feat(rustdesk): 新增独占式 IP 直连模式

src/runtime/remote_access.rs

@@ -121,7 +121,7 @@ impl RemoteAccessCoordinator {
         let vnc = self.vnc.read().await.clone();
         let rtsp = self.rtsp.read().await.clone();
 
-        config.rustdesk.enabled = rustdesk.is_some_and(|service| service.is_listening());
+        config.rustdesk.enabled = rustdesk.is_some_and(|service| service.is_running());
         config.vnc.enabled = match vnc {
             Some(service) => matches!(
                 service.status().await,
@@ -191,8 +191,12 @@ impl RemoteAccessCoordinator {
             .await?;
 
         let need_restart = options.force
+            || old_config.mode != new_config.mode
             || old_config.codec != new_config.codec
+            || old_config.direct_access_port != new_config.direct_access_port
             || old_config.rendezvous_server != new_config.rendezvous_server
+            || old_config.relay_server != new_config.relay_server
+            || old_config.relay_key != new_config.relay_key
             || old_config.device_id != new_config.device_id
             || old_config.device_password != new_config.device_password;
         let current = self.rustdesk.read().await.clone();
@@ -224,7 +228,7 @@ impl RemoteAccessCoordinator {
                     credentials_to_save = service.save_credentials();
                 }
                 Some(service) => {
-                    if service.is_listening() {
+                    if service.is_running() {
                         if need_restart {
                             service.restart(new_config.clone()).await.map_err(|error| {
                                 AppError::Config(format!(

src/rustdesk/config.rs

@@ -11,12 +11,24 @@ pub enum RustDeskCodec {
     H265,
 }
 
+#[typeshare]
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+#[derive(Default)]
+pub enum RustDeskMode {
+    #[default]
+    Id,
+    DirectIp,
+}
+
 #[typeshare]
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(default)]
 pub struct RustDeskConfig {
     pub enabled: bool,
+    pub mode: RustDeskMode,
     pub codec: RustDeskCodec,
+    pub direct_access_port: u16,
     pub rendezvous_server: String,
     pub relay_server: Option<String>,
     #[typeshare(skip)]
@@ -40,7 +52,9 @@ impl Default for RustDeskConfig {
     fn default() -> Self {
         Self {
             enabled: false,
+            mode: RustDeskMode::Id,
             codec: RustDeskCodec::H264,
+            direct_access_port: 21118,
             rendezvous_server: String::new(),
             relay_server: None,
             relay_key: None,
@@ -58,9 +72,12 @@ impl Default for RustDeskConfig {
 impl RustDeskConfig {
     pub fn is_valid(&self) -> bool {
         self.enabled
-            && !self.rendezvous_server.is_empty()
             && !self.device_id.is_empty()
             && !self.device_password.is_empty()
+            && match self.mode {
+                RustDeskMode::Id => !self.rendezvous_server.trim().is_empty(),
+                RustDeskMode::DirectIp => self.direct_access_port != 0,
+            }
     }
 
     pub fn effective_rendezvous_server(&self) -> &str {
@@ -214,4 +231,43 @@ mod tests {
         config.rendezvous_server = String::new();
         assert_eq!(config.effective_rendezvous_server(), "");
     }
+
+    #[test]
+    fn direct_ip_mode_is_valid_without_rendezvous_server() {
+        let config = RustDeskConfig {
+            enabled: true,
+            mode: RustDeskMode::DirectIp,
+            rendezvous_server: String::new(),
+            ..Default::default()
+        };
+
+        assert!(config.is_valid());
+    }
+
+    #[test]
+    fn id_mode_is_invalid_without_rendezvous_server() {
+        let config = RustDeskConfig {
+            enabled: true,
+            mode: RustDeskMode::Id,
+            rendezvous_server: String::new(),
+            ..Default::default()
+        };
+
+        assert!(!config.is_valid());
+    }
+
+    #[test]
+    fn legacy_config_defaults_to_id_mode() {
+        let config: RustDeskConfig = serde_json::from_value(serde_json::json!({
+            "enabled": false,
+            "codec": "h264",
+            "rendezvous_server": "",
+            "device_id": "123456789",
+            "device_password": "password"
+        }))
+        .expect("legacy RustDesk config should deserialize");
+
+        assert_eq!(config.mode, RustDeskMode::Id);
+        assert_eq!(config.direct_access_port, 21118);
+    }
 }

