RustDesk is an open-source remote desktop application, an alternative to TeamViewer and AnyDesk. By default, clients use public RustDesk servers to find each other and relay traffic. Self-hosting the server on your own VPS gives you control and privacy, often better speed, and no dependence on public infrastructure. It’s popular with IT support teams and anyone managing family computers.

How it works

The free server has two components:

  • hbbs: the ID/rendezvous server. Clients register their ID with it and find each other.
  • hbbr: the relay server. When a direct peer-to-peer connection isn’t possible (NAT, firewalls), traffic is relayed through it.

Connections are end-to-end encrypted between the clients. A key pair on the server makes sure clients only use your server.

Requirements

  • A small VPS: 1 vCPU and 1 GB RAM is enough. CPU use is low.
  • Bandwidth is what matters for relayed sessions: a remote desktop stream uses roughly 1–5 Mbps or more, depending on resolution and activity. See VPS bandwidth explained.
  • Location: close to the people involved, for low latency. For support between mainland China and elsewhere, a route-optimised location such as Hong Kong or Tokyo helps. See Hong Kong VPS and choosing a VPS location.

Install with Docker Compose

# /opt/rustdesk/compose.yaml
services:
  hbbs:
    image: rustdesk/rustdesk-server:latest
    command: hbbs
    restart: unless-stopped
    volumes:
      - ./data:/root
    network_mode: host
    depends_on: [hbbr]
  hbbr:
    image: rustdesk/rustdesk-server:latest
    command: hbbr
    restart: unless-stopped
    volumes:
      - ./data:/root
    network_mode: host
cd /opt/rustdesk && docker compose up -d
cat data/id_ed25519.pub     # the public key clients need

Host networking keeps it simple, and lets hbbs see real client IPs (which helps with hole-punching). A native option is also available: the .deb packages from the rustdesk-server releases.

Firewall

Port Protocol Component Purpose
21115 TCP hbbs NAT type test
21116 TCP and UDP hbbs ID registration, heartbeat, hole-punching
21117 TCP hbbr Relay
21118, 21119 TCP hbbs/hbbr Web client only, optional 
sudo ufw allow 21115:21117/tcp
sudo ufw allow 21116/udp

See UFW.

Configure clients

On every computer: RustDesk → Settings → Network → ID/Relay server:

  • ID server: rd.example.com (a DNS A record to your VPS)
  • Relay server: rd.example.com (optional; derived from the ID server if empty)
  • Key: the contents of id_ed25519.pub

Both sides of a connection must use the same server and key. For many machines, distribute the configuration via a config string. Some builds let you rename the installer to embed the host and key. Check the current docs.

Security

  • Keep the private key (id_ed25519) secret. Back it up. If you lose it, every client must be reconfigured with a new key.
  • With the key set, hbbs refuses clients without it (-k _ was required in older versions; recent versions enforce it by default). Verify this, so strangers can’t use your relay bandwidth.
  • On each client, set a strong permanent password, or require accepting connections manually. Enable 2FA where offered.
  • Keep the server and clients updated.

Troubleshooting

  • “Key mismatch”: the client key doesn’t match the server key. Copy it again exactly.
  • Connects but slow: the session is relayed. Check the relay’s bandwidth and location. Direct P2P needs UDP 21116 open.
  • ID stays offline: the client can’t reach 21116 (TCP/UDP). Check the firewall and DNS, and see docker compose logs hbbs.

Pro version

RustDesk Server Pro (paid) adds a web console, address books, user accounts, access control, and audit logs. The open-source server is enough for personal use and small teams.

Quick reference

Item Value
Components hbbs (ID) + hbbr (relay)
Ports 21115–21117 TCP, 21116 UDP
Client key data/id_ed25519.pub
Back up data/id_ed25519*
Logs docker compose logs hbbs hbbr

Related: Apache Guacamole and WireGuard VPN.

  • Self-Hosting
  • Remote Desktop
  • Docker