RustDesk Server

RustDesk Server is the self-hosted back end for the RustDesk remote desktop client, aimed at sysadmins and MSPs who want every remote session brokered by their own machine instead of public infrastructure. A RustDesk server setup consists of two small services, hbbs (ID/rendezvous) and hbbr (relay), that run happily on a minimal cloud VM, a spare Linux box or even a Raspberry Pi.

The open-source edition (OSS) is free under AGPL-3.0 and covers what most small teams need: device registration, NAT hole punching and relaying when a direct connection fails. The developers sell a separate RustDesk Server Pro with a web console, user accounts and audit logs; this page focuses on the free OSS server and notes where Pro differs.

RustDesk Server at a glance

What it does

• hbbs registers client IDs, answers lookups and coordinates hole punching (TCP/UDP 21116), runs the NAT type test (TCP 21115) and serves web-client connections (TCP 21118).
• hbbr relays traffic when two peers cannot connect directly (TCP 21117, plus 21119 for the web client).
• Generates an Ed25519 key pair on first start; clients that know the public key get encrypted connections to your server.
• Ships rustdesk-utils, a small CLI helper, alongside the two daemons.
• Can be configured with flags, environment variables or an .env file, for example -r to advertise a relay address and ALWAYS_USE_RELAY=Y to force all traffic through your relay.
• Version 1.1.16 fixed peers wrongly shown online after long downtime, patched a vulnerable dependency and closed an unauthenticated UDP punch-hole issue that could be abused for reflection and amplification.
• Server Pro adds a web console on TCP 21114, users and groups, LDAP/OIDC login, shared address books, access control and audit logs.

How IT teams use it

Deploy with Docker Compose (recommended)

1. On a Linux host with Docker, create a folder and a compose.yml:

services:
  hbbs:
    container_name: hbbs
    image: rustdesk/rustdesk-server:latest
    command: hbbs
    volumes:
      - ./data:/root
    network_mode: "host"
    depends_on:
      - hbbr
    restart: unless-stopped
  hbbr:
    container_name: hbbr
    image: rustdesk/rustdesk-server:latest
    command: hbbr
    volumes:
      - ./data:/root
    network_mode: "host"
    restart: unless-stopped

2. Start it with sudo docker compose up -d. Host networking matters: it lets hbbs see real client IPs instead of the Docker bridge address, and it only works on Linux.
3. Read the public key with cat ./data/id_ed25519.pub. Back up both key files; if you lose them, every client must be reconfigured.

Install from the Debian packages

1. Install the rustdesk-server-hbbs and rustdesk-server-hbbr packages for your architecture (and optionally rustdesk-server-utils) with apt install ./package.deb.
2. The packages register systemd units; check them with:

systemctl status rustdesk-hbbs rustdesk-hbbr
cat /var/lib/rustdesk-server/id_ed25519.pub

3. Logs go to /var/log/rustdesk-server/.

Open the firewall and connect clients

1. Allow inbound TCP 21115–21117 and UDP 21116 (add TCP 21118–21119 only if you use the web client). With ufw:

sudo ufw allow 21115:21117/tcp
sudo ufw allow 21116/udp

2. On each RustDesk client go to Settings > Network and enter your server’s DNS name as ID Server plus the key. Relay Server can stay empty.
3. Export that configuration as a string and apply it at install time with rustdesk.exe --config <string>.

Install and first run

Requirements. The official docs describe hardware needs as very low: the smallest cloud server is enough. Bandwidth matters more than CPU, because relayed sessions pass through hbbr; direct (hole-punched) sessions do not.

Linux. Docker is the documented first choice for simple upgrades and rollback. The .deb packages suit admins who prefer systemd services. A community install script is also referenced in the docs. Use a static public IP or a DNS name, since clients store whatever address you give them.

Windows. A 64-bit build is published as an unsigned zip. Run hbbs and hbbr as services (the docs describe PM2 or a service wrapper) and add Windows Firewall rules for the same ports. Expect SmartScreen warnings because the binaries are not signed.

Common gotchas. Forgetting UDP 21116 breaks registration and hole punching. Placing the server behind NAT without forwarding all ports causes “connecting” loops. Mixing up keys between test and production servers shows up as key mismatch errors on the client.

Limitations

• The OSS server has no web interface, user accounts, device groups or audit trail; those require Server Pro.
• There is no macOS server build.
• Updates are manual: pull the new image or package and restart; nothing tells clients the server changed.
• Relay traffic consumes your bandwidth; a busy help desk can generate a lot of it.
• Anyone who knows your server address and key can register devices on it, so treat the key as internal information.

RustDesk Server vs alternatives

MeshCentral is also free and self-hosted but gives you a full web console, agents and device groups out of the box, at the cost of a heavier Node.js stack. Apache Guacamole is a clientless HTML5 gateway for RDP, VNC and SSH rather than a broker for a dedicated client. DWService is free and browser-based but runs on the vendor’s infrastructure. RustDesk Server is the lightest option if your users already like the RustDesk client.

FAQ

Is RustDesk Server free?

The open-source edition is free under AGPL-3.0 with no device limit. Server Pro is a separate commercial product that adds a web console, user management and audit logs.

RustDesk Server OSS vs Pro: what is the difference?

OSS only brokers and relays connections. Pro adds a web console, users and groups, LDAP/OIDC sign-in, shared address books, control roles that limit what technicians can do in a session, and audit logs.

Which ports does RustDesk Server need?

TCP 21115, 21116 and 21117 plus UDP 21116. TCP 21118 and 21119 are only for the web client, and TCP 21114 is only for the Pro web console.

Can I run RustDesk Server on Windows?

Yes, a 64-bit Windows build exists as an unsigned zip, but Linux with Docker is the documented and better-tested route.

How do I set up RustDesk Server with Docker Compose?

Use the two-service compose file with host networking shown above, run docker compose up -d, then copy the key from data/id_ed25519.pub into your clients.

Where is the RustDesk server key?

In id_ed25519.pub in the hbbs working directory: the mounted data folder for Docker, or /var/lib/rustdesk-server/ for the Debian packages.

What are the RustDesk server requirements?

Very modest: a small VPS or a Raspberry Pi-class device is enough for the services. Plan bandwidth for relayed sessions and use a stable IP address or DNS name.

Last checked against official sources: 1 October 2026 (developer website: github.com). Versions and licence terms change — confirm on the developer's site before deploying in production.