src/rustdesk/connection.rs

@@ -100,6 +100,12 @@ pub enum ConnectionState {
     Error(String),
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ConnectionMode {
+    Secure,
+    DirectIp,
+}
+
 /// Incoming connection from a RustDesk client
 pub struct Connection {
     /// Connection ID
@@ -113,12 +119,18 @@ pub struct Connection {
     /// Connection state
     state: Arc<RwLock<ConnectionState>>,
     /// Our signing keypair (Ed25519) for signing SignedId messages
-    signing_keypair: SigningKeyPair,
+    signing_keypair: Option<SigningKeyPair>,
     /// Temporary Curve25519 keypair for this connection (used for encryption)
     /// Generated fresh for each connection, public key goes in IdPk.pk
     temp_keypair: (box_::PublicKey, box_::SecretKey),
     /// Device password
     password: String,
+    /// Connection path determines whether the RustDesk signed-ID handshake is used.
+    mode: ConnectionMode,
+    /// Password hashing salt sent to the client.
+    password_salt: String,
+    /// Per-connection challenge prevents replaying a captured password hash.
+    password_challenge: String,
     /// HID controller for keyboard/mouse events
     hid: Option<Arc<HidController>>,
     /// Audio controller for audio streaming
@@ -197,7 +209,8 @@ impl Connection {
     pub fn new(
         id: u32,
         config: &RustDeskConfig,
-        signing_keypair: SigningKeyPair,
+        mode: ConnectionMode,
+        signing_keypair: Option<SigningKeyPair>,
         hid: Option<Arc<HidController>>,
         audio: Option<Arc<AudioController>>,
         video_manager: Option<Arc<VideoStreamManager>>,
@@ -223,6 +236,9 @@ impl Connection {
             signing_keypair,
             temp_keypair,
             password: config.device_password.clone(),
+            mode,
+            password_salt: config.device_id.clone(),
+            password_challenge: uuid::Uuid::new_v4().simple().to_string(),
             hid,
             audio,
             video_manager,
@@ -282,14 +298,27 @@ impl Connection {
         let writer = Arc::new(Mutex::new(writer));
         let mut shutdown_rx = self.shutdown_tx.subscribe();
 
-        // Send our SignedId first (this is what RustDesk protocol expects)
-        // The SignedId contains our device ID and temporary public key
+        match self.mode {
+            ConnectionMode::Secure => {
+                // ID-server and relay connections authenticate our ephemeral key through hbbs.
                 let signed_id_msg = self.create_signed_id_message(&self.device_id.clone());
                 let signed_id_bytes = signed_id_msg
                     .write_to_bytes()
                     .map_err(|e| anyhow::anyhow!("Failed to encode SignedId: {}", e))?;
                 debug!("Sending SignedId with device_id={}", self.device_id);
                 self.send_framed_arc(&writer, &signed_id_bytes).await?;
+            }
+            ConnectionMode::DirectIp => {
+                // Standard RustDesk direct-IP clients do not perform the signed-ID handshake.
+                // They expect password authentication to start immediately.
+                let hash_msg = self.create_hash_message();
+                let hash_bytes = hash_msg
+                    .write_to_bytes()
+                    .map_err(|e| anyhow::anyhow!("Failed to encode Hash: {}", e))?;
+                debug!("Sending password challenge for direct IP connection");
+                self.send_framed_arc(&writer, &hash_bytes).await?;
+            }
+        }
 
         // Channel for receiving video frames to send (bounded to provide backpressure)
         let (video_tx, mut video_rx) = mpsc::channel::<Bytes>(4);
@@ -842,7 +871,11 @@ impl Connection {
 
         // Sign the IdPk bytes with Ed25519
         // RustDesk's sign::sign() prepends the 64-byte signature to the message
-        let signed_id_pk = self.signing_keypair.sign(&id_pk_bytes);
+        let signed_id_pk = self
+            .signing_keypair
+            .as_ref()
+            .expect("secure RustDesk connections require a signing keypair")
+            .sign(&id_pk_bytes);
 
         let mut signed_id = SignedId::new();
         signed_id.id = signed_id_pk.into();
@@ -980,7 +1013,7 @@ impl Connection {
     /// Verify password
     fn verify_password(&self, provided: &[u8]) -> bool {
         // RustDesk password verification:
-        // We send Hash { salt: device_id, challenge: "" } to client
+        // We send a stable salt and a fresh per-connection challenge to the client.
         // The client calculates: SHA256(SHA256(password + salt) + challenge)
         // See create_hash_message() for the salt and challenge we use
         //
@@ -993,9 +1026,11 @@ impl Connection {
             return false;
         }
 
-        // The client calculates: SHA256(SHA256(password + salt) + challenge)
-        // where salt is our device_id and challenge is empty
-        let expected_hash = crypto::hash_password_double(&self.password, &self.device_id, "");
+        let expected_hash = crypto::hash_password_double(
+            &self.password,
+            &self.password_salt,
+            &self.password_challenge,
+        );
 
         // Try comparison with double hash
         if provided == expected_hash.as_slice() {
@@ -1003,9 +1038,10 @@ impl Connection {
             return true;
         }
 
-        // Also try single hash for compatibility
-        let expected_hash_single = crypto::hash_password(&self.password, &self.device_id);
-        if provided == expected_hash_single.as_slice() {
+        // Keep the legacy single-hash fallback only inside the encrypted ID-service path.
+        // It has no per-connection challenge and must not be accepted on direct IP access.
+        let expected_hash_single = crypto::hash_password(&self.password, &self.password_salt);
+        if self.mode == ConnectionMode::Secure && provided == expected_hash_single.as_slice() {
             debug!("Password verified with single hash");
             return true;
         }
@@ -1116,11 +1152,9 @@ impl Connection {
     /// Create Hash message for password authentication
     /// The client will hash the password with the salt and send it back in LoginRequest
     fn create_hash_message(&self) -> HbbMessage {
-        // Use device_id as salt for simplicity (RustDesk uses Config::get_salt())
-        // The challenge field is not used for our password verification
         let mut hash = Hash::new();
-        hash.salt = self.device_id.clone();
-        hash.challenge = String::new();
+        hash.salt = self.password_salt.clone();
+        hash.challenge = self.password_challenge.clone();
 
         let mut msg = HbbMessage::new();
         msg.union = Some(message::Union::Hash(hash));
@@ -1397,6 +1431,10 @@ impl ConnectionManager {
         *self.video_manager.write() = Some(video_manager);
     }
 
