Which ports to open for a Rust server (28015, 28016 and 28017)

Rust causes more confusion than most because it uses three different ports for three different jobs, and one of them is TCP while the others are UDP. Opening only the game port means people can join by typing the IP, but the server never shows up in the browser.

The ports

Port	Protocol	What for	Open it?
28015	UDP	The game: this is how players connect	Yes
28017	UDP	Steam query: puts you in the community browser	Yes
28016	TCP	RCON / web console	Only if you use it from outside
28083	TCP	Rust+ companion app	Only if you want Rust+

Two warnings about that table:

The query port is not fixed by default. Without +server.queryport, Rust picks one above the higher of the game and RCON ports, which on a normal install gives 28017. If you changed either, do the maths or set it explicitly.
Rust+ listens on whatever you set with +app.port. With nothing set, it uses the higher of game and RCON plus 67, i.e. 28083 on a standard install.

Windows (PowerShell as administrator)

# Game and query: the essentials
New-NetFirewallRule -DisplayName "Rust game UDP 28015 (in)"   -Direction Inbound  -Protocol UDP -LocalPort 28015 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "Rust query UDP 28017 (in)"  -Direction Inbound  -Protocol UDP -LocalPort 28017 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "Rust game UDP 28015 (out)"  -Direction Outbound -Protocol UDP -LocalPort 28015 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "Rust query UDP 28017 (out)" -Direction Outbound -Protocol UDP -LocalPort 28017 -Action Allow -Profile Any

And if you will use RCON or Rust+ from outside (only then):

New-NetFirewallRule -DisplayName "Rust RCON TCP 28016 (in)" -Direction Inbound -Protocol TCP -LocalPort 28016 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "Rust+ TCP 28083 (in)"     -Direction Inbound -Protocol TCP -LocalPort 28083 -Action Allow -Profile Any

Linux

# Ubuntu / Debian
ufw allow 28015/udp
ufw allow 28017/udp
ufw allow 28016/tcp   # only if you use RCON from outside

# AlmaLinux / Rocky
firewall-cmd --permanent --add-port=28015/udp
firewall-cmd --permanent --add-port=28017/udp
firewall-cmd --permanent --add-port=28016/tcp
firewall-cmd --reload

# Listening?
ss -lntup | grep -E '28015|28016|28017'

RCON, carefully

RCON gives full control of the server console. Open it to the internet with a short password and it is a matter of days before somebody guesses it and wipes your map. Use a long, unique password in +rcon.password and, if only you use it, go through an SSH tunnel:

ssh -L 28016:localhost:28016 root@YOUR_IP

Then point your RCON tool at localhost:28016 with nothing exposed to the world.

I am not in the community browser

The query port (UDP 28017) is missing. The most frequent cause: with only the game port open people can join by IP, but Steam will not list you.
Wrong protocol. Game and query are UDP. A TCP 28015 rule opens nothing useful.
It takes a while to show. After a boot, Steam can take a few minutes to index it. Give it time before changing anything.
Just wiped. The server restarts and re-registers; disappearing for a bit is normal.
AntiDDoS filtering: the Security tab of your service. If you have hand-made filters, 28015 and 28017 must be there on UDP.

When sizing the machine before a wipe, remember one thing: Rust's usage climbs through the cycle, because everything players build stays. Our Rust calculator takes that into account.