Install FsRdpServer on Windows

FsRdpServer is a relay server. It does not capture screens or store session content; it connects the participants in a room. All clients connect to the server, never directly to one another. Only the server needs to be reachable, rather than any client.

After installation, the service listens on these TCP ports:

The server binds its ports in dual-stack mode, accepting IPv4 and IPv6 connections on the same port. No configuration is required for this.

Windows Server 2019, 2022 and 2025, and Windows 10/11 x64 are suitable. A separate .NET installation is not required; the program includes everything it needs.

Get-Date
w32tm /resync

Get-NetIPAddress -AddressFamily IPv4,IPv6 |
  Where-Object { $_.PrefixOrigin -ne 'WellKnown' } |
  Format-Table IPAddress, InterfaceAlias, PrefixOrigin, SuffixOrigin

Get-NetTCPConnection -State Listen -LocalPort 80 -ErrorAction SilentlyContinue

3.1 Why a Name Rather than an IP Address?

Clients connect using a DNS name, for example server.ihrefirma.de, never an IP address. There are two essential reasons:

• The TLS certificate is issued for a name . If a client connects using an IP address, the name does not match the certificate and the connection is rejected.
• Your license is also tied to this exact name (LicensedServerHost).

3.2 What Are A and AAAA Records?

A DNS record translates a name into an address. There are two types because the internet uses two address types:

Pronounce AAAA as “quad A”. Both records can exist for the same name, which is the usual case. The client uses whichever its connection supports and generally prefers IPv6.

Important: An AAAA record points to the IPv6 address of the server itself, rather than the router. With IPv6, every device on a home or company network has its own globally valid address; there is no address translation as with IPv4.

3.3 Find Your Public Addresses

Run this on the server itself :

# Öffentliche IPv4-Adresse Ihres Anschlusses (die des Routers)
(Invoke-WebRequest -Uri "https://api.ipify.org" -UseBasicParsing).Content

# Öffentliche IPv6-Adresse dieses Servers
(Invoke-WebRequest -Uri "https://api6.ipify.org" -UseBasicParsing).Content

If the first command returns an address, you have public IPv4. If the second does, you have IPv6. If either fails, your connection does not support that protocol or it is not enabled.

3.4 DS-Lite: No Public IPv4 Address

Many cable and fiber connections in Germany, commonly Vodafone cable and some other providers, use DS-Lite. Your connection shares a public IPv4 address with many other customers rather than having its own. The consequence is clear:

• IPv4 port forwarding in the router has no effect. You can configure it, but it will never be reached; there is no external route to your connection.
• Only IPv6 works. The name therefore receives only an AAAA record, without an A record.
• Clients on IPv4-only networks cannot connect. In practice this affects some company networks and mobile connections. Viewers connecting from the internet need IPv6, or you need a different connection.

How to Recognize DS-Lite:

• Under “Internet → Online-Monitor”, the router shows no public IPv4 address, only IPv6, or an IPv4 address in the range 100.64.x.x to 100.127.x.x.
• Running https://api.ipify.org (see 3.3) fails, while api6.ipify.org succeeds.
• FRITZ!Box often explicitly shows “DS-Lite” under “Internet → Zugangsdaten → IPv6” (Internet → Account Information → IPv6).

Many providers will switch you to a real IPv4 address on request at no charge; ask for “dual stack instead of DS-Lite”. If clients need to connect from any network, a call to the provider is the simplest solution.

3.5 Changing Addresses: Dynamic DNS

Residential and small business connections usually have no fixed address. The public IPv4 address or IPv6 prefix, the first half of the address, changes. Eventually your DNS record is outdated and no one can reach the server.

There Are Three Options:

• Order a fixed address from your provider. The simplest arrangement, usually for a small monthly surcharge. Set the A and AAAA records once and you are done.
• Use a dynamic DNS service (DynDNS, No-IP, deSEC, dynv6 and others). The router reports every address change to the service, where you receive a name such as ihrname.dynv6.net . Point your own name to it using CNAME . Caution: Not every service updates AAAA records, which is essential with DS-Lite.
• Run only on your local network – no dynamic DNS or port access required (see 3.8).