+    pub fn update_config(&self, config: RustDeskConfig) {
+        *self.config.write() = config;
+    }
+
     /// Set keypair
     pub fn set_keypair(&self, keypair: KeyPair) {
         *self.keypair.write() = Some(keypair);
@@ -1431,6 +1469,25 @@ impl ConnectionManager {
         &self,
         stream: TcpStream,
         peer_addr: SocketAddr,
+    ) -> anyhow::Result<u32> {
+        self.accept_connection_with_mode(stream, peer_addr, ConnectionMode::Secure)
+            .await
+    }
+
+    pub async fn accept_direct_connection(
+        &self,
+        stream: TcpStream,
+        peer_addr: SocketAddr,
+    ) -> anyhow::Result<u32> {
+        self.accept_connection_with_mode(stream, peer_addr, ConnectionMode::DirectIp)
+            .await
+    }
+
+    async fn accept_connection_with_mode(
+        &self,
+        stream: TcpStream,
+        peer_addr: SocketAddr,
+        mode: ConnectionMode,
     ) -> anyhow::Result<u32> {
         let id = {
             let mut next = self.next_id.write();
@@ -1440,12 +1497,22 @@ impl ConnectionManager {
         };
 
         let config = self.config.read().clone();
-        let signing_keypair = self.ensure_signing_keypair();
+        let signing_keypair = match mode {
+            ConnectionMode::Secure => Some(self.ensure_signing_keypair()),
+            ConnectionMode::DirectIp => None,
+        };
         let hid = self.hid.read().clone();
         let audio = self.audio.read().clone();
         let video_manager = self.video_manager.read().clone();
-        let (mut conn, _rx) =
-            Connection::new(id, &config, signing_keypair, hid, audio, video_manager);
+        let (mut conn, _rx) = Connection::new(
+            id,
+            &config,
+            mode,
+            signing_keypair,
+            hid,
+            audio,
+            video_manager,
+        );
 
         // Track connection state for external access
         let state = conn.state.clone();
@@ -1781,3 +1848,100 @@ async fn run_audio_streaming(
 
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn connection(mode: ConnectionMode) -> Connection {
+        crypto::init().expect("crypto should initialize");
+        let config = RustDeskConfig {
+            device_id: "123456789".to_string(),
+            device_password: "fixed-password".to_string(),
+            ..Default::default()
+        };
+        let (connection, _rx) = Connection::new(
+            1,
+            &config,
+            mode,
+            (mode == ConnectionMode::Secure).then(SigningKeyPair::generate),
+            None,
+            None,
+            None,
+        );
+        connection
+    }
+
+    async fn first_server_message(mode: ConnectionMode) -> HbbMessage {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test listener should bind");
+        let address = listener
+            .local_addr()
+            .expect("listener should have an address");
+        let client = tokio::spawn(async move {
+            TcpStream::connect(address)
+                .await
+                .expect("client should connect")
+        });
+        let (server_stream, peer_addr) = listener.accept().await.expect("server should accept");
+        let mut client_stream = client.await.expect("client task should finish");
+        let mut server_connection = connection(mode);
+        let server =
+            tokio::spawn(
+                async move { server_connection.handle_tcp(server_stream, peer_addr).await },
+            );
+
+        let bytes = read_frame(&mut client_stream)
+            .await
+            .expect("client should receive the first frame");
+        drop(client_stream);
+        let _ = tokio::time::timeout(Duration::from_secs(1), server).await;
+        decode_message(&bytes).expect("first frame should contain a RustDesk message")
+    }
+
+    #[test]
+    fn direct_ip_password_challenge_is_non_empty_and_verifiable() {
+        let connection = connection(ConnectionMode::DirectIp);
+        let message = connection.create_hash_message();
+        let hash = match message.union {
+            Some(message::Union::Hash(hash)) => hash,
+            _ => panic!("expected Hash message"),
+        };
+
+        assert_eq!(hash.salt, "123456789");
+        assert!(!hash.challenge.is_empty());
+
+        let response = crypto::hash_password_double("fixed-password", &hash.salt, &hash.challenge);
+        assert!(connection.verify_password(&response));
+    }
+
+    #[test]
+    fn direct_ip_rejects_legacy_replayable_single_hash() {
+        let direct = connection(ConnectionMode::DirectIp);
+        let single_hash = crypto::hash_password("fixed-password", "123456789");
+        assert!(!direct.verify_password(&single_hash));
+
+        let secure = connection(ConnectionMode::Secure);
+        assert!(secure.verify_password(&single_hash));
+    }
+
+    #[test]
+    fn password_challenge_changes_for_each_connection() {
+        let first = connection(ConnectionMode::DirectIp);
+        let second = connection(ConnectionMode::DirectIp);
+        assert_ne!(first.password_challenge, second.password_challenge);
+    }
+
+    #[tokio::test]
+    async fn direct_ip_connection_starts_with_password_hash() {
+        let message = first_server_message(ConnectionMode::DirectIp).await;
+        assert!(matches!(message.union, Some(message::Union::Hash(_))));
+    }
+
+    #[tokio::test]
+    async fn secure_connection_starts_with_signed_id() {
+        let message = first_server_message(ConnectionMode::Secure).await;
+        assert!(matches!(message.union, Some(message::Union::SignedId(_))));
+    }
+}

src/rustdesk/mod.rs

@@ -26,7 +26,7 @@ use crate::hid::HidController;
 use crate::utils::bind_tcp_listener;
 use crate::video::stream_manager::VideoStreamManager;
 
