Unturned Commands.dat and RocketMod plugins explained

Unturned has one command system and three ways to reach it: a line in Commands.dat, a line typed into the server console, or a line typed into chat by an administrator with / or @ in front of it. Which of the three works for a given command is not arbitrary - every command is classified as boot-time, runtime, or both, and a few also require cheats to be switched on. Get that classification straight and most of the confusion around Unturned server administration disappears. The other half of the job is RocketMod, which adds its own parallel command system with its own permissions file, and which quietly fixes the most annoying omission in the vanilla server: it has an autosave and the base game does not.

How Unturned reads a command#

Commands are case-insensitive. When a command takes more than one parameter, the parameters are separated by forward slashes, which reads strangely the first time: ban 76561198012345678/Cheating/86400 is a name, a reason and a duration, not a path.

Where a command can be issued depends on its classification:

• Config. Only read at boot, from Commands.dat. Map, Port, Owner, Cheats, PvE and Password are in this group. Typing them into a running console does nothing useful.
• Runtime. Only work while the server is up: kick, ban, teleport, say, day, weather.
• Any. Work in both places. MaxPlayers, Name, Welcome, Save and Shutdown can sit in Commands.dat or be typed live.
• Runtime cheat. Work at runtime and only if Cheats is present in Commands.dat: give, vehicle, animal, experience.

Commands.dat lives at Servers/<ServerID>/Server/Commands.dat, one command per line, read once as the server boots. Lines starting with // are comments. The gameplay numbers - loot rates, zombie health, vehicle respawns - are not here; they are in the separate difficulty config covered in the Unturned server setup guide. Commands.dat decides what the server is. The config decides how it plays.

Commands.dat: everything you can set at boot#

The config-only commands, the ones that must be in the file because there is nowhere else to put them:

And the ones that work in the file or live in the console:

A worked file for a small survival server, with the comments the game itself allows:

// identityName Thursday SurvivalOwner 76561198012345678Welcome Rules are in Discord. No offline raiding./255/200/0// worldMap WashingtonMode NormalPerspective BothMaxPlayers 24Queue_Size 8Cycle 3600// connectionPort 27015Timeout 400Chatrate 1.0FilterLog Y/Y/Y/Y// listingGSLT 0123456789ABCDEF0123456789ABCDEF

Four of those repay a second look. Timeout is not a timeout at all - it is a maximum ping, and 750 is generous enough that a player at the far end of the world stays connected while lagging visibly for everyone near them. Dropping it to 400 on a regional server is a real quality improvement and an unpopular one.

Log Y/Y/Y/Y turns on chat, join and leave, death and anti-cheat logging, and it is off by default. Turn it on before you need it, because the first time you want to know who blew up a base, the logs either exist or they do not. Logs worth keeping covers what to retain and for how long.

Password is worth one warning of its own: the game stores it as a SHA-1 hash, so treat it as a door key for a group of friends and never reuse a password you use anywhere else.

Port takes two consecutive ports, 27015 for queries and 27016 for game traffic. Running a second server on the same machine means Port 27017, not 27016, or the two collide. Game server ports explained has the general version of this trap. The GSLT line is a credential you create yourself against Unturned's app id 304930 - Steam game server tokens explained covers what one is, who may create one and what gets one banned.

Runtime commands: moderation, cheats and the console#

These are typed into the server console, or into chat by an administrator with / or @ in front. The moderation set:

The world and housekeeping set:

And the cheat set, which needs Cheats in Commands.dat: give, vehicle, animal, experience, reputation, flag, quest. Leaving Cheats on for a public server is a decision, not an oversight - it means every administrator can spawn anything, and the only record of it is whatever you set Log to.

save deserves emphasis because the vanilla server has no autosave at all. Nothing writes player structures, vehicles and inventories to disk on a timer. shutdown saves; a kill, a crash or an out-of-memory stop does not. Until you install RocketMod, which adds one, a scheduled save is the only thing standing between your server and a lost week.

