[{"data":1,"prerenderedAt":221},["ShallowReactive",2],{"seo-verification":3,"blog-rustdesk-replace-teamviewer-with-a-self-hosted-server-ma-en":6,"promo-bar-likely":207},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-rustdesk-replace-teamviewer-with-a-self-hosted-server-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":152,"ctaBody":153,"ctaButton":154,"ctaUrl":155,"relatedPosts":156},222,"rustdesk-replace-teamviewer-with-a-self-hosted-server",{"fr":12,"en":10,"ar":13,"es":14},"rustdesk-bureau-distance-self-hosted-vps","rustdesk-استبدال-teamviewer-بخادم-self-hosted","rustdesk-escritorio-remoto-self-hosted-vps","RustDesk: self-hosted remote desktop on a VPS","Host your own RustDesk relay server on a VPS for private remote desktop sessions — no third-party relay, full TLS, and access control.",13,2,false,"2026-08-04T00:00:00+00:00","2026-09-29T14:40:44+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Frustdesk-bureau-distance-self-hosted-vps-poster.svg","TeamViewer and AnyDesk charge high annual license fees while routing every session through their own infrastructure. RustDesk, open source under AGPL-3.0, flips that model: you deploy two lightweight services on your VPS, traffic never leaves your infrastructure, and end-to-end encryption is guaranteed by design — not by contract. This guide covers the full architecture, step-by-step deployment, TLS configuration, access control and ongoing maintenance.",[35,39,50,53,56,81,84,87,90,142,146,149],{"type":36,"title":37,"body":38},"h2","Why self-host your remote desktop server","Commercial solutions like TeamViewer and AnyDesk share one characteristic: every connection passes through their relay infrastructure, regardless of the actual distance between the two machines. This creates three concrete problems.\n\n**Privacy and compliance.** Data flows through third-party servers subject to the legislation of their host country. For IT providers accessing financial, medical or legal systems, this implicit delegation can invalidate a compliance agreement (GDPR, ISO 27001, HIPAA). Self-hosted RustDesk eliminates this dependency: encrypted traffic stays in your datacenter.\n\n**Vulnerability history.** TeamViewer has experienced several notable incidents — in 2016, thousands of accounts were compromised via credential stuffing; in 2024, an intrusion into the corporate environment was attributed to an APT group. These incidents do not implicate the protocol, but highlight that depending on a third party means depending on their attack surface.\n\n**License cost.** TeamViewer Business starts at over €600\u002Fyear for a single concurrent user. AnyDesk is cheaper but still follows a per-seat model. Self-hosted RustDesk reduces costs to your VPS alone — a ServOrbit VPS starting at 99 DH\u002Fmonth handles an entire team.",{"type":40,"title":41,"items":42},"ul","What self-hosted RustDesk gives you",[43,44,45,46,47,48,49],"**No session limits** — no per-seat license or concurrent connection quota; your server serves as many users as your VPS can handle","**Guaranteed end-to-end encryption** — Ed25519 curve for key exchange, ChaCha20-Poly1305 for the video stream and keyboard\u002Fmouse inputs: your server's public key is embedded in the client, making interception structurally impossible","**Controlled latency** — your relay is in the datacenter of your choice; by picking the region closest to your teams, RTT is consistently lower than a generic SaaS relay based in Northern Europe","**Cross-platform clients** — Windows, macOS, Linux, Android, iOS and web browser from a single central server, without different configurations per platform","**Custom IDs** — assign memorable identifiers (`SERVER-DB-01`, `LAPTOP-ALICE`) instead of the random numeric IDs generated by default","**Built-in REST API** — RustDesk Server Pro exposes a REST API to query connection status, list registered machines and automate provisioning via your own scripts or a CMDB","**Full session audit log** — every connection, disconnection and file transfer is timestamped and logged server-side; essential for environments with traceability requirements",{"type":36,"title":51,"body":52},"RustDesk architecture: hbbs and hbbr","RustDesk separates the signaling role from the relay role into two distinct processes.