Rustdesk + Nginx proxy manager

rustdesk.yml

version: '3'

networks:
  rustdesk-net:
    external: false

services:

  nginx-proxy-manager:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      # These ports are in format <host-port>:<container-port>
      - '80:80' # Public HTTP Port
      - '443:443' # Public HTTPS Port
      - '8081:81' # Admin Web Port
      # Add any other Stream port you want to expose
      # - '21:21' # FTP
      # Ports needed for Rustdesk:
      - '21115:21115'
      - '21116:21116'
      - '21116:21116/udp'
      - '21117:21117'
      - '21118:21118'
      - '21119:21119'

    # Uncomment the next line if you uncomment anything in the section
    # environment:
      # Uncomment this if you want to change the location of 
      # the SQLite DB file within the container
      # DB_SQLITE_FILE: "/data/database.sqlite"

      # Uncomment this if IPv6 is not enabled on your host/
      # DISABLE_IPV6: 'true'
      
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    networks:
      - rustdesk-net
  hbbs:
    container_name: hbbs
    image: rustdesk/rustdesk-server:latest
    command: hbbs -r rustdesk.yourDomain.com:21117
    volumes:
      - ./data:/root
    networks:
      - rustdesk-net
    depends_on:
      - hbbr
    restart: unless-stopped
    
  hbbr:
    container_name: hbbr
    image: rustdesk/rustdesk-server:latest
    command: hbbr
    volumes:
      - ./data:/root
    networks:
      - rustdesk-net
    restart: unless-stopped

6. The last thing you need to do is point a domain name to the server. For example rustdesk.yourdomain.com. No need to specify the port, Nginx and RustDesk will handle the rest.

So I only set that up in our DNS manager? Nothing to be done on Proxy Manager?

Also, since I'm using separate docker compose files, I'm supposed to be moving the port values to the NPM compose file, or I can leave it there?

Edit: turns out i had to put the ports in NGINX
And the DNS problem was me forgetting to apply the overrides

I seem to have stuck. I'm stuck because when my Rustdesk client is using the internal IP address where this Rustdesk Docker container is, the Rustdesk client is able to connect...meaning I'm seeing "READY". But when I change the ID/Relay server to point to rustdesk.mydomain.com, it just won't connect. I figured that it could very well be my firewall. I"m pointing my firewall to the IP address of the Docker host where Rustdesk is. I would love it if someone could tell if my Port Forwarding on Unifi Controller is correct. It should be but I may have missed something?

I tried separating my port forwarding on my UniFi, but then I found it worked better if I just opened up both UDP/TCP to all the ports.

Thanks for the assistance.
I opened both protocols (TCP and UDP). It didn't work either. :(

And the DNS problem was me forgetting to apply the overrides

how did ya get this working

i'm also allready running a nginx docker separetly

how did ya get this working

if you want to test it out first, add the override in your router/DNS server
point the URL to your server's IP

Can't access webui. Tried my unraid server's IP and Hostname:21115-21119, also tried rustdesk.mydomain.com. Any ideas on what I can try?

What I've done:

My ports are forwarded.
My NPM streams are open and my hbbr and hbbs docker logs look good. I previously had NPM Streams working with the hbbs.rustdesk_network but set a static IP like the other user commented and changed to network_mode to be with my pre-existing NPM container.
I tried Proxy Hosts using 21117 too.

I'm starting to believe that rustdesk doesn't work for self hosted behind a router in a multi-layer environment. From all the videos and articles and posts, everyone who were successful, had hosted them with a cloud service (meaning, not hosted locally but with something like AWS, Digital Ocean, etc)

RUSTDESK SERVER LAYERED SECURITY MODEL

no it works. I rebuilt my NPM with rust desk like his example, and it's now working. It's a few steps. But I followed all above and it works for me. I host mine on my Proxmox, UDM, Spectrum and cloudflare dynamic dns solution.

I know this is fundamental question, but I really want to learn this. I'm ok with steps 2-6 as I have many docker images running (ollama, piwigo, nginx, searxng, frigate NVR). But the "create a stack" has me baffled. I have read all over the net, but I'm really confused.

Could you point me in the right direction or explain what creating a stack is? And how is it deployed?
Many thanks

I know this is fundamental question, but I really want to learn this. I'm ok with steps 2-6 as I have many docker images running (ollama, piwigo, nginx, searxng, frigate NVR). But the "create a stack" has me baffled. I have read all over the net, but I'm really confused.

Could you point me in the right direction or explain what creating a stack is? And how is it deployed? Many thanks

Hey!

I used portainer for this and there it is called a stack, but I believe it's the name of the folder you create your docker-compose in. To check you can do step two and then get the name by running docker network ls and finding the one that has _rustdesk-net after it.

