How to Self-Host a High-Performance RustDesk Relay & Rendezvous Server on Linux VPS: Complete Low-Latency Remote Desktop Setup in Pakistan

Pakistani IT support agencies, Managed Service Providers (MSPs), call centers, and software export firms face a compounding challenge with commercial remote desktop tools. Proprietary platforms like TeamViewer and AnyDesk continuously tighten licensing policies, triggering aggressive commercial-use timeouts that cut off active client troubleshooting sessions after 60 seconds.

Compounding this operational friction is the cost factor. Enterprise subscriptions billed in US Dollars place severe pressure on Pakistani corporate budgets amid rupee currency devaluation and banking foreign-exchange limits.

Worse yet is network performance. Proprietary vendors route remote desktop sessions through overseas relay nodes located in Western Europe or Singapore. When a technician in Lahore connects to an office workstation in Karachi, keystrokes and video packets travel thousands of kilometers round-trip, creating sluggish 180ms to 280ms input latency.

Self-hosting RustDesk on a dedicated Linux VPS solves every one of these operational hurdles.

RustDesk is a high-performance, open-source remote desktop platform written in Rust. It provides end-to-end encryption using Ed25519 key verification and ChaCha20-Poly1305 ciphers.

By deploying your own RustDesk Rendezvous (hbbs) and Relay (hbbr) servers on a low-latency Cloud VPS in Pakistan, your organization gains complete infrastructure ownership, zero subscription fees, and sub-15ms desktop responsiveness over domestic fiber broadband.

This production guide walks through deploying, securing, and tuning a high-performance RustDesk server on Linux VPS.

---

1. How RustDesk Works Under the Hood

To operate a resilient remote desktop deployment, system administrators must understand the dual-daemon architecture that powers RustDesk:

hbbs (Heartbeat & Rendezvous Server)

The hbbs daemon acts as the central coordinator and registration broker.

1. Client ID Registration: Each client endpoint connects to hbbs on startup and registers a unique, persistent numeric ID.
2. NAT Hole Punching: When a technician attempts to control a remote workstation, hbbs determines the public IP and port mappings of both endpoints. It facilitates direct Peer-to-Peer (P2P) UDP hole punching through local routers and firewalls.
3. Mutual Key Authentication: If configured with the -k _ parameter, hbbs validates that the connecting client possesses the matching Ed25519 public key, blocking unauthorized third parties from using your server.

hbbr (Relay Server)

The hbbr daemon serves as an encrypted, high-throughput fallback data pipeline.

When direct P2P connections cannot be established—typically caused by symmetric NAT or restrictive corporate firewalls—hbbs commands both endpoints to establish an encrypted outbound TCP tunnel to hbbr.

The relay server acts as an opaque proxy. It forwards raw encrypted byte streams between endpoints without ever decrypting the underlying screen frames, keystrokes, or clipboard data.

---

2. Proprietary Remote Desktop vs. Self-Hosted RustDesk

Switching to a self-hosted RustDesk deployment provides immediate advantages across performance, privacy, and operational costs.

Operational Metric	TeamViewer / AnyDesk	Self-Hosted RustDesk on Linux VPS
Data Ownership	Third-party multitenant cloud	100% private, sovereign infrastructure
Session Routing	Overseas relays (Europe/Singapore)	Localized domestic VPS routing
Round-Trip Latency (PK-to-PK)	140ms – 260ms	8ms – 25ms
Licensing Model	$50 to $200+ / user / month	Zero software license fees
Session Duration Limits	Automated timeouts on free/standard	Completely unlimited 24/7 sessions
Encryption Standard	Proprietary closed-source	Open-source Ed25519 and ChaCha20
Concurrent Sessions	Tiered license paywalls	Bound only by VPS network bandwidth

Pro-Tip: In a direct P2P session, your VPS consumes bandwidth only during the initial 2-second connection handshake. Once established, data flows directly between client machines, allowing a modest 2 vCPU VPS to coordinate hundreds of simultaneous active connections across your organization.

