshake, so the failure is almost always the password, the firewall on that UDP port, or a mismatch between the address you set and the address you connect to. Here is how to isolate which.

1. Understand how RCON authenticates

RCON is not a persistent login. Each command does a two-step exchange over UDP 27015: the client asks for a challenge, the server returns a number, and the client re-sends the command with the password and that challenge. Anything that blocks UDP in either direction, or a password mismatch, aborts the exchange. Because it is UDP, a firewall that only opened the port one-way still breaks the reply, which is why a command can appear to hang forever rather than fail cleanly.

2. Set the password server-side correctly

The server must have a non-empty RCON password loaded. Set it in server.cfg, not on the command line where it can be seen:

rcon_password "a-long-random-string"

Confirm it actually loaded by running rcon_password with no value in the server console — an empty value means server.cfg did not execute or the line is commented. An empty rcon_password disables RCON entirely, and every remote attempt then returns Bad rcon_password no matter what you send.

3. Set the password on the client the right way

From your client console you must set the password and target the server before sending commands:

setinfo "password" ""
rcon_password "a-long-random-string"
rcon status

If you are not currently connected to the server, RCON needs to know where to send the command via rcon_address and rcon_port:

rcon_address 203.0.113.10
rcon_port 27015
rcon status

A frequent mistake is setting rcon_password but leaving rcon_address pointed at a stale server, so the command goes to the wrong box and returns Bad rcon_password from that unrelated server.

4. Open the UDP port both ways

RCON uses the game's UDP port. If a host firewall or cloud security group only allows inbound game traffic but drops the RCON challenge reply, or blocks the port entirely for your source IP, you get a timeout with no error text. On a Linux host confirm the port is open for UDP:

iptables -L -n | grep 27015
ss -lun | grep 27015

The server must be listening on UDP 27015 (ss -lun shows it), and the firewall must allow UDP 27015 from your address in both directions. On a cloud provider, add UDP 27015 to the security group; a rule that only covers TCP does nothing for CS 1.6, which is UDP-only.

5. Check sv_rcon_banpenalty and lockout

GoldSrc locks out an IP after repeated bad RCON attempts. If you fat-fingered the password several times while testing, the server may be refusing you specifically. The relevant cvars:

sv_rcon_minfailures 5
sv_rcon_maxfailures 10
sv_rcon_banpenalty 0

If sv_rcon_banpenalty is non-zero, a locked-out client stays banned from RCON for that many minutes even with the correct password. Restart the map or wait out the penalty, then retry with the right password once. Setting a modest penalty is good practice against brute force, but it is also why your own testing can lock you out mid-session.

Troubleshooting

• Bad rcon_password from remote, fine locally — the client password does not match, or rcon_address points at a different server. Re-set both and retry.
• Command hangs / times out — UDP 27015 is blocked one-way by the firewall or security group. Open it inbound and outbound for your IP.
• Lost connection to server — you are querying an address where nothing is listening, or the port is wrong. Verify with ss -lun.
• Worked, then suddenly rejected — RCON ban penalty from failed attempts. Check sv_rcon_banpenalty and wait it out.
• Empty rcon_password on the server — RCON is disabled entirely. Set it in server.cfg and confirm it loaded.
• Works from LAN, not WAN — you are behind NAT and the port is not forwarded to the server's internal IP for UDP.

Verification

From the remote client, after setting the password and address, run rcon status. A correct setup returns the player list and server hostname. Then run a harmless command such as rcon stats and confirm it executes. If status works remotely, RCON is fully functional and any later failure is a re-typed password or a changed address. For running the server behind a control plane where the port is remapped, confirm the RCON port matches the external allocation as described in the panel startup guide. Never share the RCON password in a bind or config you distribute.