RustDesk

Last reviewed Aug 23, 2026 · 717 words

RustDesk is the open-source TeamViewer you stop paying for: cross-platform remote desktop that works out of the box through the project's public servers, and — the reason it belongs in a self-hoster's stack — a rendezvous/relay server you can run yourself in two small containers. Self-hosting the server is what turns it from "free TeamViewer clone" into infrastructure you control: your traffic meets your machines only.

How the pieces fit

Three components: the clients (Windows, macOS, Linux, iOS, Android), hbbs (the ID/rendezvous server that introduces two clients to each other and brokers a direct connection), and hbbr (the relay that carries the session when NAT traversal fails and a direct link is impossible). Most sessions go direct after introduction; the relay is the fallback, and it's the component the catalogue's "bandwidth heavy" warning is about — a relayed 1080p session streams through your server for its whole duration, so a home upload link or small VPS needs that in the mental budget.

The server in one compose file

services:
  hbbs:
    image: rustdesk/rustdesk-server:latest
    command: hbbs -k _
    network_mode: host
    volumes:
      - ./data:/root
    restart: unless-stopped
  hbbr:
    image: rustdesk/rustdesk-server:latest
    command: hbbr -k _
    network_mode: host
    volumes:
      - ./data:/root
    restart: unless-stopped

Open 21115–21117/tcp, 21116/udp (plus 21118–21119/tcp if you want the web client) to wherever clients will connect from. On first run hbbs writes a keypair into ./data; the public half (id_ed25519.pub) is your server's identity. The -k _ flag is the important security decision: it makes the server refuse any client that doesn't present your public key, so your relay never becomes free infrastructure for strangers who scan for open RustDesk servers — which absolutely happens.

Point the clients home

On every client: Settings → Network → ID/Relay server. Enter your server's address as the ID server and paste the contents of id_ed25519.pub into the Key field. Leave the relay field blank — hbbs advertises its companion hbbr automatically. For a fleet, the cleaner path is baking the config in: RustDesk supports client builds and deployment flags that pre-set server and key, so family machines can't drift back to the public servers. Verify success in one step: the client's home screen says "Ready" with your server's ID, and a test session between two machines on different networks confirms the relay path works before the day you need it urgently.

Unattended access, done carefully

The reason to run RustDesk instead of ad-hoc screen sharing is standing access to your own machines and the family support burden — mum's laptop, the offsite PC. Set a strong permanent password per machine (Settings → Security → Unattended access), keep "verification" prompts on for machines with humans at them, and treat the permanent-password list like the credentials they are. This is also where the threat-modeling questions earn their keep: every machine with unattended access enabled is reachable by anyone holding its ID and password, gated only by your server's key requirement. The full server walkthrough, including hardening and the relay-bandwidth arithmetic, is in self-hosting RustDesk.

When RustDesk is the wrong layer

If every machine involved is yours and technical, a mesh VPN plus native tools can beat a remote-desktop stack: Tailscale makes RDP/VNC/SSH to your own machines trivial, with no relay server to feed. RustDesk wins wherever the far end is a human who needs to click one thing — cross-platform support sessions, the relative who can read you a 9-digit ID but will never install a VPN — and for full-fidelity desktop control on machines you'd rather not join to your tailnet. Many of us run both; the division of labour in remote access three ways applies cleanly.

What I'd do

The two containers above on a small VPS (a $5 instance handles a household's relay needs), key enforcement on, ports 21115–21117 open, clients configured with server plus key, unattended passwords in the password manager. Total setup is under half an hour, and the running cost of never again hearing "TeamViewer says commercial use detected" is roughly zero.