\n\n**hbbs — the rendezvous server (ID Server).** This is the entry point. Each RustDesk client that starts registers with a numeric (or custom) identifier. When a connection is initiated, both parties contact `hbbs` to exchange IP addresses and attempt a direct P2P connection. `hbbs` listens on TCP ports 21115 and 21116, as well as UDP 21116.\n\n**hbbr — the relay server.** If the P2P connection fails (symmetric NAT, restrictive firewall), traffic is relayed via `hbbr`. The relay only sees encrypted streams — it cannot read the content. `hbbr` listens on TCP port 21117.\n\n**Connection flow.** Machine A contacts `hbbs` via TCP to obtain machine B's address. Both machines attempt a direct UDP connection (hole punching). If it succeeds, `hbbr` is not involved and latency is minimal. If it fails, `hbbs` provides A with the address of `hbbr` to relay — with a slight overhead of a few milliseconds. In practice, P2P succeeds on the majority of home and enterprise networks that don't have strict NAT.",{"type":36,"title":54,"body":55},"VPS requirements","**Minimum resources.** 1 GB RAM and 1 vCPU are sufficient for up to approximately 20 simultaneous relay connections. Beyond that, the limiting factor is bandwidth: a Full HD stream encodes at approximately 2-4 Mbit\u002Fs. For 50 simultaneous relay connections, plan for 2 vCPU, 2 GB RAM and a VPS with a guaranteed throughput of at least 200 Mbit\u002Fs.\n\n**Ports to open.**\n- TCP 21115 — NAT negotiation\n- TCP 21116 — ID registration\n- UDP 21116 — P2P hole punching\n- TCP 21117 — relayed stream\n- TCP 21118 and 21119 — web client (optional)\n- TCP 443 — admin HTTPS interface (if enabled)\n\n**Required software.** Docker Engine 24+ and Docker Compose v2 (`docker compose` without hyphen). A domain name or subdomain is recommended to expose the admin interface behind TLS — otherwise admin connections use plain HTTP.",{"type":57,"title":58,"steps":59},"steps","Deploy RustDesk Server on a VPS",[60,63,66,69,72,75,78],{"title":61,"body":62},"Create the directory and docker-compose.yml","Create the directory structure and Compose file:\n\n```bash\nmkdir -p \u002Fopt\u002Frustdesk\u002Fdata\ncd \u002Fopt\u002Frustdesk\n```\n\nContents of `docker-compose.yml`:\n\n```yaml\nservices:\n  hbbs:\n    image: rustdesk\u002Frustdesk-server:latest\n    command: hbbs\n    ports:\n      - \"21115:21115\"\n      - \"21116:21116\"\n      - \"21116:21116\u002Fudp\"\n      - \"21118:21118\"\n    volumes:\n      - .\u002Fdata:\u002Froot\n    restart: unless-stopped\n    depends_on:\n      - hbbr\n\n  hbbr:\n    image: rustdesk\u002Frustdesk-server:latest\n    command: hbbr\n    ports:\n      - \"21117:21117\"\n      - \"21119:21119\"\n    volumes:\n      - .\u002Fdata:\u002Froot\n    restart: unless-stopped\n```\n\nThe shared `.\u002Fdata` volume ensures that `hbbs` and `hbbr` use the same key pair generated on first startup.",{"title":64,"body":65},"Start containers and retrieve keys","Start both services in the background:\n\n```bash\ndocker compose up -d\n```\n\nOn first startup, `hbbs` automatically generates an Ed25519 key pair in `.