Architecture and migration
Sizing, target environment, data transfer, cutover and recovery are resolved before production operations.
WZ-IT installs and operates RustDesk with dedicated rendezvous and relay components. We configure clients and keys, integrate the solution into your access architecture and handle monitoring, backups and updates.
The following are trademarks of their respective owners: RustDesk (Purslane Ltd.). WZ-IT is an independent service provider and has no business, partnership, or contractual relationship with these companies. We offer independent migration, installation, hosting, and operations services.
RustDesk is an open-source remote desktop solution with self-hostable rendezvous and relay components. Direct connections, clients, updates and connected services remain separate data and security boundaries.
As an experienced RustDesk integrator, we handle installation, configuration and operation of your self-hosted RustDesk server - on our infrastructure or on-premise at your location.
We install and operate your RustDesk server (hbbs + hbbr) on secure infrastructure in Germany or at your preferred location. Including firewall configuration, TLS setup and client deployment support.
We monitor and update the agreed RustDesk server components. Security and availability also depend on clients, keys, network paths and the concrete configuration.
Your own ID/rendezvous and relay server (hbbs/hbbr) for controllable mediation and relay data flows.
Encrypted connections; the resulting security level depends on key distribution, clients, versions and server configuration.
Clients for Windows, macOS, Linux, iOS, Android and Web - all devices in one solution.
Support for multiple software and hardware codecs; available codecs and performance depend on client, hardware and version.
On Windows, no installation or admin rights required - privilege elevation on demand.
Clear interface for quick remote connections without complicated configuration.
Professional installation on your infrastructure - on-premise, cloud or hybrid
In your data center
AWS, Azure, Hetzner & more
Advanced architecture after technical and licence assessment
Fast remote support for employees and customers without complicated VPN setups
Secure access to office PCs from home with end-to-end encryption
Open-source solution with your own rendezvous and relay server plus documentable data flows
Remote access to Windows, Linux and macOS servers with cross-platform support
Scalable remote desktop solution for IT service providers with custom branding
Screen sharing and remote control for interactive trainings and demos
Secure access and access control for your installation
WireGuard, NetBird or Tailscale
Directly or through an upstream identity layer
Depends on application, edition and identity provider
Fail2Ban, Rate Limiting, IP Whitelisting
We set up secure VPN access to your installation - ideal for remote work and external employees.
Full-service installation with no hidden costs
RustDesk offers TeamViewer alternative with own server. We integrate it into your IT service management processes.
The server API enables device management: Register clients, assign groups, control access rights - all automatable.
A webhook can be triggered on every connection: Audit log, ticket creation, approval workflow.
As open source project, the client can be customized: Own branding, preconfigured servers, additional security features.
How we implement RustDesk development in practice.
Support staff must manually document which computers they accessed. Compliance risk.
Automatic linking: RustDesk session logged with ticket ID. Connection log appears in ticket.
CMDB doesn't contain all devices because registration is manual. RustDesk knows all clients.
Sync service automatically transferring RustDesk clients to CMDB - incl. OS, version, last contact.
Maintenance at night requires access without user confirmation, but standard access is too open.
Time-window-based unattended access with hardware token authentication and automatic session recording.
We do more than provide an application. WZ-IT designs the technical architecture, integrates network and identity, operates the agreed scope and develops integrations when the standard product is not enough.
Sizing, target environment, data transfer, cutover and recovery are resolved before production operations.
SSO, secure access, internal systems and existing security components are integrated appropriately.
Updates, backups, technical monitoring and response paths follow a transparent operational scope.
APIs, automation and custom extensions can be delivered beyond basic deployment.
The exact scope depends on the application, edition, infrastructure and criticality. Vendor licences and non-standard components are quoted separately.
Remote access is designed as a combination of identities, control platform, gateways, routes and traceable access policies.
Employees, service providers and systems receive only the access paths required for their task.
TLS, firewall rules, reverse proxies or private network paths are designed around the platform's exposure.
Local accounts, SSO, directories, service accounts and emergency access are connected through clear roles.
Devices, connections, policies and administrative changes are managed centrally and traceably.
Sites, subnets, relays and outbound tunnels without unnecessarily exposed services.
Least-privilege rules, groups, key rotation and optional technical device criteria.
Controlled access to servers, applications, OT networks and documented events.
The diagram is a resilient target model. Its implementation depends on edition, data flows, load, availability objectives and existing infrastructure.