Admins, whitelists and bans#

Three plain text files sit in Servers/<ServerID>/Server/, one identifier per line:

Adminlist.dat     administratorsBlacklist.dat     bansWhitelist.dat     the allow list, used when Whitelisted is set

The Owner command in Commands.dat is separate and stronger: it grants permanent administrator rights to one SteamID64 without touching Adminlist.dat, and it is the right place for your own account. Everyone else goes through admin at runtime, which writes to the list for you.

Whitelisted in Commands.dat flips the server to allow-list-only. From that point nobody joins unless their ID is in Whitelist.dat or was added with permit. The Tag parameter on permit is a label for your own benefit - it shows up when you print the list, which on a 200-slot whitelist is the difference between a usable file and a wall of numbers.

Getting a player's SteamID64 is easiest with investigate <name> while they are connected. Copying it from a profile URL works too, but half of Unturned's player base has a vanity URL rather than a numeric one, and people paste the vanity string into Adminlist.dat and wonder why nothing happened.

Installing RocketMod (LDM)#

RocketMod is the plugin framework almost every Unturned plugin targets. Its history matters for one practical reason: the original maintainers stopped work in December 2019 and released the source under the MIT licence, Smartly Dressed Games forked it to keep it in step with the game, and in June 2020 the fork was rebranded Legally Distinct Missile at the original author's request. LDM is the version you want. It keeps compatibility with existing plugins and carries fixes for legacy Rocket problems including multithreading exceptions and a teleportation exploit.

You do not need to download it. The dedicated server ships it:

1. Stop the server.
2. Copy the Rocket.Unturned folder from the server's Extras directory.
3. Paste it into the server's Modules directory.
4. Start the server, and watch for Rocket in the startup log. modules in the console confirms it loaded.

On first start Rocket creates its own folder inside the instance, and from then on this is where plugin work happens:

Servers/MyServer/Rocket/  Rocket.config.xml              core settings, RCON, automatic shutdown  Rocket.Unturned.config.xml     the Unturned-specific module settings  Permissions.config.xml         groups, members, permissions  Commands.config.xml            enable, disable and re-prioritise commands  Rocket.en.translation.xml      message strings  Plugins/                       plugin DLLs and their config files  Libraries/                     shared dependencies  Logs/                          Rocket.log, rotated on start

Unturned servers on RE:NODE ship with RocketMod already in place, so the module is installed and this folder exists after the first boot - you add plugins through the file manager or over SFTP. There is no allow-list of permitted plugins; what you upload is what runs, which is also a good reason to look at a plugin's source before you hand it your server.

Rocket.config.xml and what it turns on#

Four blocks matter. The shipped defaults, with the things worth changing marked by their consequences:

<RocketSettings>  <RCON Enabled="false" Port="27115" Password="changeme"        EnableMaxGlobalConnections="true" MaxGlobalConnections="10"        EnableMaxLocalConnections="true" MaxLocalConnections="3" />  <AutomaticShutdown Enabled="false" Interval="86400" />  <WebConfigurations Enabled="false" Url="" />  <WebPermissions Enabled="false" Url="" Interval="180" />  <LanguageCode>en</LanguageCode>  <MaxFrames>60</MaxFrames></RocketSettings>

RCON is off by default with a password of changeme, and if you turn it on without changing that you have published a remote console to the internet. Rocket's RCON is a plain TCP socket on port 27115; it is not encrypted and it is not rate-limited beyond the connection counts above. Turn it on only if something actually needs it, change the password, and restrict who can reach the port. RCON safely covers the general rules, and they apply here with more force than usual.

AutomaticShutdown with Interval="86400" is a once-a-day restart, off by default. It is a reasonable thing to switch on for a survival server, though a scheduled restart from your panel gives you a warning message and a backup first, which this does not. Restart schedules that help covers picking a time.

