Skip to main content

​
Reach a private HTTPS administration console

Outcome: A support workstation securely reaches one appliance’s HTTPS admin UI; you do not expose the entire appliance LAN. Example: Agent on a reachable LAN host → firewall console 10.40.10.8:8443 → externally reserved DRLink TCP port.

​
Step 1 — confirm the existing application

On the Agent/gateway OS, establish that 10.40.10.8:8443 is reachable and the admin application has a trusted certificate for the name end users will use. DRLink Remote Access uses TLS passthrough, not TLS termination. A certificate-name mismatch is a deployment problem, not a reason to disable verification.

​
New Agent: configure the console with Zero-Touch

On the Server run set enrollment zero-touch, select Linux, name/describe the host, then Choose Remote Services → Add HTTPS. Enter Service ID firewall-ui, Target host 10.40.10.8, Target port 8443, then Finish. Run the generated command on the gateway that can reach that LAN. The required Objects and Remote Service are automatic. Inspect show remote-services and the actual service detail on the Agent, then continue at Step 4. Steps 2–3 below are only for additional services on an existing Agent. Prepare required source restrictions before publishing.

​
Step 2 — register the destination and service

Real Data Relay Link CLI capture — Service Object type choices: 1 SSH/TCP 22, 3 HTTPS/TCP 443, or 6 Fixed TCP as needed. Figure 1. Service Object type choices: 1 SSH/TCP 22, 3 HTTPS/TCP 443, or 6 Fixed TCP as needed. CLI output example; sensitive addresses and hostnames are masked. Server REPL:
Prefer setting the required Remote Access WHITELIST before publishing this sensitive UI. See office-only allowlist.

​
Step 3 — publish only this port

Real Data Relay Link CLI capture — On the owning Agent Host select 2 Create Remote Service; this does not create the service on the Server. Figure 2. On the owning Agent Host select 2 Create Remote Service; this does not create the service on the Server. CLI output example; sensitive addresses and hostnames are masked. After enrolling an Agent that can reach the target LAN IP, use the Agent REPL:
Record the reserved public endpoint shown by the CLI.

​
Step 4 — test from an authorized workstation

Configure a DNS name such as console.example.net to reach the DRLink public address. The backend HTTPS certificate must match console.example.net (or a separately verified name that the application actually presents). Access:
For a DNS test that preserves both the URL hostname and TLS verification, replace placeholders and use:
Expected: the appliance login page over validated TLS, not a DRLink management login. Authenticate using the application’s own identity mechanism.

​
Step 5 — verify restricted access

Real Data Relay Link CLI capture — Remote Access before any rules: No Policy, unmatched ALLOW. A new published service is not automatically source-restricted. Figure 3. Remote Access before any rules: No Policy, unmatched ALLOW. A new published service is not automatically source-restricted. CLI output example; sensitive addresses and hostnames are masked. Server REPL:
From a second, unapproved source, test access and confirm the policy denial, not merely a network timeout. If Remote Access has no policy, it defaults to ALLOW: publishing alone is not sufficient access restriction.

​
Recovery

  • Certificate error: correct DNS/certificate/SNI on the application, not a proxy rewrite; never turn off TLS verification to pass a test.
  • Browser timeout: check external firewall, reserved port, Agent connectivity and target 10.40.10.8:8443.
  • Unexpected ALLOW: inspect all matching Remote Access rules and their effective mode; set remote-access disabled is ALLOW ALL, not a safe emergency deny.
  • Retire console: remove firewall-ui on the owning Agent after impact review, leaving unrelated LAN services untouched.

​
Current behavior check — 2026-10-28

The application keeps its own TLS and login. Verify its certificate hostname at the allocated public endpoint without skipping certificate checks. After a reconnect, synchronize on the owning Agent and check the current Remote Service generation before declaring recovery. Current CLI inventory · MCP compatibility
Last modified on October 29, 2026