-use self::config::RustDeskConfig;
+use self::config::{RustDeskConfig, RustDeskMode};
 use self::connection::ConnectionManager;
 use self::protocol::{make_local_addr, make_relay_response, make_request_relay};
 use self::rendezvous::{AddrMangle, RendezvousMediator, RendezvousStatus};
@@ -53,8 +53,6 @@ impl std::fmt::Display for ServiceStatus {
     }
 }
 
-const DIRECT_LISTEN_PORT: u16 = 21118;
-
 pub struct RustDeskService {
     config: Arc<RwLock<RustDeskConfig>>,
     status: Arc<RwLock<ServiceStatus>>,
@@ -78,6 +76,7 @@ impl RustDeskService {
     ) -> Self {
         let (shutdown_tx, _) = broadcast::channel(1);
         let connection_manager = Arc::new(ConnectionManager::new(config.clone()));
+        let direct_access_port = config.direct_access_port;
 
         Self {
             config: Arc::new(RwLock::new(config)),
@@ -85,7 +84,7 @@ impl RustDeskService {
             rendezvous: Arc::new(RwLock::new(None)),
             rendezvous_handle: Arc::new(RwLock::new(None)),
             tcp_listener_handle: Arc::new(RwLock::new(None)),
-            listen_port: Arc::new(RwLock::new(DIRECT_LISTEN_PORT)),
+            listen_port: Arc::new(RwLock::new(direct_access_port)),
             connection_manager,
             video_manager,
             hid,
@@ -107,6 +106,7 @@ impl RustDeskService {
     }
 
     pub fn update_config(&self, config: RustDeskConfig) {
+        self.connection_manager.update_config(config.clone());
         *self.config.write() = config;
     }
 
@@ -126,6 +126,10 @@ impl RustDeskService {
         self.tcp_listener_handle.read().is_some()
     }
 
+    pub fn is_running(&self) -> bool {
+        self.status() == ServiceStatus::Running
+    }
+
     pub async fn start(&self) -> anyhow::Result<()> {
         let config = self.config.read().clone();
 
@@ -146,9 +150,8 @@ impl RustDeskService {
 
         *self.status.write() = ServiceStatus::Starting;
         info!(
-            "Starting RustDesk service with ID: {} -> {}",
-            config.device_id,
-            config.rendezvous_addr()
+            "Starting RustDesk service in {:?} mode with ID: {}",
+            config.mode, config.device_id,
         );
 
         if let Err(e) = crypto::init() {
@@ -157,6 +160,27 @@ impl RustDeskService {
             return Err(e.into());
         }
 
+        self.connection_manager.set_hid(self.hid.clone());
+
+        self.connection_manager.set_audio(self.audio.clone());
+
+        self.connection_manager
+            .set_video_manager(self.video_manager.clone());
+
+        if config.mode == RustDeskMode::DirectIp {
+            let (tcp_handles, listen_port) = match self.start_tcp_listener_with_port().await {
+                Ok(result) => result,
+                Err(err) => {
+                    *self.status.write() = ServiceStatus::Error(err.to_string());
+                    return Err(err);
+                }
+            };
+            *self.tcp_listener_handle.write() = Some(tcp_handles);
+            *self.listen_port.write() = listen_port;
+            *self.status.write() = ServiceStatus::Running;
+            return Ok(());
+        }
+
         let mediator = Arc::new(RendezvousMediator::new(config.clone()));
 
         let keypair = mediator.ensure_keypair();
@@ -165,26 +189,8 @@ impl RustDeskService {
         let signing_keypair = mediator.ensure_signing_keypair();
         self.connection_manager.set_signing_keypair(signing_keypair);
 
-        self.connection_manager.set_hid(self.hid.clone());
-
-        self.connection_manager.set_audio(self.audio.clone());
-
-        self.connection_manager
-            .set_video_manager(self.video_manager.clone());
-
         *self.rendezvous.write() = Some(mediator.clone());
 
-        let (tcp_handles, listen_port) = match self.start_tcp_listener_with_port().await {
-            Ok(result) => result,
-            Err(err) => {
-                *self.status.write() = ServiceStatus::Error(err.to_string());
-                return Err(err);
-            }
-        };
-        *self.tcp_listener_handle.write() = Some(tcp_handles);
-
-        mediator.set_listen_port(listen_port);
-
         let connection_manager = self.connection_manager.clone();
         let service_config = self.config.clone();
 
