RustDesk Firewall Ports: Complete UFW and iptables Guide

“Which ports do I need to open?” is the #1 question in every RustDesk installation thread. Here is the definitive answer.

The Complete Port Map

Port	Protocol	Service	Purpose
21115	TCP	HBBS	NAT type test
21116	TCP + UDP	HBBS	ID registration + Hole punching
21117	TCP	HBBR	Relay traffic
21118	TCP	HBBS	WebSocket (web client)
21119	TCP	HBBR	WebSocket relay
21114	TCP	API	Web console (Pro only)

Critical: Port 21116 must be open on both TCP and UDP. Missing UDP is the #1 cause of “relay only” connections and degraded performance.

UFW Commands (Ubuntu/Debian)

sudo ufw allow 21115/tcp
sudo ufw allow 21116/tcp
sudo ufw allow 21116/udp
sudo ufw allow 21117/tcp
sudo ufw allow 21118/tcp
sudo ufw allow 21119/tcp

# Pro only (Web Console)
sudo ufw allow 21114/tcp

sudo ufw reload
sudo ufw status

iptables Commands (CentOS/RHEL)

sudo iptables -A INPUT -p tcp --dport 21115 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 21116 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 21116 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 21117 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 21118 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 21119 -j ACCEPT

# Save rules
sudo iptables-save > /etc/iptables/rules.v4

Cloud Provider Firewalls

Don’t forget: many cloud providers (AWS, Hetzner, DigitalOcean) have their own firewall layer in addition to UFW/iptables. You need to open these ports in BOTH places.

Hetzner Cloud: Go to Firewall → Add Rule for each port.
AWS: Security Group → Inbound Rules.
DigitalOcean: Networking → Firewalls.

Verification

After opening ports, verify from an external machine:

nmap -Pn -p 21115-21119 your-server-ip

All ports should show as “open.”

The DeployRD Way

With DeployRD, firewall configuration is automated during deployment. Every port is opened correctly in both the OS firewall and the cloud provider’s firewall. Zero chance of missing UDP on 21116.

Skip the Firewall Headache →