diff --git a/content/self-host/rustdesk-server-oss/Docker/_index.de.md b/content/self-host/rustdesk-server-oss/Docker/_index.de.md index 55d8a46e..a7f9838f 100644 --- a/content/self-host/rustdesk-server-oss/Docker/_index.de.md +++ b/content/self-host/rustdesk-server-oss/Docker/_index.de.md @@ -39,6 +39,12 @@ Stellen Sie sicher, dass Sie diese Ports in der Firewall öffnen: *Wenn Sie keine Webclient-Unterstützung benötigen, können die entsprechenden Ports `21118`, `21119` deaktiviert werden.* +{{% notice warning %}} +Wenn WebSocket aktiviert ist (die Ports `21118`/`21119` für den [Webclient](https://rustdesk.com/web/) geöffnet sind), vertrauen `hbbs`/`hbbr` den Headern `X-Real-IP` / `X-Forwarded-For` eingehender WebSocket-Verbindungen, um die echte Client-IP zu ermitteln, damit die Client-IP erhalten bleibt, wenn der WebSocket-Verkehr über einen Reverse-Proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)) läuft. Diese Header werden nicht validiert. Wer `21118`/`21119` direkt erreichen kann, kann daher mit gefälschten Headern eine beliebige IP-Adresse vortäuschen, IP-basierte Ratenbegrenzung und Sperren umgehen und die in den Logs aufgezeichneten IP-Adressen verfälschen. + +Wenn Sie den Webclient verwenden, stellen Sie die WebSocket-Ports nur über einen Reverse-Proxy bereit, der `X-Real-IP` selbst setzt, und beschränken Sie `21118`/`21119` mit Firewall-Regeln so, dass sich nur der Reverse-Proxy mit ihnen verbinden kann. Wenn Sie den Webclient nicht verwenden, lassen Sie die Ports `21118` und `21119` geschlossen. +{{% /notice %}} + ### Docker-Beispiele ```sh diff --git a/content/self-host/rustdesk-server-oss/Docker/_index.en.md b/content/self-host/rustdesk-server-oss/Docker/_index.en.md index 1a49710a..176bd966 100644 --- a/content/self-host/rustdesk-server-oss/Docker/_index.en.md +++ b/content/self-host/rustdesk-server-oss/Docker/_index.en.md @@ -46,6 +46,12 @@ Be sure to open these ports in the firewall: *If you do not need web client support, the corresponding ports `21118`, `21119` can be disabled.* +{{% notice warning %}} +When WebSocket is enabled (ports `21118`/`21119` are open for the [web client](https://rustdesk.com/web/)), `hbbs`/`hbbr` trust the `X-Real-IP` / `X-Forwarded-For` headers of incoming WebSocket connections to determine the real client IP, so that the client IP is preserved when the WebSocket traffic goes through a reverse proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). These headers are not validated, so anyone who can reach `21118`/`21119` directly can spoof an arbitrary IP address with forged headers, bypassing IP-based rate limiting and blocking, and falsifying the IP addresses recorded in logs. + +If you use the web client, expose the WebSocket ports only through a reverse proxy that sets `X-Real-IP` itself, and restrict `21118`/`21119` with firewall rules so that only the reverse proxy can connect to them. If you do not use the web client, keep ports `21118` and `21119` closed. +{{% /notice %}} + ### Docker examples ```sh diff --git a/content/self-host/rustdesk-server-oss/Docker/_index.es.md b/content/self-host/rustdesk-server-oss/Docker/_index.es.md index 3f9ce25b..0d0f041e 100644 --- a/content/self-host/rustdesk-server-oss/Docker/_index.es.md +++ b/content/self-host/rustdesk-server-oss/Docker/_index.es.md @@ -39,6 +39,12 @@ Asegúrese de abrir estos puertos en el firewall: *Si no necesita soporte para cliente web, los puertos correspondientes `21118`, `21119` pueden deshabilitarse.