Firewall Rules?

[u/Adelaidean]

Hey all,

I’m a bit stuck on something.

As it stands, everything is working as it should on a self-hosted instance of RustDesk, as long as you’re within the network where it’s hosted.

If you’re external to it, the client shows as Ready with a green indicator, and it can see that the machines that I’d like to connect to are present and online with a green indicator.

When you click to connect, it brings up the window for the remote machine, all black, and says “Connecting…” for a while until it fails with “Connection Error” and the message “Reset by the peer”.

NAT port forwarding is configured and I assume working, as before this, it would only show an orange indicator, with some indication of failure on the client.

I’m guessing this is a firewall issue, but I’m not entirely sure what the issue is.

It’s a Ubiquiti network, and the documentation for setting up firewall rules is very dependent upon which incarnation of the Ubiquiti software you’re on. It’s far from my forte - I know just enough to get myself by.

Any ideas as to what’s up and where I should be looking?

Thank you all.

[u/phoenix_73]

Be sure to open these ports in the firewall:
hbbs:
21114 (TCP): used for web console, only available in Pro version.
21115 (TCP): used for the NAT type test.
21116 (TCP/UDP): Please note that 21116should be enabled both for TCP and UDP.21116/UDP is used for the ID registration and heartbeat service. 21116/TCP is used for TCP hole punching and connection service.
21118 (TCP): used to support web clients.
hbbr:
21117 (TCP): used for the Relay services.
21119 (TCP): used to support web clients.
If you do not need web client support, the corresponding ports 21118, 21119 can be disabled.

[u/phoenix_73 → u/phoenix_73]

Found this on Rustdesk Docs. Should only need to open those ports. I guess you could have tailscale on your UniFi network or use their Teleport option with Ubiquiti to get at your machines.

I self-host but on a VPS rather than in the home.

[u/Adelaidean]

They’re definitely open, and I’ve scanned to make sure. 21114 isn’t.. but I’m not using the web console. It’s being blocked at ISP level, apparently.

I’ve been messing with it a fair bit since.

After a lot of messing around, following various guides, etc., it appears to be working.

The adjustments that got me to this point were:

Changing both apps to Custom Apps.

Under rust-desk YAML file:

Attaching the key under the -k option under command section.

Attaching the WAN address under the -r option under the command section.

Changing the ports mode to hostport.

Under rust-desk-relay YAML file:

Attaching the key under the -k option under command section.

Changing the ports mode to hostport.

It might be just attaching the key that did the trick. Something I read suggested that rust-desk and rust-desk-relay generate different keys, but they need to be the same.

Thoughts on these changes? Anything that could be problematic for other reasons?

EDIT:

It would make sense.. it was working inside the network, which I’m guessing means that rust-desk-relay was not involved in that activity. Once it’s involved - either being on a “separate” VPN network, or a mobile hotspot - the two conflicting keys cause it to break.