> ## Documentation Index
> Fetch the complete documentation index at: https://link.datarelay.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Use case: Office-only Remote Access

> Set a narrow inbound WHITELIST and prove both approved and denied sources.

# Limit remote support to one approved office IP

**Outcome:** Only the office public source IP may access a specific Agent-owned SSH Remote Service. Other public sources receive a Remote Access policy denial.

**Example:** office egress IP 203.0.113.10 → Server → Managed Host **branch-a**, service object **ssh**. Substitute real public addresses.

> [!WARNING]
>
> Without any configured Remote Access policy, v2.4 effective Remote Access is **ALLOW**. **Disabling** Remote Access enforcement also means **ALLOW ALL**. Do not use disabling enforcement as a lockdown or casually reset/delete the only WHITELIST rule.

## Step 1 — identify the actual source and existing rules

![Real Data Relay Link CLI capture — Remote Access before any rules: No Policy, unmatched ALLOW. A new published service is not automatically source-restricted.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/server-inbound-default.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=6ccc484894e73895ddf128ee290fe3a5)

*Figure 1. Remote Access before any rules: No Policy, unmatched ALLOW. A new published service is not automatically source-restricted. CLI output example; sensitive addresses and hostnames are masked.*

**Server REPL:**

```text theme={null}
show managed-hosts
show service-objects
show remote-access
system backup
```

The Server must already have **branch-a** enrolled with a valid SSH Service Object. Capture the current policy and the backup archive path. Determine the office's **public/NAT egress IP as seen at the Server**; a workstation's internal private IP may not be the observed source.

## Step 2 — create explicit source selectors

**Server REPL:**

```text theme={null}
set network-object office-public type ip value 203.0.113.10
set network-object unapproved-test type ip value 198.51.100.21
show network-object office-public
```

Use a legitimate alternate public source for the negative test; the documentation addresses above are examples.

## Step 3 — create the WHITELIST

![Real Data Relay Link CLI capture — Remote Access guided menu: choose 2 Create rule, then 5 Test / Explain to validate.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/remote-access-menu.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=c54499e4c34413ef48fd101219bd25da)

*Figure 2. Remote Access guided menu: choose 2 Create rule, then 5 Test / Explain to validate. CLI output example; sensitive addresses and hostnames are masked.*

![Real Data Relay Link CLI capture — Policy Mode selection: use 2 whitelist to ALLOW matched sources; 1 blacklist has different behavior.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/remote-access-mode.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=2a6249c5614bc796d68c0efc639f0429)

*Figure 3. Policy Mode selection: use 2 whitelist to ALLOW matched sources; 1 blacklist has different behavior. CLI output example; sensitive addresses and hostnames are masked.*

**Server REPL:**

```text theme={null}
set remote-access office-ssh mode whitelist source office-public destination branch-a service ssh enabled
set remote-access enabled
show remote-access
show remote-access office-ssh
```

Review all pre-existing enabled Rules. WHITELIST entries may jointly authorize more sources than this single Rule. Rule changes may request confirmation based on the calculated security impact.

## Step 4 — test policy without creating connectivity

![Real Data Relay Link CLI capture — Real command help: test remote-access requires named source, destination and service selectors.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/remote-test-syntax.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=942deb416fa251df5dc7f38efdeede47)

*Figure 4. Real command help: test remote-access requires named source, destination and service selectors. CLI output example; sensitive addresses and hostnames are masked.*

**Server REPL:**

```text theme={null}
test remote-access source office-public destination branch-a service ssh
test remote-access source unapproved-test destination branch-a service ssh
```

Expected: **ALLOW** for the office, **DENY** for the unapproved source *if no other matching Rule exists*. The test is read-only and does not prove an SSH endpoint works.

## Step 5 — test real traffic from both networks

Use the reserved SSH public port printed by `show remote-service` on the Agent. From the actual office network:

```bash theme={null}
ssh -p <reserved-public-port> <actual-os-user>@<drlink-public-host>
```

Repeat from an independently unapproved source. Confirm an explicit policy DENY / relevant audit record, not only a timeout or a separate firewall block. External firewall restrictions may additionally prevent traffic from reaching DRLink.

## Recovery and safety

If the office cannot reach the service, verify the NAT-visible office IP, Service Object name, target Managed Host, tunnel health and matched Rules with `test remote-access` / `system audit`. To change access safely, edit or replace the Rule under a maintenance plan. `unset remote-access policy` resets to default ALLOW; `set remote-access disabled` is also ALLOW ALL. Do not use either to repair a failed restriction unless a deliberately approved broad-access change is intended.

## Current behavior check — 2026-10-28

Inspect every enabled Rule and referenced Group before the negative test. Remote Access disabled enforcement and full policy reset open access (ALLOW ALL/initial ALLOW); they are not safe ways to prove denial. Group policy tests require every expanded combination to allow before reporting aggregate ALLOW.

[Current CLI inventory](https://link.datarelay.run/drlink/cli-reference.md) · [MCP compatibility](https://link.datarelay.run/reference/mcp-validation.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.