Thank you very much. Not only did it work, you got me into Portainer and I'm exploring even more. Learning is great, even for someone who is 3 score and 14 years old.

…

On Tue, Mar 11, 2025 at 4:13 PM Lvdwardt ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ I know this is fundamental question, but I really want to learn this. I'm ok with steps 2-6 as I have many docker images running (ollama, piwigo, nginx, searxng, frigate NVR). But the "create a stack" has me baffled. I have read all over the net, but I'm really confused. Could you point me in the right direction or explain what creating a stack is? And how is it deployed? Many thanks Hey! I used portainer for this and there it is called a stack, but I believe it's the name of the folder you create your docker-compose in. To check you can do step two and then get the name by running docker network ls and finding the one that has _rustdesk-net after it. — Reply to this email directly, view it on GitHub <https://gist.github.com/Lvdwardt/707d9c3fb4581d38102399f91a21c9c6#gistcomment-5486263> or unsubscribe <https://github.com/notifications/unsubscribe-auth/AZNNG77WVWOXONMQSNAJPIL2T47WZBFKMF2HI4TJMJ2XIZLTSKBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DFVRZXKYTKMVRXIX3UPFYGLK2HNFZXIQ3PNVWWK3TUUZ2G64DJMNZZDAVEOR4XAZNEM5UXG5FFOZQWY5LFVEYTEMJWG42DIOBVU52HE2LHM5SXFJTDOJSWC5DF> . You are receiving this email because you commented on the thread. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> .

@echoparkbaby I run mine with xcp-ng 8.3. The other stuff is the same as you being UDM, Cloudflare dynamic dns solution. Not sure what Spectrum is though.
I even tried it by running not in a VM but in actual metal hardware with Docker and with this rustdesk Docker yml file. Would the UDM be the point of block? How do I check?

@Lvdwardt thanks for the step-by-step. Just wanted to mention that there is a typo in the guide: "Make sure that port 21117 has both TCP and UDP selected.". That should be port 21116.

Your image is right, but not the written guide. I fell fowl of that unfortunately, but all good now.

I used to run this fine for months until recently ... for some odd reason I can`t remote to some abroad sites where I used to do it just fine before .. so I started updating all rustdesk windows installations I had ..

It still works locally on my lan fine however I can`t get it to work remotely anynmore ..

Looking at the logs I can see there is a request for relay on my hbbr container however it returns a relay error after a while .. keys and sites and forwarders also the nginx streams all set working fine except since the update I interestingly get an offline mark on my nginx stream on port 21119 ... checked and rechecked everything but can`t find the issue ..

anyone ?

• [ ]

annoyingly the error is not specific so it can point you in the right direction .. no matter which direction I`m trying to connect to returns the same ..

If you're using a FQDN like rustdesk.your_domain.com, have you added this FQDN to your internal DNS server yet?

If you're using Pi-Hole, Under Settings --> Local DNS Records.
Note to use only the external FQDN.

Im using pihole, but pihole wont route the incoming traffic to my container .. nginx will do ... only using traffic internally unbound. I also have local dns setup for but I`m not sure I can setup external FQDNS into my internal instance as from what I know this will screw everything up.

my rustdesk.external.com domain points to my wan ip and from there ngnix takes traffic where it needs to go via streams ...

Im using 2 nginx instances .. the old one I always had which routes https traffic to the required containers and authelia as required and also using nginx for rustdesk where Im pointing the traffic from my LXC local ip internally to docker bridge network created by rustdesk ...

the setup was working fine until recently

so on my main desktop (as I have a few on my lan) when opening rustdesk all history connections show up fine .. if I log in locally it works ... but the remote ones even if shown with green dot, when I try to connect to them it hangs for a while .. and throws a relay problem ... same when i try to connect from one of them remotec desktops into my own desktop ..

I tried so far :

1. rebooting all desktops and updating to latest verisons
2. force-recreated the containers with nginx and rustdesk (the compose file) to make sure the latest containers are downloaded
3. re-checked the forwarding ports in my unifi
4. re-checked the firewall rules
5. rechecked my main ngnix rules

all above looking good, I can connect to all my servers behind the ngnix, Im using quite a few .. its only rustdesk that stopped working

I wouldn't try to use nginx as per the original post has suggested. Routing traffic through nginx, as shown in this post, means that you dont have a router. Most people have a router. Why route traffic twice before it hits the Rustdesk containers?

Simplify is your friend. Remove useless layers of complexity.

Here's what I got going on my home lab.

After traffic hits my router, my router forwards the rustdesk named opened ports to the rustdesk containers

Since you're running Pi-hole, do this:

Yes, it is that simple.