3.6 Create Records with Your DNS Provider

Sign in to your domain provider (registrar or hosting provider) and create a record for the desired name:

Changes can take up to one TTL period to reach all systems. Increase the TTL (e.g. to 3600) only once everything works.

3.7 Check Name Resolution

Run this from another computer rather than the server:

Resolve-DnsName server.ihrefirma.de -Type A
Resolve-DnsName server.ihrefirma.de -Type AAAA

Expect the exact address you entered. “DNS name does not exist” means the record has not propagated yet or is misspelled. A different address probably comes from an outdated cached entry; clear it using Clear-DnsClientCache.

3.8 Run Only on Your Local Network

If all participants are on the same company network, no public DNS or port access is needed. The name must still exist because the certificate and license rely on it. Two options:

• Internal DNS (e.g. your Active Directory DNS service): create server.ihrefirma.de with the local IP address. This is the preferred approach.
• A hosts file on every client – suitable only for small tests. Add an entry in C:\Windows\System32\drivers\etc\hosts :

  192.168.1.50    server.ihrefirma.de

A hosts entry only changes name resolution. It does not replace certificate name verification or license binding; the certificate must still be issued for server.ihrefirma.de .

There are two barriers between an internet client and your server: the router and Windows Firewall. Setup handles Windows Firewall automatically; you configure the router yourself.

4.1 IPv4: Port Forwarding

With IPv4, your network has one public address shared by all devices. The router must know which device should receive incoming connections. Create a rule for each port:

On a FRITZ!Box: Internet → Freigaben → Portfreigaben → Gerät für Freigaben hinzufügen (Internet → Permit Access → Port Sharing → Add Device for Sharing), then select the server and create each rule.

4.2 IPv6: Allow Access Rather than Forwarding

IPv6 has no address translation; every device is already addressable from outside. The router does not redirect anything, but opens its firewall for that device and port. The interface usually still calls this “port sharing”, with a choice such as “internet access via IPv6”.

4.3 Port 80: Only for Let's Encrypt

Let's Encrypt must verify that you control the name. The simplest verification uses port 80. Allow port 80 to your server permanently, since automatic renewal runs every 60 days.

Routers often display a security warning here, referring to a continuously running web server. If a program listens on port 80 only for the few seconds needed to issue a certificate, the risk is low.

4.4 Windows Firewall

Setup creates the incoming rules FSRdpServer Main, FSRdpServer Audio and, if you enable the browser viewer, FSRdpServer WebGateway . Rules apply only to the server program, rather than the port generally. Additional security software may need manual port rules.

5.1 What Is a PFX File?

cert.pfx is a password-protected PKCS#12 container holding three things:

• the server certificate – the public identity for your server name;
• the private key – the secret proving that identity belongs to you;
• usually also the intermediate certificates from the issuing authority.

FsRdpServer uses it to encrypt all connections, just as a web server uses its HTTPS certificate. The service does not start without a valid certificate.

5.2 Which Name Must the Certificate Include?

The certificate must include the licensed server name as a Subject Alternative Name (SAN). Two variants are allowed:

• A wildcard certificate for *.ihrefirma.de – also covers server.ihrefirma.de and can be reused for additional servers later.
• A certificate for this one name only, namely server.ihrefirma.de. Less expensive, but not reusable for other names.

The PFX file may contain exactly one certificate with a private key. If it contains several, the server refuses to start with a clear message.

5.3 Option A: Purchase a Certificate and Export It as PFX

The usual approach if you already have a domain with a hosting provider. Order a certificate, have it issued and export it as PFX on Windows.

5.4 Option B: Free with Let's Encrypt

Works only if your server name is in public DNS and the certificate authority can reach your server. On Windows, win-acme is the commonly used tool (free, from win-acme.com).

If you obtained the certificate another way as fullchain.pem and privkey.pem , bundle it with OpenSSL:

openssl pkcs12 -export -out cert.pfx ^
  -inkey privkey.pem -in fullchain.pem

OpenSSL then asks for the password interactively so it is not stored in command prompt history.