---

3. Network Ports & Firewall Requirements

RustDesk requires specific TCP and UDP ports open on your Linux VPS. Ensure your cloud provider security groups and local firewall permit the following traffic:

Port	Protocol	Component	Primary Function
21115	TCP	hbbs	NAT type detection and routing discovery
21116	TCP	hbbs	TCP connection handling and API coordination
21116	UDP	hbbs	Heartbeat keep-alives and UDP NAT registration
21117	TCP	hbbr	Encrypted session relay service data channel
21118	TCP	Web Client	Optional web GUI client signaling port
21119	TCP	Web Client	Optional web GUI client relay port

---

4. Traversing Pakistani ISP Carrier-Grade NAT (CGNAT)

Major Pakistani telecommunications providers and internet service providers—including PTCL, Nayatel, StormFiber, Transworld, Jazz, and Zong—extensively deploy Carrier-Grade NAT (RFC 6598, 100.64.0.0/10).

Under CGNAT, hundreds of home and office internet subscribers share a single public IPv4 address.

When two endpoints sit behind symmetric NAT pools on different providers (for example, a technician on Nayatel fiber in Islamabad controlling a workstation on a Jazz 4G backup router in Karachi), standard direct UDP hole punching often fails.

A self-hosted RustDesk server deployed on a cloud instance with a dedicated public IPv4 address completely bypasses this limitation. Because both endpoints initiate outbound TCP connections to your server on ports 21116 and 21117, local ISP router firewalls allow the traffic seamlessly without requiring home router port forwarding or static IP subscriptions.

---

5. Linux Kernel Network Tuning for High Concurrency

Before starting the RustDesk daemons, optimize the Linux network stack to handle thousands of concurrent UDP packet streams and file descriptors without dropped packets.

Connect to your Ubuntu 24.04 or Debian 12 VPS as root and apply the following system settings:

Step 5.1: Increase System File Descriptors

Edit /etc/security/limits.conf:

* soft nofile 65535
* hard nofile 65535
root soft nofile 65535
root hard nofile 65535

Step 5.2: Optimize Network Buffer Sizes

Append the following kernel parameters to /etc/sysctl.conf:

# Maximum socket receive and send buffer sizes across all protocols
net.core.rmem_max = 26214400
net.core.wmem_max = 26214400
net.core.rmem_default = 1048576
net.core.wmem_default = 1048576

# UDP memory allocations (pages: min, pressure, max)
net.ipv4.udp_rmem_min = 16384
net.ipv4.udp_wmem_min = 16384

# Backlog queue limits for high connection bursts
net.core.netdev_max_backlog = 10000
net.core.somaxconn = 4096

# Total system open files limit
fs.file-max = 2097152

Apply the updated kernel configuration immediately:

sysctl -p

---

6. Step-by-Step Production Deployment Using Docker Compose

Docker Compose is the recommended deployment method. It provides automated restart policies, process isolation, and simplified key management.

Step 6.1: Install Docker Engine

Update package indices and install the official Docker Engine:

apt update && apt upgrade -y
apt install -y curl ufw ca-certificates gnupg lsb-release

# Install Docker via official utility script
curl -fsSL https://get.docker.com | sh
systemctl enable --now docker

Step 6.2: Create Project Directory Structure

mkdir -p /opt/rustdesk-server/data
cd /opt/rustdesk-server

Step 6.3: Create docker-compose.yml

Create your Compose definition. In this configuration, replace relay.yourdomain.pk with your server’s static public IPv4 address or fully qualified domain name:

version: '3.8'

services:
  hbbs:
    container_name: rustdesk-hbbs
    image: rustdesk/rustdesk-server:latest
    command: hbbs -r relay.yourdomain.pk:21117 -k _
    volumes:
      - ./data:/root
    network_mode: host
    restart: always
    depends_on:
      - hbbr

  hbbr:
    container_name: rustdesk-hbbr
    image: rustdesk/rustdesk-server:latest
    command: hbbr -k _
    volumes:
      - ./data:/root
    network_mode: host
    restart: always

Pro-Tip: The -k _ argument is critical for production security. When passed to both hbbs and hbbr, the servers automatically generate a private/public keypair on the first boot and enforce mutual authentication. Any client that attempts to connect without your matching public key is immediately dropped.