\u002Fdata\u002F`. Retrieve the public key:\n\n```bash\ncat \u002Fopt\u002Frustdesk\u002Fdata\u002Fid_ed25519.pub\n```\n\nNote this value — you'll need it to configure each client. Without it, clients will refuse to connect to your server. Also keep `id_ed25519` (private key) in a secure location; if it's compromised, all clients will need to be reconfigured with a new key.",{"title":67,"body":68},"Configure the firewall (TCP\u002FUDP ports)","Open the necessary ports in `ufw`:\n\n```bash\nufw allow 21115\u002Ftcp\nufw allow 21116\u002Ftcp\nufw allow 21116\u002Fudp\nufw allow 21117\u002Ftcp\nufw allow 21118\u002Ftcp\nufw allow 21119\u002Ftcp\nufw reload\n```\n\nIf your VPS is also protected by a network firewall in the ServOrbit panel, apply the same rules there. Then verify that the ports are listening:\n\n```bash\nss -tlnup | grep -E '2111[5-9]'\n```",{"title":70,"body":71},"Expose the admin interface behind an HTTPS reverse proxy","RustDesk Server Pro provides a web admin interface on port 21114 (HTTP). To expose it over HTTPS, add nginx as a reverse proxy.\n\nMinimal nginx vhost for `rustdesk.your-domain.com`:\n\n```nginx\nserver {\n    listen 443 ssl;\n    server_name rustdesk.your-domain.com;\n    ssl_certificate \u002Fetc\u002Fletsencrypt\u002Flive\u002Frustdesk.your-domain.com\u002Ffullchain.pem;\n    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Frustdesk.your-domain.com\u002Fprivkey.pem;\n    location \u002F {\n        proxy_pass http:\u002F\u002F127.0.0.1:21114;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n    }\n}\n```\n\nObtain the certificate with Certbot:\n\n```bash\ncertbot --nginx -d rustdesk.your-domain.com\n```",{"title":73,"body":74},"Configure desktop clients (Windows, macOS, Linux)","Download the RustDesk client from [rustdesk.com](https:\u002F\u002Frustdesk.com) and open the network settings (gear icon → Network). Enter:\n- **ID Server**: your VPS IP address or domain name\n- **Relay Server**: same value\n- **Key**: the value copied from `id_ed25519.pub`\n\nConfirm. The connection indicator turns green if the server is reachable and the key is correct. From this point, no connection attempts will go through the public RustDesk servers.",{"title":76,"body":77},"Configure mobile clients (Android and iOS)","On Android, install RustDesk from the Play Store or directly via APK (useful if the Play Store is restricted on some enterprise devices). On iOS, RustDesk is available on the App Store.\n\nIn both cases, go to Settings → ID\u002FRelay Server and enter the same values as for the desktop client: server address and public key. The key can be shared via QR code from the RustDesk Server Pro admin interface, which simplifies mass deployment on mobile fleets.",{"title":79,"body":80},"Test an end-to-end connection","On two machines configured with your server, note the identifier displayed on the target machine. From the source machine, enter this identifier in the RustDesk connection field and initiate the session.\n\nCheck the logs to confirm the connection is going through your infrastructure:\n\n```bash\ndocker logs rustdesk-hbbr-1 --tail 20\n```\n\nA line containing `[RELAY]` indicates the relay is being used (strict NAT). A `[DIRECT]` line or no line in the `hbbr` logs indicates a direct P2P connection — ideal for latency.",{"type":36,"title":82,"body":83},"Configuring TLS for secure connections","By default, RustDesk streams are end-to-end encrypted with ChaCha20-Poly1305 — additional TLS is not required for the remote desktop sessions themselves. However, the admin interface (port 21114) and the REST API run in plain HTTP if you don't protect them.\n\n**Option 1: Certbot + nginx (recommended).** As shown in step 4, nginx acts as a reverse proxy in front of port 21114. Certbot renews the certificate automatically via a systemd timer.