The Unturned-side module file is the more interesting one:

<UnturnedSettings>  <RocketModObservatory KickLimitedAccounts="true"                        KickTooYoungAccounts="true"                        MinimumAge="604800" />  <AutomaticSave Enabled="true" Interval="1800" />  <CharacterNameValidation>true</CharacterNameValidation>  <LogSuspiciousPlayerMovement>true</LogSuspiciousPlayerMovement>  <EnableItemBlacklist>false</EnableItemBlacklist>  <EnableItemSpawnLimit>false</EnableItemSpawnLimit>  <MaxSpawnAmount>10</MaxSpawnAmount>  <EnableVehicleBlacklist>false</EnableVehicleBlacklist></UnturnedSettings>

AutomaticSave is the headline: enabled, every 1800 seconds. Installing RocketMod gives an Unturned server the half-hourly autosave it otherwise lacks entirely. If your server is busy and building-heavy, halve that interval; the save is brief and half an hour of lost construction is not.

KickLimitedAccounts and KickTooYoungAccounts with MinimumAge="604800" reject Steam accounts that are limited or less than seven days old. On a public server this removes a meaningful share of throwaway griefing accounts for free, and it also blocks the occasional legitimate new player, so it is a trade rather than a win.

Permissions: groups, inheritance and cooldowns#

Permissions.config.xml is where most "the plugin does not work" reports actually end. A plugin's commands are not available to anybody until a group holds their permission node, and the node is simply the command's name.

<RocketPermissions>  <DefaultGroup>default</DefaultGroup>  <Groups>    <Group>      <Id>default</Id>      <DisplayName>Guest</DisplayName>      <Color>white</Color>      <Members />      <Permissions>        <Permission>p</Permission>        <Permission>compass</Permission>        <Permission>rocket</Permission>      </Permissions>    </Group>    <Group>      <Id>vip</Id>      <DisplayName>VIP</DisplayName>      <Color>FF9900</Color>      <ParentGroup>default</ParentGroup>      <Members>        <Member>76561198012345678</Member>      </Members>      <Permissions>        <Permission>kit.*</Permission>        <Permission Cooldown="120">heal</Permission>        <Permission Cooldown="30">v</Permission>      </Permissions>    </Group>  </Groups></RocketPermissions>

Four mechanics are doing all the work here:

• `DefaultGroup` names the group everyone lands in without being listed anywhere. Whatever it holds, every player has.
• `ParentGroup` gives inheritance. vip inherits everything default has and adds its own, so you never repeat a node.
• `Members` is a list of SteamID64s. This is the only place a player is tied to a group, other than the /p command.
• `Cooldown` is per-permission and in seconds. Cooldown="120" on heal means a VIP can heal once every two minutes. This is the feature that makes a perks system survivable, and it is set nowhere else.

Wildcards work on dotted nodes: kit.* grants every kit a kit plugin defines, where kit.starter would grant one. Colours take a name or a hex value without a leading hash.

Changes to this file are picked up with /p reload rather than a restart. /p <player> <group> moves somebody between groups live, which is how you hand out a rank without opening a file at all. The same least-privilege thinking that applies to panel accounts applies here - subusers and least privilege makes the general argument, and it is the same argument: nobody needs tp because they moderate chat.

Rocket's own commands are governed by that file. The vanilla commands in the earlier tables are not: they check administrator status and nothing else. Two systems, side by side, and a player can be a Rocket VIP with no vanilla powers or a vanilla admin with no Rocket permissions.

The built-in Rocket commands, all of which are permission nodes you can hand out:

Plugins and OpenMod#

A plugin is a .dll dropped into Rocket/Plugins/. On first load it writes <PluginName>.configuration.xml and <PluginName>.en.translation.xml beside itself, which is your cue that it loaded at all - no config file means no load, and Rocket/Logs/Rocket.log will say why. Shared dependencies go in Libraries/. rocket reload <plugin> picks up a changed configuration without stopping the server.

The order of operations that avoids most grief:

1. Stop the server, or at least know you will reload afterwards.
2. Drop the DLL into Plugins/ and start the server.
3. Read the log. Confirm the plugin loaded and wrote its config.
4. Stop, edit the config it generated, start again.
5. Grant its permission nodes to a group in Permissions.config.xml.
6. Test as a non-admin account. Admins bypass enough that testing as one proves nothing.