Step 6.4: Configure Host Firewall (UFW)

Open the required RustDesk network ports in Ubuntu’s uncomplicated firewall:

# Allow standard SSH management
ufw allow 22/tcp

# RustDesk Rendezvous (hbbs)
ufw allow 21115/tcp
ufw allow 21116/tcp
ufw allow 21116/udp

# RustDesk Relay (hbbr)
ufw allow 21117/tcp

# Optional Web Client interfaces
ufw allow 21118/tcp
ufw allow 21119/tcp

# Enable firewall
ufw enable

Step 6.5: Launch the RustDesk Stack

Start the containers in detached mode:

docker compose up -d

Verify that both containers are running healthy:

docker compose ps

---

7. Retrieving Your Cryptographic Public Key

When hbbs starts for the first time, it writes the Ed25519 keypair into the ./data directory.

Display your public key string:

cat /opt/rustdesk-server/data/id_ed25519.pub

The output is a base64-encoded string similar to:

7bN5cWzPqL9vXyR2tK1mJ4sD8hF0gA3jE6nU=

Copy this key string. You will provide it to every client workstation that connects to your infrastructure.

---

8. Client Configuration & Endpoint Distribution

Once your server is active, configure your client machines across Windows, macOS, Linux, and Android.

Manual Client Setup

1. Download and install the official RustDesk client from the official project repository.
2. Open RustDesk and navigate to Settings (or click the three vertical dots next to your ID) > Network > Unlock Network Settings.
3. Fill in the network configuration fields:
   • ID Server: relay.yourdomain.pk (or your VPS IPv4 address)
   • Relay Server: relay.yourdomain.pk:21117
   • API Server: Leave blank
   • Key: Paste your public key string (7bN5cWzPqL9vXyR2...)
4. Click Apply.

Check the status indicator at the bottom left of the RustDesk window. It will immediately show a green circle with the status message “Ready”.

Automated Client Deployment for IT Support Teams

For IT service desks deploying RustDesk to hundreds of end-user laptops without manual configuration, RustDesk supports automated configuration parsing through executable filename encoding.

Rename the Windows installation executable using the following naming convention before distributing it to users:

rustdesk-host=relay.yourdomain.pk,key=7bN5cWzPqL9vXyR2tK1mJ4sD8hF0gA3jE6nU=,.exe

When the user launches this renamed .exe, RustDesk automatically parses the host address and public key directly from its filename and writes the configuration to disk without requiring any manual user entry.

---

9. Hardware Sizing & Scaling for Multi-User Teams

RustDesk is remarkably resource-efficient. CPU consumption scales primarily with active relay sessions that require encrypted packet forwarding:

Team Size	Active Concurrent Relays	Total Managed Endpoints	Recommended VPS Configuration
Small Agency / Freelancers	1 to 10 Relays	50 to 200 Devices	2 vCPU, 4 GB RAM, 40 GB NVMe
Mid-Size Support Desk	10 to 40 Relays	200 to 1,000 Devices	4 vCPU, 8 GB RAM, 80 GB NVMe
Enterprise Call Center / BPO	50 to 150+ Relays	1,000 to 5,000+ Devices	8 vCPU, 16 GB RAM, 160 GB NVMe
Multi-Branch Corporate Fleet	200+ Heavy Relays	10,000+ Devices	Bare-Metal Dedicated Servers

If your organization manages continuous, multi-technician screen-recording streams, mass file transfers, or remote 4K graphic rendering across multiple domestic branches, hosting your relay infrastructure on bare-metal Dedicated Servers in Pakistan delivers unthrottled gigabit throughput with physical CPU isolation.

