RCON not accessible from the outside world

[Marahin]

Hi.

Great work with the image; I managed to deploy it to a Kubernetes cluster.
I have one issue though; even with 27015 tcp+udp forwarded, and with the RCON proxy set up to port 27050, it still does not allow external connections to be made to that RCON server. At least it's how I see the issue.

➜  ~ docker run --rm -it outdead/rcon
Enter remote host and port [ip:port]: 10.0.0.210:27050
Enter password: yyyyyy
Waiting commands for 10.0.0.210:27050 (or type :q to exit)
> echo "test"
"test"
> :q

➜  ~ docker run --rm -it outdead/rcon
Enter remote host and port [ip:port]: 193.x.x.x:27050
Enter password: yyyy
cli: auth: rcon: dial tcp 193.x.x.x:27050: i/o timeout

I am more or less confident with the port forwarding, as the 27015 and 27016 tcp+udp ports have been passed through and both I and other players are able to connect to the game server from the Internet (outside of LAN).
However, RCON still does not respond at all for the public address.

The following is a slightly redacted Kubernetes manifest in YAML (generated from JSONNET, so sorry for some boilerplate) containing both the deployment manifest and service manifest:

---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations: {}
  labels:
    name: cs
  name: cs
  namespace: cs
spec:
  minReadySeconds: 30
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      name: cs
  strategy:
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations: {}
      labels:
        name: cs
    spec:
      containers:
      - args: []
        env:
        - name: CS2_ADDITIONAL_ARGS
          value: -usercon
        - name: CS2_GAMEMODE
          value: "0"
        - name: CS2_GAMETYPE
          value: "3"
        - name: CS2_IP
          value: 0.0.0.0
        - name: CS2_LAN
          value: "0"
        - name: CS2_PORT
          value: "27015"
        - name: CS2_PW
          value: ""
        - name: CS2_RCONPW
          value: yyyyyy
        - name: CS2_RCON_PORT
          value: "27050"
        - name: CS2_SERVERNAME
          value: yyyyyyyy
        - name: CS2_STARTMAP
          value: de_mirage
        - name: HOME
          value: /home/steam
        - name: HOMEDIR
          value: /home/steam
        - name: STEAMGUARD
          value: yyyyyyyyy
        - name: STEAMPASS
          value: yyyyyyyyyyyy
        - name: STEAMUSER
          value: yyyyyyyyyyy
        image: joedwards32/cs2:latest
        imagePullPolicy: Always
        name: cs
        ports:
        - containerPort: 27015
          name: cs2-27015
          protocol: TCP
        - containerPort: 27015
          name: cs2-27015-udp
          protocol: UDP
        - containerPort: 27016
          name: cs2-27016
          protocol: TCP
        - containerPort: 27016
          name: cs2-27016-udp
          protocol: UDP
        - containerPort: 27050
          name: cs2-27050-tcp
          protocol: TCP
        stdin: false
        tty: false
        volumeMounts:
        - mountPath: /home/steam/cs2-dedicated
          name: data
      imagePullSecrets:
      - name: regcred
      initContainers: []
      securityContext:
        fsGroup: 1020
      terminationGracePeriodSeconds: 30
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: cs-pvc
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    metallb.universe.tf/allow-shared-ip: 10.0.0.210
  labels:
    name: cs-lb-tcp
  name: cs-lb-tcp
  namespace: cs
spec:
  loadBalancerIP: 10.0.0.210
  ports:
  - name: srv-cs2-27015-tcp
    port: 27015
    protocol: TCP
    targetPort: cs2-27015
  - name: srv-cs2-27016-tcp
    port: 27016
    protocol: TCP
    targetPort: cs2-27016
  - name: srv-cs2-27050-tcp
    port: 27050
    protocol: TCP
    targetPort: cs2-27050-tcp
  selector:
    name: cs
  type: LoadBalancer
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    metallb.universe.tf/allow-shared-ip: 10.0.0.210
  labels:
    name: cs-lb-udp
  name: cs-lb-udp
  namespace: cs
spec:
  loadBalancerIP: 10.0.0.210
  ports:
  - name: srv-cs2-27015-udp
    port: 27015
    protocol: UDP
    targetPort: cs2-27015-udp
  - name: srv-cs2-27016-udp
    port: 27016
    protocol: UDP
    targetPort: cs2-27016-udp
  selector:
    name: cs
  type: LoadBalancer

Expected behavior

I am able to connect to remote console through the external IP address.

[Marahin]

Another surprising behavior, that is probably related to the current state of CS2, is how it handles rcon_address within the Game console:

> rcon_address x.x.x.x:27050
> rcon_password yyyyyy
> rcon console echo "test"
Unable to connect to remote server (x.x.x.x:27015)

Even though I specifically set the address and port to :27050, it still makes a request to :27015. Perhaps it is a user error and I'm unaware I'm doing something wrong.

Connecting through a local address yields no errors, though at the point of writing I'm not certain if it actually executes commands in-game. It is certain however (I tested it yesterday) that RCON commands executed through outdead/rcon container execute correctly (I was able to call sv_cheats 1, mp_restargame etc)

[jrsales]

I have the same issue, but I can change the port and it registers.
My RCON port is 2016

> rcon_address x.x.x.x:27015
> rcon status
Unable to connect to remote server (x.x.x.x:27015)
> rcon_address x.x.x.x:27016
> rcon status
Lost RCON connection, please retry command (UNKNOWN ERROR)
> rcon_address x.x.x.x:27018
> rcon status
Unable to connect to remote server (x.x.x.x:27018)

[joedwards32]

I've only been able to use rcon with a 3rd party client:

https://github.com/forewing/csgo-rcon

[joedwards32]

Others with similar issues not related to the container image: https://www.reddit.com/r/GlobalOffensive/comments/167spzi/cs2_rcon/

Looks like a CS2 client issue.

[ppaulis]

@joedwards32 not sure about this being a CS2 client issue though.. I installed a CS2 server through TCAdmin, and RCON works fine. The only bug remaining there is, that RCON can't be used while being on the server. But from the outside it works fine. I'll try to investigate a little bit further.

[joedwards32]

@joedwards32 not sure about this being a CS2 client issue though.. I installed a CS2 server through TCAdmin, and RCON works fine. The only bug remaining there is, that RCON can't be used while being on the server. But from the outside it works fine. I'll try to investigate a little bit further.

That is strange. I use RCON frequently with the container but only using a 3rd party client. I've had no joy with CS2's official client.

So at a basic network level it does work. TCP packets can get to the right place.

Worth investigating further. I've reopened this issue.

[creazy231]

https://github.com/gorcon/rcon-cli works for me without any problems using docker

[joedwards32]

https://github.com/gorcon/rcon-cli works for me without any problems using docker

3rd party clients work fine.

This definitely looks like a CS2 client bug. Here's the wireshark of a CS2 client connection attempt:

It fails during TCP handshake:

• The client (192.168.0.4) sends a SYN to the the server (192.168.0.31)
• The server responds correctly with a SYN_ACK
• The client should send a final ACK to complete the threeway handshake, but instead sends a RST (reset) packet to terminate the connection.

This is all at the TCP layer before any application layer stuff can happen. Looks like maybe there is a race condition or some other problem with the TCP stack in the CS2 client.

[joedwards32]

Closing this issue as it appears to be a CS2 TCP stack bug.