@@ -299,16 +305,8 @@ impl RustDeskService {
     }
 
     async fn start_tcp_listener_with_port(&self) -> anyhow::Result<(Vec<JoinHandle<()>>, u16)> {
-        let (listeners, listen_port) = match self.bind_direct_listeners(DIRECT_LISTEN_PORT) {
-            Ok(result) => result,
-            Err(err) => {
-                warn!(
-                    "Failed to bind RustDesk TCP on port {}: {}, falling back to random port",
-                    DIRECT_LISTEN_PORT, err
-                );
-                self.bind_direct_listeners(0)?
-            }
-        };
+        let direct_access_port = self.config.read().direct_access_port;
+        let (listeners, listen_port) = self.bind_direct_listeners(direct_access_port)?;
 
         *self.listen_port.write() = listen_port;
 
@@ -330,7 +328,7 @@ impl RustDeskService {
                                     info!("Accepted direct connection from {}", peer_addr);
                                     let conn_mgr = conn_mgr.clone();
                                     tokio::spawn(async move {
-                                        if let Err(e) = conn_mgr.accept_connection(stream, peer_addr).await {
+                                        if let Err(e) = conn_mgr.accept_direct_connection(stream, peer_addr).await {
                                             error!("Failed to handle direct connection from {}: {}", peer_addr, e);
                                         }
                                     });

src/web/handlers/config/rustdesk.rs

@@ -53,7 +53,9 @@ async fn current_status(
 #[derive(Debug, serde::Serialize)]
 pub struct RustDeskConfigResponse {
     pub enabled: bool,
+    pub mode: crate::rustdesk::config::RustDeskMode,
     pub codec: crate::rustdesk::config::RustDeskCodec,
+    pub direct_access_port: u16,
     pub rendezvous_server: String,
     pub relay_server: Option<String>,
     pub device_id: String,
@@ -66,7 +68,9 @@ impl From<&RustDeskConfig> for RustDeskConfigResponse {
     fn from(config: &RustDeskConfig) -> Self {
         Self {
             enabled: config.enabled,
+            mode: config.mode,
             codec: config.codec,
+            direct_access_port: config.direct_access_port,
             rendezvous_server: config.rendezvous_server.clone(),
             relay_server: config.relay_server.clone(),
             device_id: config.device_id.clone(),
@@ -117,28 +121,22 @@ pub async fn update_rustdesk_config(
 pub async fn regenerate_device_id(
     State(state): State<RemoteAccessApiState>,
 ) -> Result<Json<RustDeskConfigResponse>> {
-    state
-        .config
-        .update(|config| {
-            config.rustdesk.device_id = RustDeskConfig::generate_device_id();
-        })
-        .await?;
-
-    let new_config = state.config.get().rustdesk.clone();
+    let _apply_guard = try_apply_lock(&state.rustdesk_apply_lock, "rustdesk")?;
+    let old_config = state.config.get().rustdesk.clone();
+    let mut regenerated = old_config.clone();
+    regenerated.device_id = RustDeskConfig::generate_device_id();
+    let new_config = persist_and_apply(&state, old_config, regenerated).await?;
     Ok(Json(RustDeskConfigResponse::from(&new_config)))
 }
 
 pub async fn regenerate_device_password(
     State(state): State<RemoteAccessApiState>,
 ) -> Result<Json<RustDeskConfigResponse>> {
-    state
-        .config
-        .update(|config| {
-            config.rustdesk.device_password = RustDeskConfig::generate_password();
-        })
-        .await?;
-
-    let new_config = state.config.get().rustdesk.clone();
+    let _apply_guard = try_apply_lock(&state.rustdesk_apply_lock, "rustdesk")?;
+    let old_config = state.config.get().rustdesk.clone();
+    let mut regenerated = old_config.clone();
+    regenerated.device_password = RustDeskConfig::generate_password();
+    let new_config = persist_and_apply(&state, old_config, regenerated).await?;
     Ok(Json(RustDeskConfigResponse::from(&new_config)))
 }
 

src/web/handlers/config/types.rs

@@ -899,7 +899,9 @@ fn validate_rustdesk_relay_key(key: &str) -> Result<(), AppError> {
 #[derive(Debug, Deserialize)]
 pub struct RustDeskConfigUpdate {
     pub enabled: Option<bool>,
+    pub mode: Option<crate::rustdesk::config::RustDeskMode>,
     pub codec: Option<crate::rustdesk::config::RustDeskCodec>,
+    pub direct_access_port: Option<u16>,
     pub rendezvous_server: Option<String>,
     pub relay_server: Option<String>,
     pub relay_key: Option<String>,
@@ -908,6 +910,11 @@ pub struct RustDeskConfigUpdate {
 
 impl RustDeskConfigUpdate {
     pub fn validate(&self) -> crate::error::Result<()> {
+        if self.direct_access_port == Some(0) {
+            return Err(AppError::BadRequest(
+                "RustDesk direct access port must be greater than 0".into(),
+            ));
+        }
         // Validate rendezvous server format (should be host:port)
         if let Some(ref server) = self.rendezvous_server {
             if !server.is_empty() && !server.contains(':') {
@@ -944,11 +951,25 @@ impl RustDeskConfigUpdate {
     }
 
     pub fn validate_merged(&self, config: &RustDeskConfig) -> crate::error::Result<()> {
-        if config.enabled && config.rendezvous_server.trim().is_empty() {
+        if config.enabled {
+            match config.mode {
+                crate::rustdesk::config::RustDeskMode::Id
+                    if config.rendezvous_server.trim().is_empty() =>
+                {
                     return Err(AppError::BadRequest(
-                "RustDesk ID server is required".into(),
+                        "RustDesk ID server is required in ID service mode".into(),
                     ));
                 }
+                crate::rustdesk::config::RustDeskMode::DirectIp
+                    if config.direct_access_port == 0 =>
+                {
+                    return Err(AppError::BadRequest(
+                        "RustDesk direct access port must be greater than 0".into(),
+                    ));
+                }
+                _ => {}
+            }
+        }
         Ok(())
     }
 