5.5 Option C: Your Company's Own CA

Suitable only for internal installations. You issue the certificate yourself, but every client must explicitly trust your company CA or all connections fail. This option is unsuitable for the browser viewer because every browser would show a warning page.

5.6 Check the PFX File before Installation

Always do this first; otherwise an incorrect certificate only becomes apparent when setup aborts:

$pfx = Get-PfxCertificate -FilePath C:\FsRdp-Setup\cert.pfx
$pfx | Format-List Subject, NotBefore, NotAfter, HasPrivateKey, Thumbprint
$pfx.Extensions |
  Where-Object { $_.Oid.FriendlyName -eq 'Subject Alternative Name' } |
  ForEach-Object { $_.Format($true) }

Check Three Points:

• HasPrivateKey must report True .
• NotAfter must be in the future.
• The SAN list must include your licensed name; for a wildcard certificate, the corresponding entry is *.ihrefirma.de.

5.7 Add the Expiry Date to Your Calendar

Certificates expire: purchased ones usually after a year, Let's Encrypt after 90 days. When the certificate expires, every client suddenly stops connecting. Set a reminder two weeks before NotAfter or configure automatic renewal. win-acme handles renewal itself; the service must be restarted afterwards (see section 11).

No License Needed for the First 30 Days

If no license file exists beside the configuration, the server still starts and runs as a trial installation for 30 days. Nothing needs to be enabled: install, configure the certificate and start the service. The trial limits duration and capacity, not features:

“All features” means screen sharing, remote control, camera, voice, chat, file transfer, session recording, live captions and the browser viewer. Their technical requirements still apply: captions need your own API key, and the browser viewer needs its port and certificate (section 9).

During the trial, all participants see a Watermark over the shared screen. This is intentional: an unlicensed server should be recognizable as such.

What the trial does not include is supporter key and the features tied to those keys: reserved room names and the room password with which a customer opens their permanent room in a browser. This is not a feature block; an unlicensed server simply does not issue keys.

After 30 days, the service keeps running and listening but responds to every connection with a request for a license; it does not refuse not to start. You can install a license file later without reinstalling (section 11).

Request a License

For continued operation, the license file license.fsrdp is required. It is tied to two things: your server name and a permanent installation ID, generated on the server.

Send Me These Details for Issuing the License:

• the exact DNS name clients will use;
• the desired number of concurrent rooms;
• the number of participants per room;
• the desired term;
• whether you want browser viewing, session recording or live captions; these features must be enabled in the license.

An installed server displays its ID as follows:

& "$env:ProgramFiles\FsRdpServer\FsRdpServer.exe" --installation-id

You Now Need: Setup_FSRdpServer.exe and cert.pfx with its password. The license file license.fsrdp is needed only if you already have one; otherwise install the 30-day trial.

What Setup Configures:

Open PowerShell as administrator and work through these checks in order.

Is the Service Running?

Get-Service -Name FsRdpServer

The status must be Running .

Are Both Ports Listening?

Get-NetTCPConnection -State Listen -LocalPort 8888,8889

Are the Firewall Rules Present?

Get-NetFirewallRule -DisplayName "FSRdpServer Main","FSRdpServer Audio"

What Does the License Report?

& "$env:ProgramFiles\FsRdpServer\FsRdpServer.exe" --license-status

During the trial, you see this instead of customer details:

License state:         trial
Trial state file:      C:\ProgramData\FsRdpServer\trial-state.json
Trial period:          2026-09-11 through 2026-10-11 (30 day(s) left)
Trial room:            123456789

The 30-day period is tied to the first start of this installation, recorded in trial-state.json. It is measured against the latest time ever observed; turning the system clock back does not extend it.

Complete Self-Check:

& "$env:ProgramFiles\FsRdpServer\FsRdpServer.exe" `
  --validate-installation `
  --validation-data-dir "$env:ProgramData\FsRdpServer"

Return code 0 means everything is in order. Return code 3 means warnings, for example unresolved DNS or a certificate chain that cannot be fully verified locally. Read the warning in full and continue only if you understand the cause. Fix every genuine error before putting the server into operation.