Step five is the one that gets skipped, and it produces the classic symptom: a plugin that loads cleanly, logs nothing, and ignores every command typed at it. Before you conclude a plugin is broken, check its node is in a group the tester belongs to.

OpenMod is the newer framework, written by one of Rocket's original maintainers, and it does not replace RocketMod - it runs alongside it and can host Rocket plugins through a compatibility layer. The easy install is the OpenMod installer plugin: drop it into Rocket/Plugins/, restart, run /openmod install and follow the prompts. The manual route copies an OpenMod.Unturned folder into Modules/ and takes a long first start while it downloads its own components. Pick whichever framework the plugins you actually want are published for; there is no need to choose ideologically.

Whatever you install, take the backup first. Player structures, vehicles and inventories live in the instance's save files and a plugin that deletes them has no undo. Back up the instance folder on a schedule and restore one occasionally to prove the backup works, because a backup nobody has restored is a hypothesis. The general hygiene for a modded server - pinning versions, reading source, removing what you stopped using - is in keeping a modded server clean, and workshop content follows its own rules covered in Steam Workshop mods on dedicated servers.

Troubleshooting#

A command in `Commands.dat` does nothing. It is a runtime command. kick, ban, say and teleport only exist while the server is up.

The server keeps loading PEI. Map does not match an installed level name. It is the internal name, not the display name, and a missing workshop map produces the same result.

Edits to `Commands.dat` disappear. The server was running when you saved. Stop, edit, start.

Rocket did not load. Run modules in the console. If Rocket.Unturned is not listed, the folder was not copied from Extras into Modules, or it was copied one level too deep.

A plugin loaded but its commands are ignored. Permissions, nine times out of ten. Add the node to a group in Permissions.config.xml, run /p reload, and test as a normal player.

A plugin wrote no config file. It did not load. Rocket/Logs/Rocket.log will name the missing dependency or the version mismatch.

Players are kicked the moment they join. KickLimitedAccounts or KickTooYoungAccounts in Rocket.Unturned.config.xml, or Filter in Commands.dat rejecting their name, or Whitelisted with an empty allow list.

Progress is lost after a crash. Vanilla Unturned has no autosave. Install RocketMod for its 30-minute AutomaticSave, shorten the interval, and schedule a save command as well.

RCON refuses connections or accepts the wrong ones. Port 27115, a password that is still changeme, and connection limits that are lower than you think. Check all three before assuming a firewall.

FAQ#

What is the difference between Commands.dat and the config file?

Commands.dat sets what the server is - name, map, port, slots, owner, password, token. The difficulty config sets how the game plays - loot chance, zombie damage, vehicle respawn times. They never overlap, and almost every "which file do I edit" question is answered by that split.

Is RocketMod still maintained?

Yes, as Legally Distinct Missile, maintained by Smartly Dressed Games since the original team stepped away in December 2019. It ships with the dedicated server in the Extras folder, so the copy you install is always current with the game build.

Why does my plugin load but do nothing?

Its commands have no permission node granted to the group the player is in. Open Permissions.config.xml, add the command's name as a Permission in the right group, and run /p reload. Test as a non-admin, because administrators bypass enough checks to hide the problem.

Can I run RocketMod and OpenMod together?

Yes. OpenMod was designed to sit alongside Rocket rather than replace it, and it can run Rocket plugins through a compatibility layer. The installer plugin route sets both up in a few minutes.

Does Unturned autosave?

Not in vanilla. The base server saves on a clean shutdown and when you type save, and at no other time. RocketMod adds an AutomaticSave every 1800 seconds, which is the single best reason to install it even on a server with no plugins.

How do I limit a perk without giving it away?

Use the Cooldown attribute on the permission rather than a plugin setting: <Permission Cooldown="120">heal</Permission> allows one heal every two minutes. Cooldowns are per-permission and per-group, so the same command can be generous for staff and rationed for donors.