Skip to main content

​
Limit remote support to one approved office IP

Outcome: Only the office public source IP may access a specific Agent-owned SSH Remote Service. Other public sources receive a Remote Access policy denial. Example: office egress IP 203.0.113.10 → Server → Managed Host branch-a, service object ssh. Substitute real public addresses.
Without any configured Remote Access policy, v2.4 effective Remote Access is ALLOW. Disabling Remote Access enforcement also means ALLOW ALL. Do not use disabling enforcement as a lockdown or casually reset/delete the only WHITELIST rule.

​
Step 1 — identify the actual source and existing rules

Real Data Relay Link CLI capture — Remote Access before any rules: No Policy, unmatched ALLOW. A new published service is not automatically source-restricted. Figure 1. Remote Access before any rules: No Policy, unmatched ALLOW. A new published service is not automatically source-restricted. CLI output example; sensitive addresses and hostnames are masked. Server REPL:
The Server must already have branch-a enrolled with a valid SSH Service Object. Capture the current policy and the backup archive path. Determine the office’s public/NAT egress IP as seen at the Server; a workstation’s internal private IP may not be the observed source.

​
Step 2 — create explicit source selectors

Server REPL:
Use a legitimate alternate public source for the negative test; the documentation addresses above are examples.

​
Step 3 — create the WHITELIST

Real Data Relay Link CLI capture — Remote Access guided menu: choose 2 Create rule, then 5 Test / Explain to validate. Figure 2. Remote Access guided menu: choose 2 Create rule, then 5 Test / Explain to validate. CLI output example; sensitive addresses and hostnames are masked. Real Data Relay Link CLI capture — Policy Mode selection: use 2 whitelist to ALLOW matched sources; 1 blacklist has different behavior. Figure 3. Policy Mode selection: use 2 whitelist to ALLOW matched sources; 1 blacklist has different behavior. CLI output example; sensitive addresses and hostnames are masked. Server REPL:
Review all pre-existing enabled Rules. WHITELIST entries may jointly authorize more sources than this single Rule. Rule changes may request confirmation based on the calculated security impact.

​
Step 4 — test policy without creating connectivity

Real Data Relay Link CLI capture — Real command help: test remote-access requires named source, destination and service selectors. Figure 4. Real command help: test remote-access requires named source, destination and service selectors. CLI output example; sensitive addresses and hostnames are masked. Server REPL:
Expected: ALLOW for the office, DENY for the unapproved source if no other matching Rule exists. The test is read-only and does not prove an SSH endpoint works.

​
Step 5 — test real traffic from both networks

Use the reserved SSH public port printed by show remote-service on the Agent. From the actual office network:
Repeat from an independently unapproved source. Confirm an explicit policy DENY / relevant audit record, not only a timeout or a separate firewall block. External firewall restrictions may additionally prevent traffic from reaching DRLink.

​
Recovery and safety

If the office cannot reach the service, verify the NAT-visible office IP, Service Object name, target Managed Host, tunnel health and matched Rules with test remote-access / system audit. To change access safely, edit or replace the Rule under a maintenance plan. unset remote-access policy resets to default ALLOW; set remote-access disabled is also ALLOW ALL. Do not use either to repair a failed restriction unless a deliberately approved broad-access change is intended.

​
Current behavior check — 2026-10-28

Inspect every enabled Rule and referenced Group before the negative test. Remote Access disabled enforcement and full policy reset open access (ALLOW ALL/initial ALLOW); they are not safe ways to prove denial. Group policy tests require every expanded combination to allow before reporting aggregate ALLOW. Current CLI inventory · MCP compatibility
Last modified on October 28, 2026