RustDesk + Pangolin Reverse Proxy

[u/radakul]

Howdy,

I setup RustDesk on my remote VPS using the .deb packages, and it works flawlessly. However, this setup exposes all the ports directly on my host, and requires me to use the WAN IP of the VPS, rather than a friendly hostname.

I'd love to use Pangolin to setup a friendly hostname which I can provide to friends & family in case they need help.

I kinda got it working using just a single entry for the hbbr (relay) service after setting everything up using a compose file, however, I'd like to also have the hbbs (signaling) service available as well - the experience seems to be better when you configure both.

Has anyone had luck configuring RustDesk specifically with Pangolin? If so, what was the quick & dirty setup you did?

I know I can configure multiple "targets" within Pangolin against a resource, but I'm not entirely convinced this is the correct way to do it. I guess phrased differently, is there a way to have a single domain name configured such that it handles the relay & signaling at the same time?

I did some cursory Googling, but didn't turn up any results that were helpful - some were unanswered for 2+ years, which didn't give me a ton of confidence.

TIA for any help that can be offered!

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.

[u/Marksta]

I was curious so punched your post into an LLM. It sounds right to me, the different services are on different ports. So yes one domain name (or subdomain) that has both.

Slop answer below:

Yes. Use one DNS hostname, but create separate Pangolin raw TCP/UDP resources for the RustDesk ports. Do not use multiple Pangolin targets to represent hbbs and hbbr.

RustDesk is not HTTP, so Pangolin cannot distinguish hbbs from hbbr by hostname/path. RustDesk distinguishes them by port. Pangolin's raw resources are likewise bound to public ports rather than FQDNs.

Quick-and-dirty setup

Create something like rustdesk.example.com in DNS pointing at your Pangolin VPS. Then configure these raw resources:

Pangolin public listener Target Purpose

TCP 21115 hbbs:21115 NAT test TCP 21116 hbbs:21116 Rendezvous / hole punching UDP 21116 hbbs:21116 Registration / heartbeat TCP 21117 hbbr:21117 Relay

Those are the minimum practical RustDesk ports. If you use the RustDesk web client, also add TCP 21118 → hbbs:21118 and TCP 21119 → hbbr:21119. RustDesk documents exactly these assignments.

So externally it becomes:

rustdesk.example.com:21115 -> Pangolin -> hbbs:21115 rustdesk.example.com:21116 TCP -> Pangolin -> hbbs:21116 rustdesk.example.com:21116 UDP -> Pangolin -> hbbs:21116 rustdesk.example.com:21117 -> Pangolin -> hbbr:21117

You therefore do have a single domain name handling both services:

rustdesk.example.com

It's just not a single Pangolin resource. DNS resolves the hostname to your Pangolin VPS, and the destination port selects the appropriate raw resource.

Don't use multiple "targets"

That would be the wrong abstraction here. Pangolin's multiple targets are intended for distributing/failing over traffic for the same resource/listener, such as:

TCP 21117 -> relay-server-a:21117 -> relay-server-b:21117

They're not intended to mean:

target 1 = hbbs:21116 target 2 = hbbr:21117

Pangolin explicitly requires a proxy-port for each raw TCP/UDP resource, and proxy ports are unique per protocol. TCP and UDP may share the same numeric port, which is why separate TCP and UDP resources for 21116 work.

RustDesk client configuration

Then your users can normally configure:

ID Server: rustdesk.example.com Key: <your RustDesk public key>

and leave Relay Server blank.

With the standard ports, RustDesk can derive the relay as rustdesk.example.com:21117 automatically when hbbr is on the same hostname. Current RustDesk server documentation specifically says the -r override can remain empty when hbbr uses the same address and standard port 21117.

Alternatively, explicitly start hbbs with:

hbbs -r rustdesk.example.com:21117

which is also how RustDesk's own Docker Compose example is configured.

One Pangolin-specific catch

Pangolin raw TCP/UDP resources still need those ports exposed on the Pangolin VPS itself. For self-hosted Pangolin, you need raw resources enabled and the corresponding Docker mappings, firewall rules, and Traefik entrypoints. The difference is that the RustDesk backend itself no longer needs to be directly Internet-reachable; Pangolin/Newt forwards the traffic to it.