Reforger OPS

How to enable RCON on an Arma Reforger server

· 5 min read

RCON is how you administer an Arma Reforger dedicated server from outside the game: see who is connected, kick, ban and restart without joining as a player. It ships disabled. You enable it with a block in the server's config.json and an open UDP port.

1. The rcon block in config.json

Open the config.json you pass to the server with -config and add (or fill in) this block at the same level as game:

"rcon": {
    "address": "0.0.0.0",
    "port": 19999,
    "password": "ALongPasswordWithoutSpaces",
    "permission": "admin",
    "blacklist": [],
    "whitelist": []
}
  • address: the IP to listen on. 0.0.0.0 accepts connections on any interface; on shared hosting it is usually the server's public IP.
  • port: a UDP port. Any free one; 19999 is the convention. It cannot be the game port or the Steam Query port.
  • password: no spaces. It is different from passwordAdmin, which is the in-game #login password.
  • permission: "admin" to kick, ban and restart. With "monitor" you can only look (#players).
  • whitelist / blacklist: commands allowed or forbidden over RCON. Empty = everything the permission allows.

2. Open the port

The server cannot open the port by itself. Depending on where it runs:

  • Own machine / VPS: an inbound UDP rule in the firewall (ufw, firewalld, Windows Defender) and, behind a router, a port forward.
  • Pterodactyl: the port must be an allocation assigned to the server, in addition to the game one. If the egg does not expose it, the node administrator adds it.
  • Rented hosting (Nitrado, GPortal and similar): there is usually an "RCON" option in the provider's panel that writes this block and opens the port for you; look there for the port and password.

3. Restart and test

config.json is read at startup: restart the server. To check that RCON answers, connect with any BattlEye client (the protocol is the same as DayZ and Arma 3) and send #players. The reply starts with:

Players on server: [Player#] ; [Player UID] ; [Player Name]

If nothing comes back, check in this order: UDP port closed, wrong address, password with spaces, or the server still booting (RCON comes up a few seconds after the game does).

Common mistakes

  • Using the same password for passwordAdmin and rcon.password. They are separate systems; leak one and you leak both.
  • Opening the port on TCP. BattlEye RCON is UDP.
  • Leaving permission: "monitor" and then wondering why #kick does nothing.
  • Posting the RCON IP and port in an open Discord. Anyone with the password can send commands.

What RCON can do (and what it cannot)

With RCON enabled you can list players, kick, ban with a duration, view and remove bans, and restart or shut down the server. You cannot write in chat, change the scenario, move players or see kills: Reforger's RCON has no such commands. That takes a server-side mod; the commands guide has the full list.

What the server replies to each command

The exact wording matters as soon as you automate anything: a reply you do not recognise looks like a failure. These are the real replies from Arma Reforger 1.8.0.13:

#players       Players on server: [Player#] ; [Player UID] ; [Player Name]
               4 ; 7d6f1c2a-... ; Name
#kick          Player 'NAME' kicked!
#ban create    Player '7d6f1c2a-...' banned!
#ban remove    Ban removed!
#ban list      Server has no bans to list.      (when there are none)
               Total bans: 3 | Page: 1/1        (when there are)
               - Identity Id | Banned name
               - 7d6f1c2a-... | Name

A well-formed command that cannot be applied — banning an identity that does not exist, for instance — replies error '<command>'. That is not a connection problem: it is the server saying no. Treat it differently from a timeout, because retrying will not change the answer.

The detail that breaks automation: acknowledging is not executing

BattlEye acknowledges a command before the game executes it. That acknowledgement always arrives, even if the server dies a moment later. In practice: a #ban list that is acknowledged and then says nothing is indistinguishable from a #ban list of an empty list.

If you build anything on top of RCON, do not assume the acknowledgement means success. The way out is to send a protocol ping (an empty command) and see whether it comes back: if it does, the server is alive and the list really was empty; if it does not, the server is gone. And never automatically retry a #ban create whose reply was lost: it may already have been applied.

The RCON port is not the game port

This is the most common mix-up. An Arma Reforger dedicated server uses several different ports: the game port (2001 by default, the one players connect to), the Steam Query port (17777 by default, the one that answers whether the server is online) and the RCON port (19999 in the example above, for administration only). Pasting the RCON one into the server browser leads nowhere, and opening the game port does not make RCON answer.

Who can send commands, and how to lock it down

Anyone with the IP, the port and the RCON password can administer your server. There are no users, no roles and no record of who did what: the password is the permission. Treat it as the key to the server rather than as one more configuration value.

Three things that cut the risk without complicating your life:

  • Use the allowed-address list (allowedAddresses) if your host lets you. With it, even a leaked password only works from where you say.
  • Do not reuse the password. Not the passwordAdmin one, not the host's, not Discord's. If one leaks, it does not take the others with it.
  • Change it when someone leaves the team. It is the only thing that revokes their access, because there is no way to remove the permission from one specific person.

And one people forget: the RCON password travels inside config.json itself. If you share that file so someone can help with a problem — in a Discord, in a support ticket — strip it first.

Related guides