@@ -956,9 +977,15 @@ impl RustDeskConfigUpdate {
         if let Some(enabled) = self.enabled {
             config.enabled = enabled;
         }
+        if let Some(mode) = self.mode {
+            config.mode = mode;
+        }
         if let Some(codec) = self.codec {
             config.codec = codec;
         }
+        if let Some(port) = self.direct_access_port {
+            config.direct_access_port = port;
+        }
         if let Some(ref server) = self.rendezvous_server {
             config.rendezvous_server = server.clone();
         }
@@ -1466,7 +1493,9 @@ mod tests {
     fn rustdesk_relay_key_accepts_hbbs_style_base64_32_bytes() {
         let update = RustDeskConfigUpdate {
             enabled: None,
+            mode: None,
             codec: None,
+            direct_access_port: None,
             rendezvous_server: None,
             relay_server: None,
             relay_key: Some("pLU0pEj2IZnNVKzrIO1pIdwGA3dOVJJLkFIYGOCGH1E=".to_string()),
@@ -1481,7 +1510,9 @@ mod tests {
         let not_32 = "AAAAAAAAAAAAAAAAAAAAAA==".to_string();
         let update = RustDeskConfigUpdate {
             enabled: None,
+            mode: None,
             codec: None,
+            direct_access_port: None,
             rendezvous_server: None,
             relay_server: None,
             relay_key: Some(not_32),
@@ -1490,6 +1521,49 @@ mod tests {
         assert!(update.validate().is_err());
     }
 
+    #[test]
+    fn rustdesk_direct_ip_mode_does_not_require_id_server() {
+        let mut config = RustDeskConfig::default();
+        config.enabled = true;
+        config.mode = crate::rustdesk::config::RustDeskMode::DirectIp;
+        config.rendezvous_server.clear();
+
+        let update = RustDeskConfigUpdate {
+            enabled: Some(true),
+            mode: Some(crate::rustdesk::config::RustDeskMode::DirectIp),
+            codec: None,
+            direct_access_port: Some(21118),
+            rendezvous_server: Some(String::new()),
+            relay_server: None,
+            relay_key: None,
+            device_password: None,
+        };
+
+        assert!(update.validate().is_ok());
+        assert!(update.validate_merged(&config).is_ok());
+    }
+
+    #[test]
+    fn rustdesk_id_mode_requires_id_server_when_enabled() {
+        let mut config = RustDeskConfig::default();
+        config.enabled = true;
+        config.mode = crate::rustdesk::config::RustDeskMode::Id;
+        config.rendezvous_server.clear();
+
+        let update = RustDeskConfigUpdate {
+            enabled: Some(true),
+            mode: Some(crate::rustdesk::config::RustDeskMode::Id),
+            codec: None,
+            direct_access_port: None,
+            rendezvous_server: Some(String::new()),
+            relay_server: None,
+            relay_key: None,
+            device_password: None,
+        };
+
+        assert!(update.validate_merged(&config).is_err());
+    }
+
     #[test]
     fn ipv6_bind_vnc_config_accepts_ipv6_literals() {
         for bind in ["::", "::1", "2001:db8::1"] {

web/src/api/config.ts

@@ -221,7 +221,9 @@ export const extensionsApi = {
 
 export interface RustDeskConfigResponse {
   enabled: boolean
+  mode: 'id' | 'direct_ip'
   codec: 'h264' | 'h265'
+  direct_access_port: number
   rendezvous_server: string
   relay_server: string | null
   device_id: string
@@ -238,7 +240,9 @@ export interface RustDeskStatusResponse {
 
 export interface RustDeskConfigUpdate {
   enabled?: boolean
+  mode?: 'id' | 'direct_ip'
   codec?: 'h264' | 'h265'
+  direct_access_port?: number
   rendezvous_server?: string
   relay_server?: string
   relay_key?: string

web/src/i18n/en-US.ts

@@ -1072,6 +1072,15 @@ export default {
     rustdesk: {
       title: 'RustDesk Remote',
       desc: 'Configure the RustDesk service; the selected codec will be locked',
+      mode: 'Access Mode',
+      modeId: 'ID Service',
+      modeIdDesc: 'Register with an ID server and use the configured relay when direct connections fail',
+      modeDirectIp: 'Direct IP',
+      modeDirectIpDesc: 'Listen on the device only, without connecting to an ID or relay server',
+      directAccessPort: 'Direct Access Port',
+      directAccessPortInvalid: 'The direct access port must be between 1 and 65535',
+      directAccessWarningTitle: 'Direct IP access is not end-to-end encrypted',
+      directAccessWarningDesc: 'Use it only on a trusted LAN or encrypted VPN. Do not expose this port directly to the internet.',
       rendezvousServer: 'ID Server',
       rendezvousServerPlaceholder: 'hbbs.example.com:21116',
       rendezvousServerRequired: 'Enter the RustDesk ID server',

