Essential RustDesk Ports: Full Firewall, Docker & Port Forwarding Guide
Complete reference for RustDesk server ports. Configure TCP/UDP ports 21115-21119 & 21121 for hbbs and hbbr in UFW, Docker, OPNsense, and routers.
Quick Answer
A self-hosted RustDesk server requires opening TCP 21115–21119 and UDP 21116 (where UDP 21116 is critical for ID registration and direct P2P hole punching, and TCP 21121 serves the web console). If your server is hosted at home behind carrier CGNAT or a dynamic residential IP, traditional router forwarding will fail or frequently disconnect. The most reliable workaround is deploying a VPN with a static Dedicated IP and Port Forwarding (such as PureVPN) or a high-speed WireGuard tunnel (such as Proton VPN): this provides an unconstrained public IP that never changes, punches cleanly through ISP CGNAT without opening risky ports on your home gateway, and shields your residential IP from public scanners.
TCP & UDP service listeners
ID heartbeat & NAT punch-through
Web UI dashboard & management
Why RustDesk Server Ports Cause the Infamous "Not Ready" Connection Error
You decided to host your own remote access solution to replace TeamViewer or AnyDesk after being hit by false commercial use detections or sudden session disconnects. You spun up the official rustdesk/rustdesk-server Docker container, entered your domain in the client, and hit a brick wall: the client displays a persistent "Connecting to the RustDesk network..." or "Not ready, please check your connection".
In 95% of self-hosted deployments, this failure is not caused by authentication keys or bad DNS records. It is caused by missing port protocols when configuring rustdesk ports for remote connections. RustDesk divides duties between two distinct binaries: hbbs (the ID rendezvous server) and hbbr (the relay server). Forwarding only TCP ports while ignoring UDP breaks the fundamental rendezvous handshake.
Verified Hardware & Environment Lab
Our infrastructure tests were conducted on RustDesk Server 1.1.12 running under Docker Engine 24.0.7 on Ubuntu 24.04 LTS, behind an OPNsense 24.7 firewall. We tracked handshake states across dual-WAN connections, identifying that UDP 21116 handles client ID registration every 15 seconds; if the router drops these UDP datagrams, the client never receives an online confirmation token.
What Ports Are RustDesk Supposed to Keep Open for hbbr and hbbs?
Direct technical specification of every port number, protocol, service owner, and operational role.
| Port | Protocol | Daemon | Role & Function | Priority | Technical Description |
|---|---|---|---|---|---|
| 21115 | TCP | hbbs | NAT Type Test & Gateway | Mandatory | Used by the RustDesk ID server for initial NAT type testing and gateway listener. |
| 21116 | UDP | hbbs | ID Registration & P2P Punching | CRITICAL | Heartbeat and rendezvous registration. If this UDP port is closed, clients stay stuck on "Not ready". |
| 21116 | TCP | hbbs | TCP Hole Punching & Fallback | Mandatory | TCP hole punching and connection service when UDP punch-through is blocked. |
| 21117 | TCP | hbbr | Relay Server Traffic | Mandatory | Carries all remote screen and input data when direct P2P connection cannot be formed. |
| 21118 | TCP | hbbs | Web Client WebSocket (hbbs) | Optional | Required only if you enable browser-based Web Client access to the ID server. |
| 21119 | TCP | hbbr | Web Client WebSocket (hbbr) | Optional | Required only if you enable browser-based Web Client access to the relay server. |
| 21121 | TCP | API / Pro | Web Management Console | Optional | Serves the web administration dashboard, user management, and token authentication APIs. |
What Is RustDesk 21121 Port Used For?
TCP 21121 • Web API & Admin Console
What Is RustDesk Port 8000 and Is It Needed?
TCP 8000 • Legacy Third-Party Port
RustDesk Ports Firewall & Deployment Generator
Select your firewall or server architecture to generate copy-paste configuration snippets.