* +{{% notice warning %}} +Cuando WebSocket está habilitado (los puertos `21118`/`21119` están abiertos para el [cliente web](https://rustdesk.com/web/)), `hbbs`/`hbbr` confían en las cabeceras `X-Real-IP` / `X-Forwarded-For` de las conexiones WebSocket entrantes para determinar la IP real del cliente, de modo que la IP del cliente se conserve cuando el tráfico WebSocket pasa por un proxy inverso ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). Estas cabeceras no se validan, por lo que cualquiera que pueda acceder directamente a `21118`/`21119` puede suplantar una dirección IP arbitraria con cabeceras falsificadas, eludiendo la limitación de velocidad y el bloqueo basados en IP y falseando las direcciones IP registradas en los logs. + +Si usa el cliente web, exponga los puertos WebSocket solo a través de un proxy inverso que establezca `X-Real-IP` por sí mismo, y restrinja `21118`/`21119` con reglas de firewall para que solo el proxy inverso pueda conectarse a ellos. Si no usa el cliente web, mantenga cerrados los puertos `21118` y `21119`. +{{% /notice %}} + ### Ejemplos Docker ```sh diff --git a/content/self-host/rustdesk-server-oss/Docker/_index.fr.md b/content/self-host/rustdesk-server-oss/Docker/_index.fr.md index 8138a9c1..038b6fc7 100644 --- a/content/self-host/rustdesk-server-oss/Docker/_index.fr.md +++ b/content/self-host/rustdesk-server-oss/Docker/_index.fr.md @@ -39,6 +39,12 @@ Assurez-vous d'ouvrir ces ports dans le pare-feu : *Si vous n'avez pas besoin du support client web, les ports correspondants `21118`, `21119` peuvent être désactivés.* +{{% notice warning %}} +Lorsque WebSocket est activé (les ports `21118`/`21119` sont ouverts pour le [client web](https://rustdesk.com/web/)), `hbbs`/`hbbr` font confiance aux en-têtes `X-Real-IP` / `X-Forwarded-For` des connexions WebSocket entrantes pour déterminer l'adresse IP réelle du client, afin que celle-ci soit conservée lorsque le trafic WebSocket passe par un reverse proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). Ces en-têtes ne sont pas validés : quiconque peut atteindre directement `21118`/`21119` peut usurper une adresse IP arbitraire avec des en-têtes falsifiés, contourner la limitation de débit et le blocage basés sur l'IP, et falsifier les adresses IP enregistrées dans les journaux. + +Si vous utilisez le client web, n'exposez les ports WebSocket qu'à travers un reverse proxy qui définit lui-même `X-Real-IP`, et restreignez `21118`/`21119` avec des règles de pare-feu afin que seul le reverse proxy puisse s'y connecter. Si vous n'utilisez pas le client web, laissez les ports `21118` et `21119` fermés. +{{% /notice %}} + ### Exemples Docker ```sh diff --git a/content/self-host/rustdesk-server-oss/Docker/_index.it.md b/content/self-host/rustdesk-server-oss/Docker/_index.it.md index 1ffeb174..2347c809 100644 --- a/content/self-host/rustdesk-server-oss/Docker/_index.it.md +++ b/content/self-host/rustdesk-server-oss/Docker/_index.it.md @@ -39,6 +39,12 @@ Assicurati di aprire queste porte nel firewall: *Se non hai bisogno del supporto client web, le porte corrispondenti `21118`, `21119` possono essere disabilitate.* +{{% notice warning %}} +Quando WebSocket è abilitato (le porte `21118`/`21119` sono aperte per il [client web](https://rustdesk.com/web/)), `hbbs`/`hbbr` si fidano degli header `X-Real-IP` / `X-Forwarded-For` delle connessioni WebSocket in ingresso per determinare l'IP reale del client, in modo da preservare l'IP del client quando il traffico WebSocket passa attraverso un reverse proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). Questi header non vengono validati: chiunque possa raggiungere direttamente `21118`/`21119` può falsificare un indirizzo IP arbitrario con header contraffatti, aggirando il rate limiting e il blocco basati sull'IP e falsificando gli indirizzi IP registrati nei log. + +Se usi il client web, esponi le porte WebSocket solo tramite un reverse proxy che imposti autonomamente `X-Real-IP` e limita `21118`/`21119` con regole firewall in modo che solo il reverse proxy possa connettersi. Se non usi il client web, tieni chiuse le porte `21118` e `21119`. +{{% /notice %}} + ### Esempi Docker ```sh diff --git a/content/self-host/rustdesk-server-oss/Docker/_index.ja.md b/content/self-host/rustdesk-server-oss/Docker/_index.ja.md index 2ec8dd1d..37257a54 100644 --- a/content/self-host/rustdesk-server-oss/Docker/_index.ja.md +++ b/content/self-host/rustdesk-server-oss/Docker/_index.ja.md @@ -39,6 +39,12 @@ rustdesk-server を Docker コンテナとして実行するには、Docker/Podm *ウェブクライアントサポートが不要な場合、対応するポート `21118`、`21119` は無効にできます。