RustDesk Server Setup: A Comprehensive Guide

To set up a RustDesk server, run the two open source services, hbbs (ID/rendezvous server) and hbbr (relay server), on a Linux host with Docker, open TCP 21115-21117 and UDP 21116, and copy the public key from data/id_ed25519.pub into every RustDesk client together with your server's address. On a small VPS this takes about 10 minutes, and from then on your remote sessions are brokered by your own server instead of RustDesk's public ones.

This guide was updated in October 2026 for RustDesk Server OSS 1.1.16 (released July 2026). The first version of this post used a community install script; that is still covered below, but Docker is now the method RustDesk itself recommends.

Quick answer: RustDesk server in 5 steps

1. Get a Linux server (a 1 vCPU, 1 GB VPS or a Raspberry Pi is enough) with a public IP or a DNS name such as rustdesk.example.com.
2. Install Docker: bash <(wget -qO- https://get.docker.com).
3. Download and start the official compose file: wget rustdesk.com/oss.yml -O compose.yml && sudo docker compose up -d.
4. Open TCP 21115, 21116, 21117 and UDP 21116 in the server firewall and any cloud security group.
5. In each client go to Settings > Network > ID/Relay server, enter the server address and the contents of data/id_ed25519.pub as the Key.

How a RustDesk server works

Your session is end-to-end encrypted with the server's key. When a direct connection works, the video stream does not pass through your server at all. RustDesk's docs put relay traffic at roughly 30 KB/s to 3 MB/s per 1080p session (around 100 KB/s for office work), so bandwidth matters more than CPU.

Requirements

• A Linux server: Ubuntu 24.04, Debian 12/13 or similar. RustDesk says the smallest cloud server is enough; a Raspberry Pi also works.
• A static public IP, or a DNS A record pointing at it (recommended, so you can move servers later without reconfiguring clients).
• Root or sudo access.

If you host on Oracle Cloud, remember its security list and the Ubuntu image's iptables both block ports by default; my Oracle Cloud ports fix shows both places.

Step 1: Install Docker

RustDesk's docs use Docker's convenience script:

bash <(wget -qO- https://get.docker.com)
docker --version
docker compose version

If you prefer the apt repository method, follow Docker's Ubuntu instructions. New to Docker? See my Docker beginner's guide.

Step 2: Run hbbs and hbbr with Docker Compose

mkdir -p ~/rustdesk && cd ~/rustdesk
wget rustdesk.com/oss.yml -O compose.yml
cat compose.yml

The file contains this (shown here so you can create it by hand if you prefer):

services:
  hbbs:
    container_name: hbbs
    image: rustdesk/rustdesk-server:latest
    command: hbbs
    volumes:
      - ./data:/root
    network_mode: "host"
    depends_on:
      - hbbr
    restart: unless-stopped

  hbbr:
    container_name: hbbr
    image: rustdesk/rustdesk-server:latest
    command: hbbr
    volumes:
      - ./data:/root
    network_mode: "host"
    restart: unless-stopped

network_mode: "host" matters: it lets hbbs see each client's real IP instead of Docker's 172.17.0.1, which hole punching needs. Host networking only works on Linux, and with it you do not need ports: mappings.

Start it:

sudo docker compose up -d
sudo docker compose ps
sudo docker logs hbbs

Both containers should be Up. The hbbs log shows the key being generated on first start and the ports it listens on.

Prefer docker run?

sudo docker run --name hbbs -v ./data:/root -td --net=host --restart unless-stopped rustdesk/rustdesk-server hbbs
sudo docker run --name hbbr -v ./data:/root -td --net=host --restart unless-stopped rustdesk/rustdesk-server hbbr

Step 3: Open the firewall ports

With UFW, allow SSH first so you do not lock yourself out:

sudo ufw allow OpenSSH
sudo ufw allow 21115:21117/tcp
sudo ufw allow 21116/udp
sudo ufw enable
sudo ufw status

On AWS, Azure, Google Cloud, Oracle or DigitalOcean also add the same rules to the provider's security group or cloud firewall. If your server sits at home behind pfSense, create port forwards for the same ports to the server's LAN IP.

Check from another machine that the ports answer:

nc -zv rustdesk.example.com 21116
nc -zv rustdesk.example.com 21117

Step 4: Get the public key

cat ~/rustdesk/data/id_ed25519.pub

It is one line of about 44 characters ending in =. Copy all of it. Never share id_ed25519 (without .pub): that is the private key. Back up both files; if they are lost, hbbs creates a new pair and every client needs the new key.

Step 5: Configure RustDesk clients

On each computer (the one you control from and the one being controlled):

1. Open RustDesk and click the menu next to your ID, then Network (in newer clients: Settings > Network). Unlock with admin rights if asked.
2. Click ID/Relay server.
3. ID server: rustdesk.example.com (or the IP).
4. Relay server: leave empty; the client works it out from the ID server. Set it only if hbbr runs on another host.
5. API server: leave empty (Pro only).
6. Key: paste the contents of id_ed25519.pub.
7. Click OK. The status at the bottom should change to Ready.

To roll the same settings out to many PCs, copy the config string from Settings > Network on a configured client and apply it on others:

rustdesk.exe --config <config-string>

Option: Debian packages instead of Docker

Download the rustdesk-server-hbbs and rustdesk-server-hbbr .deb files for your architecture from the GitHub releases page, then:

sudo apt install -y ./rustdesk-server-hbbr_*_amd64.deb ./rustdesk-server-hbbs_*_amd64.deb
sudo systemctl status rustdesk-hbbs rustdesk-hbbr --no-pager
cat /var/lib/rustdesk-server/id_ed25519.pub

Option: the community install script

The original method in this post was the community script by Techahold (formerly dinger1986), which installs hbbs and hbbr as systemd services and publishes ready-made client install scripts on a password-protected web page on port 8000. RustDesk's docs still link to it:

wget https://raw.githubusercontent.com/techahold/rustdeskinstall/master/install.sh
chmod +x install.sh
./install.sh

It prints the server address and key at the end. If you use it, also open TCP 8000 for the download page, and restart the services with:

sudo systemctl restart rustdesksignal
sudo systemctl restart rustdeskrelay

The generated Windows script is unsigned, so PowerShell blocks it by default. Allow it for the current session only rather than changing the machine policy:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

Update the server

cd ~/rustdesk
sudo docker compose pull
sudo docker compose up -d

The key lives in ./data, so it survives updates.

Troubleshooting

Client shows "Not ready. Please check your connection": the client cannot reach hbbs. Check the ID server spelling, that TCP and UDP 21116 are open (cloud firewall too) and that docker compose ps shows hbbs running.

"Key mismatch": the Key field does not match the server. Paste id_ed25519.pub again on both sides, with no spaces or line breaks.

Connects but always relayed or slow: direct connections need hole punching. Make sure hbbs uses network_mode: "host", and that UDP 21116 is open. Some carrier-grade NAT and strict corporate networks will always fall back to the relay on 21117.

"Connection error: Timeout": 21117 (relay) is blocked, or hbbr is down. Test with nc -zv <server> 21117.

Clients still use the public servers: the ID server field is empty on one side. Both computers need your server settings.

RustDesk OSS vs Pro

For a homelab or helping family, OSS is all you need. Pro starts to pay off when you support many users and want accounts, audit trails and a preconfigured custom client instead of typing the key on every machine.

Related guides

• AnyViewer remote desktop review for a hosted alternative.
• Docker for beginners.
• pfSense vs OPNsense if you are choosing a firewall for port forwarding at home.