MeshCentral: free TeamViewer alternative, self-hosted, no device limits

TeamViewer costs around €500/year for professional use. DameWare requires per-seat licenses. MeshCentral is open source, originally developed by Microsoft Research, runs on your own Docker server, and has no device limits. The result is identical: browser-based remote desktop, file transfer, terminal — no commercial agent in the middle.

Installation with Docker

Three commands to get the server running on Ubuntu:

mkdir meshcentral && cd meshcentral
curl -O https://raw.githubusercontent.com/Ylianst/MeshCentral/master/docker/docker-compose.yml
docker compose up -d

Alternatively, a manual docker-compose.yml with explicit configuration:

services:
  meshcentral:
    image: ghcr.io/ylianst/meshcentral:latest
    ports:
      - "4430:4430"
      - "4443:4443"
    volumes:
      - meshcentral_data:/opt/meshcentral/meshcentral-data
      - meshcentral_files:/opt/meshcentral/meshcentral-files
    environment:
      - HOSTNAME=meshcentral.example.com
      - REVERSE_PROXY=meshcentral.example.com
      - REVERSE_PROXY_TLS_PORT=443
      - IFRAME=false
      - NODE_ENV=production
    restart: unless-stopped

volumes:
  meshcentral_data:
  meshcentral_files:

MeshCentral has its own built-in ACME client: if you point the domain at your server and set HOSTNAME correctly, it fetches the Let’s Encrypt certificate on its own without Caddy. If you prefer Caddy in front (to manage multiple services), set REVERSE_PROXY to your domain and let Caddy handle TLS termination.

Installing the agent on Windows

From the MeshCentral web console, create a Device Group and download the Windows installer. For silent deployment on multiple machines via script or GPO:

MeshAgent.exe -fullinstall -meshid="XXXXXXXX" -server="meshcentral.example.com"

The agent is about 2 MB, installs as a Windows service, connects to the server, and appears online in the console within 30 seconds. Mac and Linux have equivalent installers with the same process.

For automated deployment across 50 machines, distribute the script via GPO with the meshid parameter from your Device Group. Each PC shows up in the console with hostname, IP, operating system, and online/offline status.

Key features

Remote desktop from the browser, no plugin required: quality comparable to TeamViewer, multi-monitor support. Bidirectional file transfer via drag-and-drop. Remote terminal (PowerShell on Windows, bash on Linux) without opening RDP. Wake-on-LAN to power on offline PCs from the network. Multi-user: create separate accounts for different technicians with granular permissions per Device Group.

It works even with PCs behind NAT without opening ports on the client firewall: the agent makes an outbound WebSocket connection to the server, and remote desktop traffic goes through that channel.

HTTPS and secure access

MeshCentral runs HTTPS by default — it doesn’t operate over plain HTTP. If you use the built-in ACME client, the port is 4443. If you put Caddy in front, the Caddyfile is:

meshcentral.example.com {
    reverse_proxy meshcentral:4430
}

Enable two-factor authentication from the web interface (TOTP compatible with Google Authenticator and Authy) before exposing the server to the internet. 2FA is available for all accounts, not just admins.

A real example: a 50-PC SMB was paying €480/year for TeamViewer Business. They migrated to MeshCentral in an afternoon, deployed agents via GPO, and cut costs to zero immediately.

What to do

• Install MeshCentral with docker compose up -d, create the first admin account from the web UI, and connect a test PC with the agent to verify that remote desktop and file transfer work
• Enable 2FA on the admin account before making the domain public — this is the one step you cannot skip
• For mass deployment on Windows, export the silent install script from the console (Device Group → Bulk Install) and distribute it via GPO or Intune