* +{{% notice warning %}} +WebSocket を有効にしている場合（[ウェブクライアント](https://rustdesk.com/web/)用にポート `21118`/`21119` を開放している場合）、`hbbs`/`hbbr` は、WebSocket トラフィックがリバースプロキシ（[WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)）を経由してもクライアントの実 IP が失われないように、受信した WebSocket 接続の `X-Real-IP` / `X-Forwarded-For` ヘッダーを信頼してクライアントの実 IP を判定します。これらのヘッダーは検証されないため、`21118`/`21119` に直接アクセスできる者は、偽造ヘッダーで任意の IP アドレスを偽装でき、IP ベースのレート制限やブロックを回避したり、ログに記録される IP アドレスを偽ったりできます。 + +ウェブクライアントを使用する場合は、`X-Real-IP` を自ら設定するリバースプロキシ経由でのみ WebSocket ポートを公開し、ファイアウォールルールで `21118`/`21119` への接続をリバースプロキシからのみに制限してください。ウェブクライアントを使用しない場合は、ポート `21118`、`21119` を閉じたままにしてください。 +{{% /notice %}} + ### Docker の例 ```sh diff --git a/content/self-host/rustdesk-server-oss/Docker/_index.ko.md b/content/self-host/rustdesk-server-oss/Docker/_index.ko.md index 7e577da5..f6ecb9df 100644 --- a/content/self-host/rustdesk-server-oss/Docker/_index.ko.md +++ b/content/self-host/rustdesk-server-oss/Docker/_index.ko.md @@ -46,6 +46,12 @@ Docker/Podman이 설치되어 있어야만 rustdesk-server를 Docker 컨테이 *웹 클라이언트 지원이 필요하지 않은 경우, 해당 포트 `21118`, `21119`를 비활성화할 수 있습니다.* +{{% notice warning %}} +WebSocket이 활성화된 경우([웹 클라이언트](https://rustdesk.com/web/)를 위해 포트 `21118`/`21119`가 열려 있는 경우), `hbbs`/`hbbr`는 WebSocket 트래픽이 리버스 프록시([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms))를 거칠 때 클라이언트의 실제 IP가 유지되도록, 수신되는 WebSocket 연결의 `X-Real-IP` / `X-Forwarded-For` 헤더를 신뢰하여 클라이언트의 실제 IP를 판단합니다. 이 헤더는 검증되지 않으므로, `21118`/`21119`에 직접 접근할 수 있는 사람은 위조된 헤더로 임의의 IP 주소를 사칭하여 IP 기반 속도 제한과 차단을 우회하고 로그에 기록되는 IP 주소를 위조할 수 있습니다. + +웹 클라이언트를 사용하는 경우, `X-Real-IP`를 직접 설정하는 리버스 프록시를 통해서만 WebSocket 포트를 노출하고, 방화벽 규칙으로 `21118`/`21119`에는 리버스 프록시만 연결할 수 있도록 제한하세요. 웹 클라이언트를 사용하지 않는 경우, 포트 `21118`, `21119`를 닫아 두세요. +{{% /notice %}} + ### Docker 예제 ```sh diff --git a/content/self-host/rustdesk-server-oss/Docker/_index.pl.md b/content/self-host/rustdesk-server-oss/Docker/_index.pl.md index 67f1a590..492339c7 100644 --- a/content/self-host/rustdesk-server-oss/Docker/_index.pl.md +++ b/content/self-host/rustdesk-server-oss/Docker/_index.pl.md @@ -40,6 +40,12 @@ Upewnij się, że zezwoliłeś na te porty w zaporze: *Jeżeli nie potrzebujesz obsługi klientów webowych, porty `21118` i `21119` mogą zostać zablokowane.* +{{% notice warning %}} +Gdy WebSocket jest włączony (porty `21118`/`21119` są otwarte dla [klienta webowego](https://rustdesk.com/web/)), `hbbs`/`hbbr` ufają nagłówkom `X-Real-IP` / `X-Forwarded-For` przychodzących połączeń WebSocket, aby ustalić prawdziwy adres IP klienta — dzięki temu adres IP klienta nie jest tracony, gdy ruch WebSocket przechodzi przez reverse proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). Nagłówki te nie są weryfikowane, więc każdy, kto może bezpośrednio połączyć się z `21118`/`21119`, może sfałszować dowolny adres IP za pomocą spreparowanych nagłówków, omijając ograniczanie liczby żądań i blokady oparte na IP oraz fałszując adresy IP zapisywane w logach. + +Jeżeli używasz klienta webowego, udostępniaj porty WebSocket wyłącznie przez reverse proxy, które samo ustawia `X-Real-IP`, i ogranicz regułami zapory dostęp do `21118`/`21119` tak, aby mogło się z nimi łączyć tylko reverse proxy. Jeżeli nie używasz klienta webowego, pozostaw porty `21118` i `21119` zamknięte. +{{% /notice %}} + ### Przykłady z Dockerem ```sh diff --git a/content/self-host/rustdesk-server-oss/Docker/_index.pt.md b/content/self-host/rustdesk-server-oss/Docker/_index.pt.md index d689c9b7..01c55e3e 100644 --- a/content/self-host/rustdesk-server-oss/Docker/_index.pt.md +++ b/content/self-host/rustdesk-server-oss/Docker/_index.pt.md @@ -39,6 +39,12 @@ Certifique-se de abrir essas portas no firewall: *Se você não precisar de suporte para cliente web, as portas correspondentes `21118`, `21119` podem ser desabilitadas.