View the Latest Log Files:

Get-ChildItem "$env:ProgramData\FsRdpServer\Logs" |
  Sort-Object LastWriteTime -Descending |
  Select-Object -First 10

The browser viewer lets viewers participate without an installed client; they simply open https://server.ihrefirma.de:8890/. It is disabled by default and requires two settings: permission in the license and activation in the configuration.

9.1 Why a Second Certificate Makes Sense

Any certificate trusted by native clients is sufficient for them, including one from your own company CA. A Browser is stricter and shows visitors a warning if the certificate is not issued by a publicly recognized authority. Give the browser viewer its own publicly trusted certificate without changing the native channels' certificate.

9.2 Setup

"WebGatewayEnabled": true,
"WebGatewayPort": 8890,
"WebGatewayCertificatePath": "C:\\FsRdp-Setup\\certs\\webgateway.pfx",
"WebGatewayCertificatePassword": "IhrPasswort",

Restart-Service -Name FsRdpServer
Get-NetTCPConnection -State Listen -LocalPort 8890

Remember to allow port 8890 in the router (section 4). If the browser viewer is disabled, setup does not create a firewall rule for this port. Enable it later by running setup again.

9.3 Remember Renewal

Backups

Back up C:\ProgramData\FsRdpServer to a location with equally restrictive access permissions, since they contain the PFX file and password.

Update the Server

Run a newer Setup_FSRdpServer.exe as administrator. Configuration, certificate, license, installation ID, room reservations and logs are retained, including browser viewer certificate settings.

Install or Replace the License

The same procedure applies to the first license after a trial and a renewed license: add the file, validate and restart the service. The license itself reloads automatically without restarting, but browser viewer, captions and demo mode settings are read at startup and require a restart.

Stop-Service -Name FsRdpServer
Copy-Item ".\license.fsrdp" "$env:ProgramData\FsRdpServer\license.fsrdp" -Force
& "$env:ProgramFiles\FsRdpServer\FsRdpServer.exe" `
  --validate-installation `
  --validation-data-dir "$env:ProgramData\FsRdpServer"
Start-Service -Name FsRdpServer

Do not start the service if validation fails. If a license is regenerated with a different supporter count, all supporter keys may change; distribute new keys promptly.

Replace the Certificate

Stop-Service -Name FsRdpServer
Copy-Item ".\cert.pfx" "$env:ProgramData\FsRdpServer\cert.pfx" -Force
# Falls sich das Passwort geändert hat: appsettings.json anpassen
Start-Service -Name FsRdpServer

Then repeat the self-check from section 8.

The Certificate Name Does Not Match

The client name, certificate name and licensed host name differ. Check all three and always connect using the licensed name.

RevocationStatusUnknown

The issuing authority publishes no reachable revocation list, common with a company CA. For public installations, use a certificate with normal revocation checking. Disabling certificate verification globally is not a solution.

Incorrect PFX Password or Missing Key

Use Get-PfxCertificate (section 5.6) to check that HasPrivateKey to True is shown and the password is correct. The file must contain exactly one certificate with a private key.

The License Belongs to Another Installation

Select server-instance-id.txt was replaced or deleted. Restore the original file from backup or request a new license for the current ID. Never edit the signed license file manually.

Every Client Reports “Trial Period Expired”

The 30 days have ended. The service keeps running but accepts no connections until a license is installed (section 11). --license-status shows trial-expired and the end date in this case.

The Server Remains in Trial Mode Despite an Installed License

The license file was not found or accepted. The startup banner shows both the expected path and the reason. Typical causes are an incorrect LicensePath in appsettings.json, a license for another installation ID or a manually edited and therefore invalid file.

The Service Runs, but No Clients Connect

Work Through the Connection Path from Outside In:

1. Does the client's name resolution return the correct address? (Resolve-DnsName)
2. Is router port access enabled, including IPv6 with DS-Lite?
3. Is the server listening on both ports? (Get-NetTCPConnection)
4. Do the firewall rules exist?
5. What do the logs in C:\ProgramData\FsRdpServer\Logs?

It Worked before, but Not Today

Two common causes: the certificate expired or your connection's public address changed and the DNS record is outdated. First check the certificate's NotAfter , then whether the DNS record still matches the current address.