OnRconMessage
OnRconMessage is called when a command arrives over an RCON connection, before Oxide splits it into a command name and arguments. Returning a non-null value stops the command from being processed.
object OnRconMessage(System.Net.IPAddress ipAddress, Oxide.Core.RemoteConsole.RemoteMessage message)Parameters
| Parameter | Type | Description |
|---|---|---|
ipAddress | System.Net.IPAddress | IP address of the RCON client that sent the command. Use it to identify or filter specific admin connections; it can be compared with connection addresses or logged. |
message | Oxide.Core.RemoteConsole.RemoteMessage | RemoteMessage object holding the parsed command text. Its Message property contains the raw command string (for example `playerlist` or `say hello`). |
Return value
Returning a non-null value (for example true) makes Oxide treat the message as handled and skip command dispatch. Returning null lets the message continue to normal RCON command processing, including the OnRconCommand hook.
How it works
The hook fires inside Oxide's RCON message handler for every non-empty command received from an RCON client. Oxide parses the incoming string into a RemoteMessage, checks that its Message property is not empty, and then calls OnRconMessage with the sender's IPAddress and the message object. If you return anything other than null, Oxide skips the rest of its handling: the built-in command dispatch is not attempted and the RCON client receives a success response instead of an error.
Use message.Message to inspect the full command line before it is split. Because the hook runs before OnRconCommand, it lets you block or rewrite a whole command rather than filtering individual arguments. There is no dedicated Rust facade field, so RemoteMessage.Message is the only reliable member to read; avoid relying on other properties. Narrowing by parameter type is not useful here: IPAddress and RemoteMessage are the only argument types Oxide passes.
Returning null keeps default behavior, so commands pass through untouched.
Example plugin: Block and log dangerous RCON commands
using Oxide.Core.RemoteConsole;
using System;
using System.Collections.Generic;
using System.Net;
using Newtonsoft.Json;
using Oxide.Core;
using Rust;
namespace Oxide.Plugins
{
[Info("Rcon Command Guard", "RustPluginGenerator", "1.0.0")]
[Description("Filters and logs commands sent over RCON before they are processed")]
public class RconCommandGuard : RustPlugin
{
private class PluginConfig
{
[JsonProperty("Blocked command prefixes")]
public List<string> BlockedPrefixes = new List<string> { "quit", "restart", "server.save" };
[JsonProperty("Log all RCON commands to console")]
public bool LogCommands = true;
}
private PluginConfig config;
protected override void LoadDefaultConfig() => config = new PluginConfig();
protected override void LoadConfig()
{
base.LoadConfig();
try
{
config = Config.ReadObject<PluginConfig>();
if (config == null) throw new Exception();
}
catch
{
PrintWarning("Configuration file is invalid, using defaults");
LoadDefaultConfig();
}
SaveConfig();
}
protected override void SaveConfig() => Config.WriteObject(config);
private object OnRconMessage(IPAddress ipAddress, RemoteMessage message)
{
if (message == null || string.IsNullOrEmpty(message.Message))
return null;
string text = message.Message.Trim();
string source = ipAddress != null ? ipAddress.ToString() : "unknown";
if (config.LogCommands)
Puts($"[RCON {source}] {text}");
for (int i = 0; i < config.BlockedPrefixes.Count; i++)
{
string prefix = config.BlockedPrefixes[i];
if (string.IsNullOrEmpty(prefix)) continue;
if (text.StartsWith(prefix, StringComparison.OrdinalIgnoreCase))
{
PrintWarning($"Blocked RCON command from {source}: {text}");
return true;
}
}
return null;
}
}
}The plugin reads config.json for a list of blocked command prefixes and an option to log every RCON command. In OnRconMessage it lowercases the incoming text, checks it against each configured prefix, and when one matches sends a warning to the server console and returns true. That non-null return stops Oxide from dispatching the command, so the RCON client gets a success result but nothing runs. Allowed commands return null and process normally. If logging is enabled, each command is written to the console with the sender IP. Prefix matching is case-insensitive and applies to the first word, which naturally covers subcommands such as ban and banid.
Common use cases
Block risky commands remotely
Reject prefixes like
server.save,quit, orrestartfrom RCON so a leaked password cannot take down the server, while still allowing normal admin commands.Audit RCON usage
Log every command with the sender IP to the console or a data file so you can trace who ran what after an incident.
Rewrite messages
Return a value for commands you want to swallow but still alert staff in chat or Discord through a chat relay before returning non-null.
Pitfalls
It fires before OnRconCommand
Returning non-null here prevents
OnRconCommandfrom being called for that message. Do not block everything if another plugin depends on that hook to see commands.It also covers console run commands
Commands typed in the server console can pass through the same handler in some builds. A broad prefix block can break your own local administration, so keep the block list tight and documented.
Use message.Message, not other members
Only
RemoteMessage.Messageis reliably filled for RCON input. Reading connection or identifier fields may return null and cause a NullReferenceException in a hook that fires rarely but critically.
Build a plugin with OnRconMessage
Describe what should happen and get a compiled plugin that uses this hook.
Edit the prompt on the next screen. 2 free plugins a month, no card.
Last updated Oct 26, 2026. Found a mistake? Email support@rustplugingenerator.com.
Build a plugin with OnRconMessage
Generate