* +{{% notice warning %}} +Quando o WebSocket está habilitado (portas `21118`/`21119` abertas para o [cliente web](https://rustdesk.com/web/)), o `hbbs`/`hbbr` confia nos cabeçalhos `X-Real-IP` / `X-Forwarded-For` das conexões WebSocket recebidas para determinar o IP real do cliente, de modo que o IP do cliente seja preservado quando o tráfego WebSocket passa por um proxy reverso ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). Esses cabeçalhos não são validados, portanto qualquer pessoa que consiga acessar diretamente `21118`/`21119` pode forjar um endereço IP arbitrário com cabeçalhos falsificados, contornando a limitação de taxa e o bloqueio baseados em IP e falsificando os endereços IP registrados nos logs. + +Se você usa o cliente web, exponha as portas WebSocket apenas por meio de um proxy reverso que defina o `X-Real-IP` por conta própria e restrinja `21118`/`21119` com regras de firewall para que apenas o proxy reverso possa se conectar a elas. Se você não usa o cliente web, mantenha as portas `21118` e `21119` fechadas. +{{% /notice %}} + ### Exemplos Docker ```sh diff --git a/content/self-host/rustdesk-server-oss/Docker/_index.ro.md b/content/self-host/rustdesk-server-oss/Docker/_index.ro.md index 1d6deb89..db0f538d 100644 --- a/content/self-host/rustdesk-server-oss/Docker/_index.ro.md +++ b/content/self-host/rustdesk-server-oss/Docker/_index.ro.md @@ -39,6 +39,12 @@ Asigură-te că deschizi următoarele porturi în firewall: *Dacă nu ai nevoie de suport pentru clienți web, porturile corespunzătoare `21118`, `21119` pot fi dezactivate.* +{{% notice warning %}} +Când WebSocket este activat (porturile `21118`/`21119` sunt deschise pentru [clientul web](https://rustdesk.com/web/)), `hbbs`/`hbbr` au încredere în anteturile `X-Real-IP` / `X-Forwarded-For` ale conexiunilor WebSocket primite pentru a determina IP-ul real al clientului, astfel încât IP-ul clientului să fie păstrat atunci când traficul WebSocket trece printr-un reverse proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). Aceste anteturi nu sunt validate, așa că oricine poate accesa direct `21118`/`21119` poate falsifica o adresă IP arbitrară cu anteturi contrafăcute, ocolind limitarea ratei și blocarea bazate pe IP și falsificând adresele IP înregistrate în loguri. + +Dacă folosești clientul web, expune porturile WebSocket doar printr-un reverse proxy care setează el însuși `X-Real-IP` și restricționează `21118`/`21119` cu reguli de firewall astfel încât doar reverse proxy-ul să se poată conecta la ele. Dacă nu folosești clientul web, păstrează porturile `21118` și `21119` închise. +{{% /notice %}} + ### Exemple Docker ```sh diff --git a/content/self-host/rustdesk-server-oss/Docker/_index.zh-cn.md b/content/self-host/rustdesk-server-oss/Docker/_index.zh-cn.md index f86032af..ef29f664 100644 --- a/content/self-host/rustdesk-server-oss/Docker/_index.zh-cn.md +++ b/content/self-host/rustdesk-server-oss/Docker/_index.zh-cn.md @@ -39,6 +39,12 @@ keywords: ["rustdesk docker", "rustdesk docker compose", "rustdesk server docker *如果您不需要网页客户端支持，可以禁用相应的端口 `21118`、`21119`。* +{{% notice warning %}} +启用 WebSocket（为[网页客户端](https://rustdesk.com/web/)开放端口 `21118`/`21119`）后，`hbbs`/`hbbr` 会信任 WebSocket 连接中的 `X-Real-IP` / `X-Forwarded-For` 请求头来确定客户端的真实 IP，以便在 WebSocket 流量经过反向代理（[WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)）时保留客户端真实 IP。这些请求头不会被校验，因此任何能直接访问 `21118`/`21119` 的人都可以通过伪造请求头来伪装任意 IP 地址，从而绕过基于 IP 的限速和封禁，并伪造日志中记录的 IP 地址。 + +如果您使用网页客户端，请只通过反向代理（由代理自行设置 `X-Real-IP`）暴露 WebSocket 端口，并通过防火墙规则限制 `21118`/`21119` 只接受来自反向代理的连接。如果您不使用网页客户端，请保持端口 `21118`、`21119` 关闭。 +{{% /notice %}} + ### Docker 示例 ```sh diff --git a/content/self-host/rustdesk-server-oss/Docker/_index.zh-tw.md b/content/self-host/rustdesk-server-oss/Docker/_index.zh-tw.md index 3f8b9a30..35980a24 100644 --- a/content/self-host/rustdesk-server-oss/Docker/_index.zh-tw.md +++ b/content/self-host/rustdesk-server-oss/Docker/_index.zh-tw.md @@ -39,6 +39,12 @@ keywords: ["rustdesk docker", "rustdesk docker compose", "rustdesk server docker *如果您不需要網頁客戶端支援，可以停用相應的埠口 `21118`、`21119`。