A clearly defined operating scope instead of an opaque hosting flat fee.
Compute, applications, storage and response are shown separately. You can see what ongoing operations include and which requirements need a technical assessment.
We also design custom RustDesk architectures, integrations and migrations. Contact us for a technical assessment.
One managed standard RustDesk application is included in the Starter workload. Every service level also includes flexible expert time for planned work during regular service hours. Select compute, additional applications, storage and the appropriate service level.
A workload is one compute instance with the applications agreed for it.
One standard app per workload is already included. Additional dedicated servers count as separate workloads.
€79.90 per started TB and month, including daily encrypted offsite backup with 7-day retention.
Remote support for employees and customers with self-hosted rendezvous and relay services. Direct and relayed connections are configured around network and privacy requirements.
The perfect solution for your individual requirements
Whether you run RustDesk in-house or need to host confidentiality-professional data §203-ready - we build, operate and maintain RustDesk on an encrypted on-site server. Data never leaves the building in cleartext.
See RustDesk on-premise
In-depth knowledge from our remote access knowledge base.
Why switching pays off and how to run your own remote desktop server.
Secure remote access to systems - without installing a client.
Remote access via browser: RDP, VNC and SSH without local software.
Roles, permissions and traceability for secure remote access.
Answers to the most important questions
Topics
RustDesk is a remote desktop and remote support solution that allows you to remotely maintain devices over the internet or LAN - including your own server option (self-hosted).
Self-hosting gives you control over connection setup/relay, infrastructure location and operational processes (firewall, updates, monitoring). This is particularly interesting for companies with data protection, latency or control requirements.
Typically two server services: hbbs = ID/rendezvous server (clients find each other through it) and hbbr = relay server (if no direct P2P connection is possible).
In the client under Menu → Network, enter the ID Server (hbbs host/IP); the Relay Server refers to hbbr (typically port 21117).
For encrypted connections, clients need to know your server's public key. The key is generated on first start and is usually located as id_ed25519.pub in the working/data directory.
Yes. The RustDesk documentation describes several ways: manually, via import/export of server configuration, and automated deployment via scripts/config string.
The API server is only relevant for RustDesk Pro (e.g., web console/login). For classic open-source self-hosted setups, many teams leave it empty.
The official documentation mentions TCP 21115-21119 and UDP 21116 (depending on use/setup). Also plan DNS/domain/reverse proxy according to your environment.
Both work. For productive setups, a domain is practical (clients, certificates, failover scenarios). In LAN/closed network environments, a fixed IP can also make sense.
Yes - but there's a common issue: NAT loopback. If server and clients are on the same LAN, they either need to use the local server IP or enable NAT loopback on the network.
This is a classic NAT loopback problem. The documentation mentions three solutions: NAT loopback on router, local DNS (e.g., AdGuard/Pi-hole) or hosts file rules.
Not necessarily. RustDesk attempts direct connections depending on network situation; if that doesn't work (firewall/NAT), hbbr can step in as relay.
Yes - a reverse proxy for domain/certificates/ingress policies is common. It's important to correctly map port and protocol requirements (TCP/UDP).
With self-hosting, you control the infrastructure components (hbbs/hbbr). You should also define in your operations concept what you log (e.g., connection logs) and for how long.
For small environments, a lean VM/instance is often sufficient; bandwidth/latency (especially for relay usage) and clean firewall rules are decisive.
Best practice: Define maintenance windows, test versions in staging first, have a rollback plan (snapshots/VM backups), then deploy to production. With Docker: pin images instead of 'latest'.
Typical: minimal port openings, expose server only behind firewall/VPN (if possible), restrict admin access, enable logs/monitoring, regular updates & restore tests.
Yes, depending on organizational structure: separate servers per location/tenant or a central server with clear policy. It's important to document data flows and responsibilities clearly.
The bottleneck is usually relay traffic (bandwidth/CPU), not the ID server. Scaling is done through better uplink capacity, separate relay servers, location proximity and clean network rules.
Most common: incorrectly opened ports/protocols (TCP vs. UDP), NAT loopback in LAN, missing key in client, and reverse proxy setups that don't correctly map UDP.
More questions? We are happy to help!
These solutions are often used together with RustDesk
These solutions offer similar functionalities and can be evaluated together
No risk: worst case, you leave with a clearer understanding of your project than before.


“WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.”
Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
Timo Wevelsiep & Robin Zins
Managing Directors of WZ-IT