---

Related Remote Infrastructure Guides

Deepen your engineering knowledge with our systems administration tutorials:

• Apache Guacamole Clientless HTML5 Web RDP Gateway on Linux VPS
• Self-Hosting Kasm Workspaces for Browser Isolation & Disposable Workstations
• Admin RDP vs User RDP in Pakistan: Security & Access Comparison
• Windows Server 2025 RDP Multi-Session Configuration Guide

---

Official Nextgen Windows & Linux RDP Server Pricing Plans

All Nextgen remote desktop and virtualization servers feature enterprise AMD EPYC and Intel Xeon high-frequency compute cores, enterprise NVMe SSD storage in RAID arrays, unmetered 1Gbps bandwidth, and direct local payment support via JazzCash, EasyPaisa, and bank transfer.

1. Global Admin Windows & Linux RDP Servers (Tier-1 International Routing)

Optimized for global freelance client work, international e-commerce platforms, containerized remote desktop relays, and automated multi-threaded workflows.

Plan Name	vCPU Cores	Dedicated RAM	NVMe SSD Storage	Bandwidth	Monthly Price (PKR)	Order Link
RDP Basic	2 vCPU	4 GB ECC	40 GB NVMe	20 TB (1Gbps)	Rs. 4,489 /mo	Deploy RDP Basic →
RDP Power	4 vCPU	8 GB ECC	80 GB NVMe	20 TB (1Gbps)	Rs. 10,478 /mo	Deploy RDP Power →
RDP Ultra (Recommended)	4 vCPU	8 GB ECC	160 GB NVMe	20 TB (1Gbps)	Rs. 13,485 /mo	Deploy RDP Ultra →
RDP Pro	8 vCPU	16 GB ECC	160 GB NVMe	20 TB (1Gbps)	Rs. 17,670 /mo	Deploy RDP Pro →
RDP Mega	8 vCPU	16 GB ECC	240 GB NVMe	20 TB (1Gbps)	Rs. 21,499 /mo	Deploy RDP Mega →
RDP Max	16 vCPU	32 GB ECC	320 GB NVMe	20 TB (1Gbps)	Rs. 32,488 /mo	Deploy RDP Max →

Review complete features and technical specifications on our Windows RDP Hosting page.

---

2. Domestic Pakistan Local RDP Servers (Karachi Datacenter)

Engineered for ultra-low 5ms domestic latency, local banking portal automation, FBR IRIS tax portal compliance, and sovereign regulatory data residency.

Plan Name	vCPU Cores	Dedicated RAM	NVMe SSD Storage	Bandwidth	Monthly Price (PKR)	Order Link
RDP Basic (PK)	1 vCPU	2 GB ECC	50 GB NVMe	2 TB Bandwidth	Rs. 13,500 /mo	Deploy Basic (PK) →
RDP Plus (PK)	2 vCPU	4 GB ECC	80 GB NVMe	4 TB Bandwidth	Rs. 22,500 /mo	Deploy Plus (PK) →
RDP Ultra (PK) (Top Seller)	4 vCPU	8 GB ECC	160 GB NVMe	6 TB Bandwidth	Rs. 36,000 /mo	Deploy Ultra (PK) →
RDP Pro (PK)	6 vCPU	16 GB ECC	350 GB NVMe	8 TB Bandwidth	Rs. 72,000 /mo	Deploy Pro (PK) →

Inspect domestic peering and routing details on our Pakistan RDP Servers page.

---

When Should You Upgrade to Bare-Metal Dedicated Servers?

For running standard remote support fleets, virtualized cloud instances provide exceptional flexibility and cost-effectiveness.

However, when managing massive multi-tenant support fleets with hundreds of concurrent relay sessions, hardware emulation clusters, or continuous uncompressed video streaming, shared hypervisors can suffer from network queue contention and jitter.

In these demanding production environments, dedicated hardware is essential. Deploying single-tenant Dedicated Servers and Dedicated Servers in Pakistan grants your organization complete physical control over bare-metal CPU cores, dedicated network interface cards (NICs), and unthrottled gigabit connectivity.

---