* +{{% notice warning %}} +啟用 WebSocket（為[網頁客戶端](https://rustdesk.com/web/)開放埠口 `21118`/`21119`）後，`hbbs`/`hbbr` 會信任 WebSocket 連線中的 `X-Real-IP` / `X-Forwarded-For` 請求標頭來判斷客戶端的真實 IP，以便在 WebSocket 流量經過反向代理（[WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)）時保留客戶端真實 IP。這些標頭不會被驗證，因此任何能直接連線 `21118`/`21119` 的人都可以透過偽造標頭來偽裝任意 IP 位址，從而繞過基於 IP 的速率限制和封鎖，並偽造日誌中記錄的 IP 位址。 + +如果您使用網頁客戶端，請只透過反向代理（由代理自行設定 `X-Real-IP`）公開 WebSocket 埠口，並透過防火牆規則限制 `21118`/`21119` 只接受來自反向代理的連線。如果您不使用網頁客戶端，請保持埠口 `21118`、`21119` 關閉。 +{{% /notice %}} + ### Docker 範例 ```sh diff --git a/content/self-host/rustdesk-server-oss/install/_index.de.md b/content/self-host/rustdesk-server-oss/install/_index.de.md index 76663aac..183edffa 100644 --- a/content/self-host/rustdesk-server-oss/install/_index.de.md +++ b/content/self-host/rustdesk-server-oss/install/_index.de.md @@ -33,6 +33,12 @@ ufw allow 21116/udp sudo ufw enable ``` +{{% notice warning %}} +Wenn WebSocket aktiviert ist (die Ports `21118`/`21119` für den [Webclient](https://rustdesk.com/web/) geöffnet sind), vertrauen `hbbs`/`hbbr` den Headern `X-Real-IP` / `X-Forwarded-For` eingehender WebSocket-Verbindungen, um die echte Client-IP zu ermitteln, damit die Client-IP erhalten bleibt, wenn der WebSocket-Verkehr über einen Reverse-Proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)) läuft. Diese Header werden nicht validiert. Wer `21118`/`21119` direkt erreichen kann, kann daher mit gefälschten Headern eine beliebige IP-Adresse vortäuschen, IP-basierte Ratenbegrenzung und Sperren umgehen und die in den Logs aufgezeichneten IP-Adressen verfälschen. + +Wenn Sie den Webclient verwenden, stellen Sie die WebSocket-Ports nur über einen Reverse-Proxy bereit, der `X-Real-IP` selbst setzt, und beschränken Sie `21118`/`21119` mit Firewall-Regeln so, dass sich nur der Reverse-Proxy mit ihnen verbinden kann. Wenn Sie den Webclient nicht verwenden, lassen Sie die Ports `21118` und `21119` geschlossen. +{{% /notice %}} + ## Installation ### Methode 1: Docker (Empfohlen) diff --git a/content/self-host/rustdesk-server-oss/install/_index.en.md b/content/self-host/rustdesk-server-oss/install/_index.en.md index 835753dc..9acc23e0 100644 --- a/content/self-host/rustdesk-server-oss/install/_index.en.md +++ b/content/self-host/rustdesk-server-oss/install/_index.en.md @@ -33,6 +33,12 @@ ufw allow 21116/udp sudo ufw enable ``` +{{% notice warning %}} +When WebSocket is enabled (ports `21118`/`21119` are open for the [web client](https://rustdesk.com/web/)), `hbbs`/`hbbr` trust the `X-Real-IP` / `X-Forwarded-For` headers of incoming WebSocket connections to determine the real client IP, so that the client IP is preserved when the WebSocket traffic goes through a reverse proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). These headers are not validated, so anyone who can reach `21118`/`21119` directly can spoof an arbitrary IP address with forged headers, bypassing IP-based rate limiting and blocking, and falsifying the IP addresses recorded in logs. + +If you use the web client, expose the WebSocket ports only through a reverse proxy that sets `X-Real-IP` itself, and restrict `21118`/`21119` with firewall rules so that only the reverse proxy can connect to them. If you do not use the web client, keep ports `21118` and `21119` closed. +{{% /notice %}} + ## Install ### Method 1: Docker (Recommended) diff --git a/content/self-host/rustdesk-server-oss/install/_index.es.md b/content/self-host/rustdesk-server-oss/install/_index.es.md index 02026da1..b294a4ac 100644 --- a/content/self-host/rustdesk-server-oss/install/_index.es.md +++ b/content/self-host/rustdesk-server-oss/install/_index.es.md @@ -33,6 +33,12 @@ ufw allow 21116/udp sudo ufw enable ``` +{{% notice warning %}} +Cuando WebSocket está habilitado (los puertos `21118`/`21119` están abiertos para el [cliente web](https://rustdesk.com/web/)), `hbbs`/`hbbr` confían en las cabeceras `X-Real-IP` / `X-Forwarded-For` de las conexiones WebSocket entrantes para determinar la IP real