How to use RustDesk for secure remote support and auditing

Why avoid public servers for remote technical support?

When thinking about remote desktop access, traditional tools make life easy by connecting two points over the internet without friction. In practice, this means traffic routes through intermediary computers scattered worldwide to find a path between the technician and the client. For professionals working within strict corporate environments, this convenience introduces severe security and privacy risks. After all, sensitive company data and client screens are traveling across servers you do not control and whose internal infrastructure lacks transparency. Ensuring compliance with strict data protection regulations requires keeping control of connection servers strictly within your own IT infrastructure.

To solve this dilemma without losing agility, we can build our own traffic hub using open-source RustDesk. Modern network ecosystems often present bottlenecks when misconfigured, which is why understanding how to optimize infrastructure to fix packet loss and jitter during heavy video streaming sessions is vital. Hosting your own relay server ensures no data flows through external computers, guaranteeing absolute sovereignty over the support channel. Moreover, before exposing any service to the internet, it is crucial to design a secure network topology with VLANs to isolate corporate traffic and prevent unwanted lateral movement if physical network boundaries are breached.

Understanding the RustDesk Server Architecture (hbbs and hbbr)

RustDesk splits its server-side backend into two main integrated components: hbbs and hbbr. The hbbs acts as the orchestra conductor, handling client registration and initial cryptographic key exchanges. Meanwhile, hbbr acts as the heavy duty mail carrier, serving as the actual relay server that transmits video streams and mouse commands when a direct internet connection is blocked by restrictive routers and firewalls. In practice, hbbs tells who can talk to whom, while hbbr shoulders the heavy lifting of the conversation if a direct path fails.

Configuring these two services requires attention to network ports so that traffic flows without operational blocks. In most deployments, we use specific ports such as 21115 for registration, 21116 for TCP and UDP listening, and 21117 for data relay services. Similar to what happens when we create a secure corporate tunnel using RustDesk, the clear separation between signaling and data transmission ensures that encryption is negotiated in an isolated, secure manner before any image packet is ever sent. This architectural split prevents attackers from tampering with sessions, as every key exchange undergoes strict validations on the centralized control server.

Step-by-step to deploy your own custom relay server

Deploying a custom relay infrastructure can be achieved cleanly using Docker containers on a dedicated Linux server within your enterprise or private cloud. The first step involves preparing the Docker Compose configuration file with the required services and correctly mapped ports. Make sure your server firewall allows incoming connections on these specific ports before starting the services. Pre-organizing the environment prevents communication failures that are difficult to troubleshoot later.

Create a directory on your server to store configuration files and application persistent data. Next, create the docker-compose.yml file using your preferred text editor in the system terminal. Paste the structured content below to run both the signaling server and the relay simultaneously with proper volume isolation.

version: '3'
services:
  hbbs:
    container_name: hbbs
    image: rustdesk/rustdesk-server:latest
    command: hbbs -r your-ip-or-domain:21117
    volumes:
      - ./data:/root
    networks:
      - rustdesk-net
    ports:
      - 21115:21115
      - 21116:21116
      - 21116:21116/udp
    restart: unless-stopped

  hbbr:
    container_name: hbbr
    image: rustdesk/rustdesk-server:latest
    command: hbbr -r your-ip-or-domain:21117
    volumes:
      - ./data:/root
    networks:
      - rustdesk-net
    ports:
      - 21117:21117
    restart: unless-stopped

networks:
  rustdesk-net:
    driver: bridge

With the file prepared on your server, run the background startup command to bring the services into continuous operation. The system will download the required images and start the containers automatically, creating the data folder where the public encryption key will be generated. Verify that processes are running smoothly by checking the logs generated by the container manager.

1. Open the terminal in the directory where you saved the Docker Compose configuration file on the server.
2. Run the command to spin up the services securely in the background.

   docker compose up -d

3. Verify that the containers are active and listening on the correct ports without errors in the logs.

   docker compose logs -f

End-to-end encryption and data transmission security

Security in remote access tools depends not only on an encrypted channel, but on how cryptographic keys are distributed and validated between parties. RustDesk uses modern elliptic-curve cryptography by default across all established sessions. In practice, this means that even if someone manages to intercept the traffic passing through your relay server, the data remains unreadable without the private key residing solely on authorized devices. The relay server acts merely as a blind pipe pushing encrypted packets without being able to open them.

To further reinforce corporate compliance, we can inject the public key automatically generated by the hbbs server directly into client installers or configurations. This key acts as an absolute trust certificate: the user application will only talk to servers presenting the corresponding cryptographic signature. Thus, malicious man-in-the-middle attacks where a fake server attempts to impersonate the corporate hub to steal access credentials or inspect technical support sessions are effectively prevented.

Corporate compliance and remote access auditing

Large enterprises and regulated entities must answer rigorous audits regarding who accessed which servers and at exact timestamps. Using commercial remote support solutions often leaves us dependent on proprietary reports stored in third-party clouds. By maintaining total control of the RustDesk infrastructure, your information security team gains the ability to cross-reference connection logs directly with firewall logs and security event management systems. This promptly meets requirements from standards like GDPR and ISO 27001 concerning strict access privilege control.

Beyond native container logs, it is highly recommended to centralize these logs into a security event management system for real-time analysis and anomaly detection. If a technician needs to access a critical machine outside business hours, the system logs the source IP, session duration, and key utilized. This operational transparency turns a convenience utility into an auditable security asset, offering peace of mind for both IT managers and internal audit and compliance departments.

Final considerations

Implementing a self-sufficient remote support solution with a dedicated relay and robust encryption shifts from being a technical luxury to a strategic necessity in the era of decentralized information security. We have seen that managing your own infrastructure eliminates inherent risks of using unknown public servers, ensuring absolute privacy for corporate data in transit. Combining lightweight technologies like Docker with end-to-end encrypted architectures proves that maintaining operational agility without sacrificing strict compliance standards is entirely achievable.

Maintaining strict control over access keys and constantly auditing connection logs strengthens the organization's security posture against external threats and internal leaks. By adopting these practices, your engineering and support team guarantees a resilient working environment capable of meeting the most demanding compliance requirements of the modern market.