\n\n**Option 2: Traefik as edge proxy.** If you already use Traefik for other services on the same VPS, simply add labels to the `hbbr` service in Compose:\n\n```yaml\nlabels:\n  - \"traefik.enable=true\"\n  - \"traefik.http.routers.rustdesk-admin.rule=Host(`rustdesk.your-domain.com`)\"\n  - \"traefik.http.routers.rustdesk-admin.tls.certresolver=letsencrypt\"\n  - \"traefik.http.services.rustdesk-admin.loadbalancer.server.port=21114\"\n```\n\n**What stays unencrypted by design.** Ports 21115-21119 don't use HTTPS because they use their own binary protocols. Encryption of these streams is handled by Ed25519 and ChaCha20 keys — not TLS. Do not attempt to force HTTPS on these ports.",{"type":36,"title":85,"body":86},"Enabling authentication and access control","The open source version of RustDesk Server has no native authentication interface — any client that knows your public key can attempt to connect to a registered machine (if that machine accepts the request). RustDesk Server Pro (self-hostable, free for up to 20 users) adds several control layers.\n\n**User accounts and groups.** The admin interface lets you create named accounts, group them and define access policies per group. A technician can have access only to the 'Infrastructure' group machines, not HR workstations.\n\n**Connection approval.** Each machine can be configured to require physical confirmation from the local user before allowing remote control — the 'Accept connection' dialog appears on the target machine's screen.\n\n**Full audit trail.** Every event (connection initiated, accepted, refused, duration, file transfer) is recorded with the initiator's identity and timestamp. Logs are exportable as CSV from the admin interface.\n\n**Disabling public servers.** To force exclusive use of your server — without falling back to public RustDesk relays if your server is unavailable — add the `--key` option with your private key to the `hbbs` command. Clients configured with your public key will then refuse any alternative server, including the official RustDesk server.",{"type":36,"title":88,"body":89},"Optimizing image quality and performance","RustDesk uses its own video codec by default (VP9 or H.264 depending on the platform) with adaptive quality based on detected bandwidth. Several levers let you tune this behavior.\n\n**Image quality.** In the client settings, 'Image quality' can be set to Low, Medium, High or Custom. In enterprise environments on a LAN or a nearby VPS, 'High' is usable without saturating bandwidth. On a mobile or long-distance connection, 'Medium' reduces perceived latency.\n\n**Codec.** RustDesk automatically selects the most suitable codec: H.265 if both endpoints have hardware encoding\u002Fdecoding, VP9 otherwise. On a VPS without a GPU, VP9 is the default — reasonable in CPU for office-type streams. Avoid forcing H.264 on a low-CPU VPS if you have multiple simultaneous connections.\n\n**P2P vs relay.** A direct P2P connection is always preferable: it avoids the extra hop through `hbbr`, removing the relay intermediary and lowering round-trip time. If your users connect from the same LAN as the target machine, check that the firewall doesn't block direct UDP connections between hosts — RustDesk tries P2P first before falling back to relay.",{"type":91,"title":92,"headers":93,"rows":99},"comparison","RustDesk vs TeamViewer vs AnyDesk vs Guacamole",[94,95,96,97,98],"Criteria","RustDesk (self-hosted)","TeamViewer","AnyDesk","Guacamole",[100,105,111,117,123,127,132,137],[101,102,103,103,104],"Hosting model","Self-hosted (VPS)","SaaS (cloud vendor)","Self-hosted (web server)",[106,107,108,109,110],"License cost","Free (OSS) \u002F Pro paid","From €600\u002Fyear\u002Fuser","From €180\u002Fyear\u002Fuser","Free (Apache 2.0)",[112,113,114,115,116],"Protocol","Proprietary encrypted (Ed25519 + ChaCha20)","Proprietary (RDP\u002FVNC hybrid)","DeskRT (proprietary codec)","VNC \u002F RDP \u002F SSH via browser",[118,119,120,121,122],"P2P connection","Yes (with relay fallback)","No (always via cloud)","Yes (with fallback)","No (central proxy)",[124,125,125,125,126],"Native mobile clients","Android + iOS native","Browser only",[128,129,130,130,131],"Audit log","Yes (Pro)","Yes (Business+)","Limited (raw server logs)",[133,129,134,135,136],"REST API","Yes (paid)","No (third-party API)","Yes (partial REST)",[138,139,140,141,139],"Data sovereignty","Total (your infra)","None (TeamViewer cloud)","Partial (AnyDesk relay)",{"type":143,"title":144,"body":145},"tip","Enterprise deployment: mass-provisioning clients","RustDesk supports automatic configuration via a configuration file embedded in the client executable. When building or packaging for your fleet, place a `RustDesk2.toml` file in the configuration directory with your values:\n\n```toml\nrelay-server = \"your-vps.example.com\"\nid-server = \"your-vps.example.com\"\nkey = \"\u003Cyour_ed25519_public_key>\"\n```\n\nOn Windows, this file goes in `%APPDATA%\\RustDesk\\config\\`. On Linux, in `~\u002F.config\u002Frustdesk\u002F`. You can deploy this configuration via your fleet management tool (Ansible, Intune, Puppet) without user interaction. The public key and server address are pre-loaded — the user installs RustDesk and is immediately connected to your infrastructure.",{"type":36,"title":147,"body":148},"Monitoring and maintaining the server","**Docker metrics.** Monitor resource consumption in real time with `docker stats` — a CPU spike on `hbbr` indicates an unusually high number of relayed connections. If the average exceeds 80% for several minutes, consider increasing vCPU or checking whether stuck connections are generating retry loops.\n\n**Log rotation.** Containers write to stdout\u002Fstderr, managed by the Docker daemon. Add a rotation policy in `docker-compose.yml` to prevent logs from filling the disk:\n\n```yaml\nlogging:\n  driver: \"json-file\"\n  options:\n    max-size: \"10m\"\n    max-file: \"5\"\n```\n\n**Image updates.** RustDesk publishes new versions regularly. To update with minimal perceived downtime:\n\n```bash\ndocker compose pull\ndocker compose up -d\n```\n\nDocker replaces containers one by one. Sessions in progress via `hbbr` are dropped during the restart (a few seconds) — prefer updates during off-peak hours. Keys in `.\u002Fdata\u002F` are preserved — no client reconfiguration required.",{"type":36,"title":150,"body":151},"Troubleshooting common issues","**Connection impossible, ID not found.** Check that `hbbs` is running (`docker ps`) and that TCP ports 21115-21116 and UDP 21116 are reachable from outside: `nc -vz \u003Cvps-ip> 21116`. If the test fails, the network firewall (ufw or VPS rule) is blocking the port.\n\n**'Incorrect key' on the client side.** The key shown in the client doesn't match `id_ed25519.pub` on the server. Re-read the exact value with `cat \u002Fopt\u002Frustdesk\u002Fdata\u002Fid_ed25519.pub` and reconfigure the client — watch for stray spaces or newlines during copy-paste.\n\n**Always in relay mode, never P2P.** UDP hole punching fails if one of the two networks uses symmetric NAT (common on some 4G\u002F5G mobile networks and corporate VPNs). This is not a bug — the relay works correctly, with slightly higher latency. To force a diagnosis, compare `hbbr` logs with and without VPN active on the client side.\n\n**Admin interface unreachable.