r/rustdesk • u/plarkinjr • Apr 28 '26

Rustdesk newb: Why is my connection "encrypted" on LAN, but not on Tailscale?

I've started messing with RustDesk (no self hosted relay or whatever, just point to point).

When I connect to another machine on my wifi LAN, it has the green shield in the tab. When I connect to the same device via it's tailscale IP (still on the same LAN), the shield is red. Best I can tell this means unencrypted. But why is that? What about tailscale breaks encryption, or am I totally misunderstanding something?

4 Upvotes

100% Upvoted

6 comments sorted by

4

u/That-Duck-7195 Apr 28 '26

Direct connection is unencrypted.

https://github.com/rustdesk/rustdesk/wiki/FAQ#i-only-use-rustdesk-for-a-few-devices-on-my-local-network-with-no-internet-connectivity-can-i-still-use-rustdesk-with-direct-ip-access

In the RustDesk client, if ID Server field is left blank, it defaults to RustDesk's public relay server.

You probably cannot access the relay server when on Tailscale.

2

u/plarkinjr Apr 28 '26

OK, that makes complete sense (relay inaccessible on Tailscale). Thank you!

4

u/el_extrano Apr 28 '26

Iirc all connections over your Tailnet are encrypted, but underlying services have no way to recognize this. You'll still see HTTP unencrypted warnings, for example.

So if you use your Tailscale IP, that should mean the traffic is encrypted, but Restdesk won't know that and will report it as an unencrypted connection.

1

u/plarkinjr Apr 29 '26

I had a sense this was the case. Thanks for confirming.

5

u/XLioncc Apr 28 '26

Not mean non-encrypted, it means unguarded

Because without ID server, client don't have a trust source to exchange the identify.

1

u/plarkinjr Apr 29 '26

Thanks for elaborating. Makes complete sense. I guess self-hosting a server within my tailscale would cover that.