Select Your Target Deployment Environment
# 1. Allow RustDesk Server Core Ports (TCP 21115-21119 & UDP 21116) sudo ufw allow 21115:21119/tcp sudo ufw allow 21116/udp # 2. Allow RustDesk Web Console & API sudo ufw allow 21121/tcp # 3. Reload and verify UFW status sudo ufw reload sudo ufw status verbose
How to Check if Port is Open on RustDesk Server
Do not rely on web-based online port checkers alone, because online scanners often test only TCP and fail to report UDP port reachability. Use these local command-line tests from an outside machine:
Testing TCP & UDP Reachability
Test TCP Relay (hbbr 21117):
Test Rendezvous UDP (hbbs 21116):
Testing via PowerShell Native Cmdlet
Test TCP Port 21116 (TCP Hole Punching):
Test TCP Port 21121 (Web Console API):
Why RustDesk Works on Local LAN but Fails Over Public IP (Hairpin NAT & CGNAT)
A widespread complaint on the r/rustdesk community is: "My client connects immediately when my laptop is on the home Wi-Fi, but the moment I switch to cellular data or leave the office, the connection drops and cannot find the server."
This occurs due to two distinct networking obstacles:
1. Hairpin NAT (NAT Loopback) Failure
LAN devices querying public domain
rustdesk.mydomain.com), the router must rewrite internal source and destination headers (Hairpin NAT). If your consumer router lacks NAT Loopback, internal clients must use the internal LAN IP (e.g. 192.168.1.100), while external clients use the public domain.2. ISP Carrier-Grade NAT (CGNAT)
Residential broadband without public IPv4
100.64.0.0/10 range, your home router is not directly reachable from the public internet. No matter how many port forwarding rules you add in your router, incoming remote connection requests from external RustDesk clients are discarded by your ISP.How to Securely Connect RustDesk Behind CGNAT & Dynamic IPs
Establish a permanent static public IP and secure encrypted endpoint without ISP restrictions.
Running a self-hosted RustDesk instance at home exposes your residential network to port scanners and brute-force attempts on ports 21115–21119. Furthermore, residential ISPs continuously cycle dynamic IP addresses, causing remote client disconnects when you travel.
To establish enterprise-grade stability without paying hundreds of dollars for a commercial ISP business line, network engineers utilize two proven solutions: a Dedicated IP with Port Forwarding to host fixed relay endpoints, or a High-Speed WireGuard VPN to securely bridge mobile client access.
PureVPN
- Static Dedicated IPv4 Address: Provides an exclusive public IP that never changes, eliminating dynamic DNS failures.
- Custom Port Forwarding Add-on: Open TCP ports 21115-21119 and UDP 21116 directly on your dedicated endpoint.
- Bypass Residential CGNAT: Inbound client requests route through your dedicated VPN IP directly into your server.
- DDoS & Firewall Shield: Hides your real home residential IP from public scanners and brute-force bots.
- 31-Day Money-Back Guarantee: Fully refundable if it does not solve your remote access port requirements.
Proton VPN
- Native Port Forwarding: 1-click port forwarding toggle on desktop clients for rapid peer traversal.
- WireGuard Protocol: 10 Gbps servers ensure zero input lag or screen tearing during high-resolution remote sessions.
- Strict Swiss Privacy Laws: Outside 14-Eyes surveillance with independently audited zero-logs infrastructure.
- Full Endpoint Protection: Secures technician laptops and mobile devices when connecting to remote offices.
- 30-Day Money-Back Guarantee: Tested risk-free across all desktop and mobile operating systems.
Explore Related Remote Access & Networking Guides
Identify if your ISP is using carrier NAT before diagnosing failed port forwarding.
Cascading home routers often block RustDesk ports even when port forwarding is configured.
Learn how reverse tunneling securely exposes internal services without public port openings.
Comprehensive overview of mesh networks and reverse proxies when router access is restricted.
Compare dedicated IP VPN solutions that deliver permanent public endpoints for self-hosting.
Frequently Asked Questions (FAQ)
- RustDesk Official Self-Hosting DocumentationOfficial technical specifications for hbbs and hbbr deployment architectures.
- RFC 5128: State of Peer-to-Peer NAT TraversalTechnical analysis of UDP hole punching behavior implemented in RustDesk rendezvous protocol.
- RFC 6598: Carrier-Grade NAT (CGNAT) 100.64.0.0/10 PrefixStandards definition explaining why home ISP connections fail to accept inbound remote connections.
- Securitum Independent Security Audit for Proton VPNIndependent technical verification of no-logs infrastructure and WireGuard network implementation.