del cliente, de modo que la IP del cliente se conserve cuando el tráfico WebSocket pasa por un proxy inverso ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). Estas cabeceras no se validan, por lo que cualquiera que pueda acceder directamente a `21118`/`21119` puede suplantar una dirección IP arbitraria con cabeceras falsificadas, eludiendo la limitación de velocidad y el bloqueo basados en IP y falseando las direcciones IP registradas en los logs. + +Si usa el cliente web, exponga los puertos WebSocket solo a través de un proxy inverso que establezca `X-Real-IP` por sí mismo, y restrinja `21118`/`21119` con reglas de firewall para que solo el proxy inverso pueda conectarse a ellos. Si no usa el cliente web, mantenga cerrados los puertos `21118` y `21119`. +{{% /notice %}} + ## Instalación ### Método 1: Docker (Recomendado) diff --git a/content/self-host/rustdesk-server-oss/install/_index.fr.md b/content/self-host/rustdesk-server-oss/install/_index.fr.md index a7ac4ebc..43a1235c 100644 --- a/content/self-host/rustdesk-server-oss/install/_index.fr.md +++ b/content/self-host/rustdesk-server-oss/install/_index.fr.md @@ -33,6 +33,12 @@ ufw allow 21116/udp sudo ufw enable ``` +{{% notice warning %}} +Lorsque WebSocket est activé (les ports `21118`/`21119` sont ouverts pour le [client web](https://rustdesk.com/web/)), `hbbs`/`hbbr` font confiance aux en-têtes `X-Real-IP` / `X-Forwarded-For` des connexions WebSocket entrantes pour déterminer l'adresse IP réelle du client, afin que celle-ci soit conservée lorsque le trafic WebSocket passe par un reverse proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). Ces en-têtes ne sont pas validés : quiconque peut atteindre directement `21118`/`21119` peut usurper une adresse IP arbitraire avec des en-têtes falsifiés, contourner la limitation de débit et le blocage basés sur l'IP, et falsifier les adresses IP enregistrées dans les journaux. + +Si vous utilisez le client web, n'exposez les ports WebSocket qu'à travers un reverse proxy qui définit lui-même `X-Real-IP`, et restreignez `21118`/`21119` avec des règles de pare-feu afin que seul le reverse proxy puisse s'y connecter. Si vous n'utilisez pas le client web, laissez les ports `21118` et `21119` fermés. +{{% /notice %}} + ## Installation ### Méthode 1 : Docker (Recommandé) diff --git a/content/self-host/rustdesk-server-oss/install/_index.it.md b/content/self-host/rustdesk-server-oss/install/_index.it.md index 2ecfce89..110e9739 100644 --- a/content/self-host/rustdesk-server-oss/install/_index.it.md +++ b/content/self-host/rustdesk-server-oss/install/_index.it.md @@ -33,6 +33,12 @@ ufw allow 21116/udp sudo ufw enable ``` +{{% notice warning %}} +Quando WebSocket è abilitato (le porte `21118`/`21119` sono aperte per il [client web](https://rustdesk.com/web/)), `hbbs`/`hbbr` si fidano degli header `X-Real-IP` / `X-Forwarded-For` delle connessioni WebSocket in ingresso per determinare l'IP reale del client, in modo da preservare l'IP del client quando il traffico WebSocket passa attraverso un reverse proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). Questi header non vengono validati: chiunque possa raggiungere direttamente `21118`/`21119` può falsificare un indirizzo IP arbitrario con header contraffatti, aggirando il rate limiting e il blocco basati sull'IP e falsificando gli indirizzi IP registrati nei log. + +Se usi il client web, esponi le porte WebSocket solo tramite un reverse proxy che imposti autonomamente `X-Real-IP` e limita `21118`/`21119` con regole firewall in modo che solo il reverse proxy possa connettersi. Se non usi il client web, tieni chiuse le porte `21118` e `21119`. +{{% /notice %}} + ## Installazione ### Metodo 1: Docker (Consigliato) diff --git a/content/self-host/rustdesk-server-oss/install/_index.ja.md b/content/self-host/rustdesk-server-oss/install/_index.ja.md index 0119a32e..70b5e7dd 100644 --- a/content/self-host/rustdesk-server-oss/install/_index.ja.md +++ b/content/self-host/rustdesk-server-oss/install/_index.ja.md @@ -33,6 +33,12 @@ ufw allow 21116/udp sudo ufw enable ``` +{{% notice warning %}} +WebSocket を有効にしている場合（[ウェブクライアント](https://rustdesk.com/web/)用にポート `21118`/`21119` を開放している場合）、`hbbs`/`hbbr` は、WebSocket トラフィックがリバースプロキシ（[WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)）を経由してもクライアントの実 IP が失われないように、受信した WebSocket 接続の `X-Real-IP` / `X-Forwarded-For` ヘッダーを信頼してクライアントの実 IP を判定します。