diff --git a/src/common.rs b/src/common.rs
index 596a248..da5b4cf 100644
--- a/src/common.rs
+++ b/src/common.rs
@@ -2102,15 +2102,45 @@ pub fn load_custom_client() {
         read_custom_client(&data.trim());
     }
 
-    // Custom fork: hardcode enable-audio = N as the default. User can still flip it on in Settings.
+    // Custom fork: hardcode bandwidth-heavy / sensitive defaults to off.
     // Reason: RustDesk's official custom.txt path requires ed25519-signed base64 (see
     // read_custom_client at line 2191 — decode64 + sign::verify with key
     // "5Qbwsde3unUcJBtrx9ZkvUmwFNoExHzpryHuPUdqlWM="), which we can't produce without the
     // official signing key. So we bypass custom.txt and inject directly into DEFAULT_SETTINGS.
-    // entry().or_insert() preserves the priority chain: OVERWRITE_SETTINGS → CONFIG2 → DEFAULT_SETTINGS.
+    // entry().or_insert() preserves the priority chain: OVERWRITE_SETTINGS → CONFIG2 → DEFAULT_SETTINGS,
+    // so users can still override any of these in their own RustDesk2.toml.
+    //
+    // Why each one is off (user has 4 users on 5 Mbps server, file transfers were saturating it):
+    //   enable-audio           — not needed for 4-user remote support; saves 64 kbps/session
+    //   enable-file-transfer   — THE KILLER: 1 GB upload = 2 GB server bandwidth (in + out)
+    //   enable-clipboard       — 50 kbps + privacy; rarely needed for remote support
+    //   enable-keyboard        — only needed for typing-on-remote scenarios
+    //   enable-tunnel          — TCP tunneling = users abusing server as a jump host
+    //   enable-record-session  — only needed if explicitly recording
+    //   enable-camera          — 500 kbps; rarely used for support
     {
         let mut defaults = config::DEFAULT_SETTINGS.write().unwrap();
         defaults.entry("enable-audio".to_string()).or_insert("N".to_string());
+        defaults.entry("enable-file-transfer".to_string()).or_insert("N".to_string());
+        defaults.entry("enable-clipboard".to_string()).or_insert("N".to_string());
+        defaults.entry("enable-keyboard".to_string()).or_insert("N".to_string());
+        defaults.entry("enable-tunnel".to_string()).or_insert("N".to_string());
+        defaults.entry("enable-record-session".to_string()).or_insert("N".to_string());
+        defaults.entry("enable-camera".to_string()).or_insert("N".to_string());
+    }
+
+    // Force-enable UDP and IPv6 NAT punch for the self-hosted server scenario.
+    // Background: get_local_option() at src/common.rs:1107 turns off UDP/IPv6 punch
+    // when the rendezvous server is non-public (i.e. self-hosted). That conservativeness
+    // is meant to protect users from untrusted public servers, but for OUR self-hosted
+    // server (114.55.133.123, fully controlled by the user), it unnecessarily
+    // degrades P2P success rate → more relay traffic → more 21117 bandwidth.
+    // Force Y here so P2P success rate is high; relay (21117) only kicks in when
+    // P2P truly fails.
+    {
+        let mut locals = config::OVERWRITE_LOCAL_SETTINGS.write().unwrap();
+        locals.entry("enable-udp-punch".to_string()).or_insert("Y".to_string());
+        locals.entry("enable-ipv6-punch".to_string()).or_insert("Y".to_string());
     }
 }