** Port 21114 is not exposed in the base `docker-compose.yml` — it must be added explicitly or accessed through the nginx reverse proxy shown in step 4. Also check that you're using the `rustdesk-server-pro` image (the open source version has no admin interface).\n\n**Image update without regenerating keys.** After `docker compose pull && docker compose up -d`, verify that `.\u002Fdata\u002Fid_ed25519.pub` hasn't changed — it shouldn't, but volume corruption can in rare cases regenerate the pair. If the key has changed, all clients will need to be reconfigured.","Ready to deploy your RustDesk server?","ServOrbit VPS plans include a dedicated public IP, a configurable firewall and Docker ready to use — everything you need to host your own remote desktop infrastructure in minutes.","Deploy RustDesk on VPS","\u002Fvps-cloud",[157,181,198],{"id":158,"slug":159,"slugs":160,"title":164,"excerpt":165,"readTime":166,"views":167,"isPinned":19,"noindex":19,"publishedAt":168,"updatedAt":169,"category":170,"categories":176,"featuredImage":30,"bgImage":31,"posterImage":178,"relatedSolution":179},131,"self-host-your-password-manager-deploy-vaultwarden-on-vps",{"fr":161,"en":159,"ar":162,"es":163},"deploy-vaultwarden-vps","استضف-مدير-كلمات-المرور-بنفسك-انشر-vaultwarden-على-vps","desplegar-vaultwarden-en-un-vps","Deploy Vaultwarden on a VPS: self-hosted password manager","Self-host Vaultwarden on a VPS: password management, Bitwarden compatibility, team vaults and TOTP, at a fixed monthly cost and under 50 MB of RAM.",15,3,"2026-06-24T00:00:00+00:00","2026-11-04T16:30:25+00:00",{"id":171,"name":172,"slug":173,"color":174,"icon":175},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[177],{"id":171,"name":172,"slug":173,"color":174,"icon":175},"\u002Fblog\u002Fcovers\u002Fdeploy-vaultwarden-vps-poster.svg",{"categorySlug":175,"appSlug":180},"vaultwarden",{"id":182,"slug":183,"slugs":184,"title":188,"excerpt":189,"readTime":190,"views":191,"isPinned":19,"noindex":19,"publishedAt":192,"updatedAt":193,"category":194,"categories":195,"featuredImage":30,"bgImage":31,"posterImage":197,"relatedSolution":30},204,"short-tls-certificates-automate-with-acme",{"fr":185,"en":183,"ar":186,"es":187},"certificats-tls-courts-automatiser-acme","شهادات-tls-القصيرة-أتمتة-التجديد-بـ-acme","certificados-tls-cortos-automatizar-con-acme","Short TLS certificates: automate with ACME","Let's Encrypt moves to 64-day certificates on February 10, 2027, then 45 days. Timeline, ARI and a checklist for certbot, acme.sh, Caddy, Traefik, nginx.",12,1,"2026-08-01T00:00:00+00:00","2026-10-23T13:27:09+00:00",{"id":171,"name":172,"slug":173,"color":174,"icon":175},[196],{"id":171,"name":172,"slug":173,"color":174,"icon":175},"\u002Fblog\u002Fcovers\u002Fcertificats-tls-courts-automatiser-acme-poster.svg",{"id":199,"slug":200,"slugs":201,"title":205,"excerpt":206,"readTime":167,"views":191,"isPinned":19,"noindex":207,"publishedAt":208,"updatedAt":209,"category":210,"categories":216,"featuredImage":30,"bgImage":31,"posterImage":218,"relatedSolution":219},136,"installing-docker-on-a-vps-a-clean-base-for-your-apps",{"fr":202,"en":200,"ar":203,"es":204},"demarrer-avec-docker-vps","تثبيت-docker-على-vps-قاعدة-نظيفة-لتطبيقاتك","instalar-docker-en-un-vps","Installing Docker on a VPS: A Clean Base for Your Apps","Set up a reliable Docker VPS: isolation, Compose, volumes, networking and best practices to deploy without improvising.",true,"2026-02-10T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":211,"name":212,"slug":213,"color":214,"icon":215},4,"Development","developpement","bg-warning\u002F10 text-warning","dev",[217],{"id":211,"name":212,"slug":213,"color":214,"icon":215},"\u002Fblog\u002Fcovers\u002Fdemarrer-avec-docker-vps-poster.svg",{"categorySlug":215,"appSlug":220},"docker-starter",1794270477623]