これらのヘッダーは検証されないため、`21118`/`21119` に直接アクセスできる者は、偽造ヘッダーで任意の IP アドレスを偽装でき、IP ベースのレート制限やブロックを回避したり、ログに記録される IP アドレスを偽ったりできます。 + +ウェブクライアントを使用する場合は、`X-Real-IP` を自ら設定するリバースプロキシ経由でのみ WebSocket ポートを公開し、ファイアウォールルールで `21118`/`21119` への接続をリバースプロキシからのみに制限してください。ウェブクライアントを使用しない場合は、ポート `21118`、`21119` を閉じたままにしてください。 +{{% /notice %}} + ## インストール ### 方法1：Docker（推奨） diff --git a/content/self-host/rustdesk-server-oss/install/_index.ko.md b/content/self-host/rustdesk-server-oss/install/_index.ko.md index fb120465..a614c432 100644 --- a/content/self-host/rustdesk-server-oss/install/_index.ko.md +++ b/content/self-host/rustdesk-server-oss/install/_index.ko.md @@ -34,6 +34,12 @@ ufw allow 21116/udp sudo ufw enable ``` +{{% notice warning %}} +WebSocket이 활성화된 경우([웹 클라이언트](https://rustdesk.com/web/)를 위해 포트 `21118`/`21119`가 열려 있는 경우), `hbbs`/`hbbr`는 WebSocket 트래픽이 리버스 프록시([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms))를 거칠 때 클라이언트의 실제 IP가 유지되도록, 수신되는 WebSocket 연결의 `X-Real-IP` / `X-Forwarded-For` 헤더를 신뢰하여 클라이언트의 실제 IP를 판단합니다. 이 헤더는 검증되지 않으므로, `21118`/`21119`에 직접 접근할 수 있는 사람은 위조된 헤더로 임의의 IP 주소를 사칭하여 IP 기반 속도 제한과 차단을 우회하고 로그에 기록되는 IP 주소를 위조할 수 있습니다. + +웹 클라이언트를 사용하는 경우, `X-Real-IP`를 직접 설정하는 리버스 프록시를 통해서만 WebSocket 포트를 노출하고, 방화벽 규칙으로 `21118`/`21119`에는 리버스 프록시만 연결할 수 있도록 제한하세요. 웹 클라이언트를 사용하지 않는 경우, 포트 `21118`, `21119`를 닫아 두세요. +{{% /notice %}} + ## 설치하기 ### 방법 1: Docker (권장) diff --git a/content/self-host/rustdesk-server-oss/install/_index.pl.md b/content/self-host/rustdesk-server-oss/install/_index.pl.md index a778678f..185a59bd 100644 --- a/content/self-host/rustdesk-server-oss/install/_index.pl.md +++ b/content/self-host/rustdesk-server-oss/install/_index.pl.md @@ -33,6 +33,12 @@ ufw allow 21116/udp sudo ufw enable ``` +{{% notice warning %}} +Gdy WebSocket jest włączony (porty `21118`/`21119` są otwarte dla [klienta webowego](https://rustdesk.com/web/)), `hbbs`/`hbbr` ufają nagłówkom `X-Real-IP` / `X-Forwarded-For` przychodzących połączeń WebSocket, aby ustalić prawdziwy adres IP klienta — dzięki temu adres IP klienta nie jest tracony, gdy ruch WebSocket przechodzi przez reverse proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). Nagłówki te nie są weryfikowane, więc każdy, kto może bezpośrednio połączyć się z `21118`/`21119`, może sfałszować dowolny adres IP za pomocą spreparowanych nagłówków, omijając ograniczanie liczby żądań i blokady oparte na IP oraz fałszując adresy IP zapisywane w logach. + +Jeżeli używasz klienta webowego, udostępniaj porty WebSocket wyłącznie przez reverse proxy, które samo ustawia `X-Real-IP`, i ogranicz regułami zapory dostęp do `21118`/`21119` tak, aby mogło się z nimi łączyć tylko reverse proxy. Jeżeli nie używasz klienta webowego, pozostaw porty `21118` i `21119` zamknięte. +{{% /notice %}} + ## Instalacja ### Metoda 1.: Docker (zalecana) diff --git a/content/self-host/rustdesk-server-oss/install/_index.pt.md b/content/self-host/rustdesk-server-oss/install/_index.pt.md index f859571c..3b58500b 100644 --- a/content/self-host/rustdesk-server-oss/install/_index.pt.md +++ b/content/self-host/rustdesk-server-oss/install/_index.pt.md @@ -33,6 +33,12 @@ ufw allow 21116/udp sudo ufw enable ``` +{{% notice warning %}} +Quando o WebSocket está habilitado (portas `21118`/`21119` abertas para o [cliente web](https://rustdesk.com/web/)), o `hbbs`/`hbbr` confia nos cabeçalhos `X-Real-IP` / `X-Forwarded-For` das conexões WebSocket recebidas para determinar o IP real do cliente, de modo que o IP do cliente seja preservado quando o tráfego WebSocket passa por um proxy reverso ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). Esses cabeçalhos não são validados, portanto qualquer pessoa que consiga acessar diretamente `21118`/`21119` pode forjar um endereço IP arbitrário com cabeçalhos falsificados, contornando a limitação de taxa e o bloqueio baseados em IP e falsificando os endereços IP registrados nos logs. + +Se você usa o cliente web, exponha as portas WebSocket apenas por meio de um proxy reverso que defina o `X-Real-IP` por conta própria e restrinja `21118`/`21119` com regras de firewall para que apenas o proxy reverso possa se conectar a elas. Se você não usa o cliente web, mantenha as portas `21118` e `21119` fechadas. +{{% /notice %}} + ## Instalar ### Método 1: Docker (Recomendado) diff --git a/content/self-host/rustdesk-server-oss/install/_index.ro.md b/content/self-host/rustdesk-server-oss/install/_index.ro.md index 80750bc5..891f198e 100644 --- a/content/self-host/rustdesk-server-oss/install/_index.ro.md +++ b/content/self-host/rustdesk-server-oss/install/_index.ro.md @@ -33,6 +33,12 @@ ufw allow 21116/udp sudo ufw enable ``` +{{% notice warning %}} +Când WebSocket este activat (porturile `21118`/`21119` sunt deschise pentru [clientul web](https://rustdesk.com/web/)), `hbbs`/`hbbr` au încredere în anteturile `X-Real-IP` / `X-Forwarded-For` ale conexiunilor WebSocket primite pentru a determina IP-ul real al clientului, astfel încât IP-ul clientului să fie păstrat atunci când traficul WebSocket trece printr-un reverse proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). Aceste anteturi nu sunt validate, așa că oricine poate accesa direct `21118`/`21119` poate falsifica o adresă IP arbitrară cu anteturi contrafăcute, ocolind limitarea ratei și blocarea bazate pe IP și falsificând adresele IP înregistrate în loguri. + +Dacă folosești clientul web, expune porturile WebSocket doar printr-un reverse proxy care setează el însuși `X-Real-IP` și restricționează `21118`/`21119` cu reguli de firewall astfel încât doar reverse proxy-ul să se poată conecta la ele. Dacă nu folosești clientul web, păstrează porturile `21118` și `21119` închise. +{{% /notice %}} + ## Instalare ### Metoda 1: Docker (Recomandat) diff --git a/content/self-host/rustdesk-server-oss/install/_index.zh-cn.md b/content/self-host/rustdesk-server-oss/install/_index.zh-cn.md index 8ea58205..97eb7762 100644 --- a/content/self-host/rustdesk-server-oss/install/_index.zh-cn.md +++ b/content/self-host/rustdesk-server-oss/install/_index.zh-cn.md @@ -33,6 +33,12 @@ ufw allow 21116/udp sudo ufw enable ``` +{{% notice warning %}} +启用 WebSocket（为[网页客户端](https://rustdesk.com/web/)开放端口 `21118`/`21119`）后，`hbbs`/`hbbr` 会信任 WebSocket 连接中的 `X-Real-IP` / `X-Forwarded-For` 请求头来确定客户端的真实 IP，以便在 WebSocket 流量经过反向代理（[WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)）时保留客户端真实 IP。这些请求头不会被校验，因此任何能直接访问 `21118`/`21119` 的人都可以通过伪造请求头来伪装任意 IP 地址，从而绕过基于 IP 的限速和封禁，并伪造日志中记录的 IP 地址。 + +如果您使用网页客户端，请只通过反向代理（由代理自行设置 `X-Real-IP`）暴露 WebSocket 端口，并通过防火墙规则限制 `21118`/`21119` 只接受来自反向代理的连接。如果您不使用网页客户端，请保持端口 `21118`、`21119` 关闭。 +{{% /notice %}} + ## 安装 ### 方法1：Docker（推荐） diff --git a/content/self-host/rustdesk-server-oss/install/_index.zh-tw.md b/content/self-host/rustdesk-server-oss/install/_index.zh-tw.md index 5a693834..474c4d16 100644 --- a/content/self-host/rustdesk-server-oss/install/_index.zh-tw.md +++ b/content/self-host/rustdesk-server-oss/install/_index.zh-tw.md @@ -33,6 +33,12 @@ ufw allow 21116/udp sudo ufw enable ``` +{{% notice warning %}} +啟用 WebSocket（為[網頁客戶端](https://rustdesk.com/web/)開放埠口 `21118`/`21119`）後，`hbbs`/`hbbr` 會信任 WebSocket 連線中的 `X-Real-IP` / `X-Forwarded-For` 請求標頭來判斷客戶端的真實 IP，以便在 WebSocket 流量經過反向代理（[WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)）時保留客戶端真實 IP。這些標頭不會被驗證，因此任何能直接連線 `21118`/`21119` 的人都可以透過偽造標頭來偽裝任意 IP 位址，從而繞過基於 IP 的速率限制和封鎖，並偽造日誌中記錄的 IP 位址。 + +如果您使用網頁客戶端，請只透過反向代理（由代理自行設定 `X-Real-IP`）公開 WebSocket 埠口，並透過防火牆規則限制 `21118`/`21119` 只接受來自反向代理的連線。如果您不使用網頁客戶端，請保持埠口 `21118`、`21119` 關閉。 +{{% /notice %}} + ## 安裝 ### 方法1：Docker（建議）