web/src/i18n/zh-CN.ts

@@ -1071,6 +1071,15 @@ export default {
     rustdesk: {
       title: 'RustDesk 远程',
       desc: '配置 RustDesk 服务，将会锁定所选编码',
+      mode: '接入模式',
+      modeId: 'ID 服务',
+      modeIdDesc: '通过 ID 服务器注册，并在直连失败时按配置使用中继服务器',
+      modeDirectIp: 'IP 直连',
+      modeDirectIpDesc: '仅监听设备端口，不连接 ID 或中继服务器',
+      directAccessPort: '直连端口',
+      directAccessPortInvalid: '直连端口必须在 1 到 65535 之间',
+      directAccessWarningTitle: 'IP 直连不提供端到端加密',
+      directAccessWarningDesc: '仅建议在可信局域网或加密 VPN 中使用，请勿将此端口直接暴露到公网。',
       rendezvousServer: 'ID 服务器',
       rendezvousServerPlaceholder: 'hbbs.example.com:21116',
       rendezvousServerRequired: '请填写 RustDesk ID 服务器',

web/src/types/generated.ts

@@ -248,6 +248,11 @@ export interface ExtensionsConfig {
 	frpc: FrpcConfig;
 }
 
+export enum RustDeskMode {
+	Id = "id",
+	DirectIp = "direct_ip",
+}
+
 export enum RustDeskCodec {
 	H264 = "h264",
 	H265 = "h265",
@@ -255,7 +260,9 @@ export enum RustDeskCodec {
 
 export interface RustDeskConfig {
 	enabled: boolean;
+	mode: RustDeskMode;
 	codec: RustDeskCodec;
+	direct_access_port: number;
 	rendezvous_server: string;
 	relay_server?: string;
 	device_id: string;
@@ -633,7 +640,9 @@ export interface RtspStatusResponse {
 
 export interface RustDeskConfigUpdate {
 	enabled?: boolean;
+	mode?: RustDeskMode;
 	codec?: RustDeskCodec;
+	direct_access_port?: number;
 	rendezvous_server?: string;
 	relay_server?: string;
 	relay_key?: string;

web/src/views/SettingsView.vue

@@ -496,16 +496,24 @@ const rustdeskCopied = ref<'id' | 'password' | null>(null)
 const { copy: clipboardCopy } = useClipboard()
 const rustdeskLocalConfig = ref({
   enabled: false,
+  mode: 'id' as 'id' | 'direct_ip',
   codec: 'h264' as 'h264' | 'h265',
+  direct_access_port: 21118,
   rendezvous_server: '',
   relay_server: '',
   relay_key: '',
 })
 
 const rustdeskValidationMessage = computed(() => {
-  if (!rustdeskLocalConfig.value.rendezvous_server?.trim()) {
+  if (rustdeskLocalConfig.value.mode === 'id' && !rustdeskLocalConfig.value.rendezvous_server?.trim()) {
     return t('extensions.rustdesk.rendezvousServerRequired')
   }
+  if (
+    rustdeskLocalConfig.value.mode === 'direct_ip'
+    && (rustdeskLocalConfig.value.direct_access_port < 1 || rustdeskLocalConfig.value.direct_access_port > 65535)
+  ) {
+    return t('extensions.rustdesk.directAccessPortInvalid')
+  }
   return ''
 })
 
@@ -1941,7 +1949,9 @@ function applyRustdeskStatus(status: RustDeskStatusResponse) {
   rustdeskStatus.value = status
   rustdeskLocalConfig.value = {
     enabled: config.enabled,
+    mode: config.mode || 'id',
     codec: config.codec || 'h264',
+    direct_access_port: config.direct_access_port || 21118,
     rendezvous_server: config.rendezvous_server,
     relay_server: config.relay_server || '',
     relay_key: config.relay_key || '',
@@ -2335,7 +2345,9 @@ function updateStatusBadgeText(): string {
 function rustdeskUpdatePayload(enabled = rustdeskLocalConfig.value.enabled) {
   return {
     enabled,
+    mode: rustdeskLocalConfig.value.mode,
     codec: rustdeskLocalConfig.value.codec,
+    direct_access_port: rustdeskLocalConfig.value.direct_access_port,
     rendezvous_server: normalizeRustdeskServer(
       rustdeskLocalConfig.value.rendezvous_server,
       21116,
@@ -2346,7 +2358,10 @@ function rustdeskUpdatePayload(enabled = rustdeskLocalConfig.value.enabled) {
 }
 
 async function saveRustdeskConfig() {
-  if (rustdeskLocalConfig.value.enabled && !validateRustdeskConfig()) return
+  if (
+    (rustdeskLocalConfig.value.enabled || rustdeskLocalConfig.value.mode === 'direct_ip')
+    && !validateRustdeskConfig()
+  ) return
 
   loading.value = true
   saved.value = false
@@ -5066,6 +5081,21 @@ watch(isWindows, () => {
                     <Label>{{ t('extensions.autoStart') }}</Label>
                     <Switch v-model="rustdeskLocalConfig.enabled" />
                   </div>
+                  <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                    <Label class="sm:text-right">{{ t('extensions.rustdesk.mode') }}</Label>
+                    <div class="sm:col-span-3 space-y-1">
+                      <Select v-model="rustdeskLocalConfig.mode" :disabled="rustdeskStatus?.service_status === 'running'">
+                        <SelectTrigger class="w-full"><SelectValue /></SelectTrigger>
+                        <SelectContent>
+                          <SelectItem value="id">{{ t('extensions.rustdesk.modeId') }}</SelectItem>
+                          <SelectItem value="direct_ip">{{ t('extensions.rustdesk.modeDirectIp') }}</SelectItem>
+                        </SelectContent>
+                      </Select>
+                      <p class="text-xs text-muted-foreground">
+                        {{ rustdeskLocalConfig.mode === 'id' ? t('extensions.rustdesk.modeIdDesc') : t('extensions.rustdesk.modeDirectIpDesc') }}
+                      </p>
+                    </div>
+                  </div>
                   <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
                     <Label class="sm:text-right">{{ t('extensions.rustdesk.codec') }}</Label>
                     <div class="sm:col-span-3 space-y-1">
@@ -5075,7 +5105,7 @@ watch(isWindows, () => {
                       </Select>
                     </div>
                   </div>
-                  <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                  <div v-if="rustdeskLocalConfig.mode === 'id'" class="grid gap-2 sm:grid-cols-4 sm:items-center">
                     <Label class="sm:text-right">{{ t('extensions.rustdesk.rendezvousServer') }}</Label>
                     <div class="sm:col-span-3 space-y-1">
                       <Input
@@ -5086,7 +5116,7 @@ watch(isWindows, () => {
                       <p v-if="rustdeskLocalConfig.enabled && rustdeskValidationMessage" class="text-xs text-destructive">{{ rustdeskValidationMessage }}</p>
                     </div>
                   </div>
-                  <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                  <div v-if="rustdeskLocalConfig.mode === 'id'" class="grid gap-2 sm:grid-cols-4 sm:items-center">
                     <Label class="sm:text-right">{{ t('extensions.rustdesk.relayServer') }}</Label>
                     <div class="sm:col-span-3 space-y-1">
                       <Input
@@ -5096,7 +5126,7 @@ watch(isWindows, () => {
                       />
                     </div>
                   </div>
-                  <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                  <div v-if="rustdeskLocalConfig.mode === 'id'" class="grid gap-2 sm:grid-cols-4 sm:items-center">
                     <Label class="sm:text-right">{{ t('extensions.rustdesk.relayKey') }}</Label>
                     <div class="sm:col-span-3 space-y-1">
                       <div class="relative">
@@ -5123,6 +5153,24 @@ watch(isWindows, () => {
                       </div>
                     </div>
                   </div>
+                  <div v-if="rustdeskLocalConfig.mode === 'direct_ip'" class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                    <Label class="sm:text-right">{{ t('extensions.rustdesk.directAccessPort') }}</Label>
+                    <div class="sm:col-span-3 space-y-1">
+                      <Input
+                        v-model.number="rustdeskLocalConfig.direct_access_port"
+                        type="number"
+                        min="1"
+                        max="65535"
+                        :disabled="rustdeskStatus?.service_status === 'running'"
+                      />
+                      <p v-if="rustdeskValidationMessage" class="text-xs text-destructive">{{ rustdeskValidationMessage }}</p>
+                    </div>
+                  </div>
+                  <Alert v-if="rustdeskLocalConfig.mode === 'direct_ip'" variant="warning">
+                    <AlertTriangle />
+                    <AlertTitle>{{ t('extensions.rustdesk.directAccessWarningTitle') }}</AlertTitle>
+                    <AlertDescription>{{ t('extensions.rustdesk.directAccessWarningDesc') }}</AlertDescription>
+                  </Alert>
                 </div>
                 <Separator />
 
@@ -5131,7 +5179,7 @@ watch(isWindows, () => {
                   <h4 class="text-sm font-medium">{{ t('extensions.rustdesk.deviceInfo') }}</h4>
 
                   <!-- Device ID -->
-                  <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                  <div v-if="rustdeskLocalConfig.mode === 'id'" class="grid gap-2 sm:grid-cols-4 sm:items-center">
                     <Label class="sm:text-right">{{ t('extensions.rustdesk.deviceId') }}</Label>
                     <div class="sm:col-span-3 flex items-center gap-2">
                       <code class="font-mono text-lg bg-muted px-3 py-1 rounded">{{ rustdeskConfig?.device_id || '-' }}</code>
@@ -5177,7 +5225,7 @@ watch(isWindows, () => {
                   </div>
 
                   <!-- Keypair Status -->
-                  <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                  <div v-if="rustdeskLocalConfig.mode === 'id'" class="grid gap-2 sm:grid-cols-4 sm:items-center">
                     <Label class="sm:text-right">{{ t('extensions.rustdesk.keypairGenerated') }}</Label>
                     <div class="sm:col-span-3">
                       <Badge :variant="rustdeskConfig?.has_keypair ? 'default' : 'secondary'">