Access a Device via SSH or RDP

In this guide, we'll set up a Device Pool so a support team can open a remote desktop session on the Windows workstations they support, wherever those machines happen to be.

Unlike other Resources, this does not involve a Gateway. The two Clients connect straight to each other over an encrypted peer-to-peer tunnel, so you only need the Firezone Clients on both ends. No Gateway or inbound access on your network firewall is needed.

Firezone does not authenticate RDP, SSH, or any other machine-level session. It decides which machines are reachable over the network; the machine itself still decides who may log in. You'll need a valid account on the device being accessed, and that device enforces its own password, key, or MFA policy as usual.

Prerequisites

  • The machines you want to reach are signed in to a Firezone Client and appear under Clients in the admin portal.
  • Remote Desktop is turned on for the machines you want to reach. Firezone carries the traffic; it does not turn the service on for you.
  • Every Client involved, on both ends, is new enough to support Device Pools. See the version requirements.

Opening ports on your network firewall is not necessary or recommended. Firezone performs secure NAT traversal between the two Clients for you.

Step 1: Create the Device Pool

  1. In your admin portal, open Resources in the left sidebar and click New Resource.
  2. Select Device Pool as the Resource type.
  3. Name it something descriptive, like Field Workstations. You'll refer to this name when creating a Policy in Step 3.
  4. Under Pool membership criteria, choose Static list, then search for and select the workstations you want the support team to reach. For a pool that follows a department as people and devices change, choose A group's devices and select that department's Group instead. See all four membership choices.
  5. Click Create Resource.

Step 2: Restrict the pool to remote access

Since these are people's working machines, grant only the services you actually need rather than the whole device.

  1. Edit the Resource you just created. In Traffic Restrictions, click Add protocol and choose TCP.
  2. Enter 3389 as the port. That's RDP.
  3. Add UDP as well with port 3389 if you want RDP's UDP transport, which gives a smoother session on lossy networks. RDP falls back to TCP without it.
  4. Save.

Now only remote desktop traffic will reach pool members. Everything else is dropped. If you want SSH too, add 22 to the TCP ports.

Step 3: Create a Policy

  1. Open Policies in the left sidebar, then click New Policy.
  2. Select the Group that should get access, such as Support, and the Device Pool you created in Step 1.
  3. Click Save.

Membership and access are separate lists. Being in the pool makes a machine reachable; the Policy decides who can reach it. A member gets no access to anything just by being a member.

Step 4: Find the device's DNS name

  1. Open Clients in the admin portal and select a workstation you added to the pool.
  2. In the device's details, copy the DNS name shown under Slug, such as field-workstation-01.firezone.network.

Each device has its own <slug>.firezone.network name. You can edit the Slug on the device to give it a recognizable name, unique within your account. Use the copied name in the examples below.

You can also use a tunnel IP address: open the Resource's Pool Members tab and copy the workstation's Tunnel IPv4 or Tunnel IPv6 address.

Step 5: Connect

From a Client signed in as a member of the Support Group, connect using the device's DNS name. Sign in with an account that already exists on the target machine.

On Windows, use the built-in Remote Desktop Connection:

mstsc /v:field-workstation-01.firezone.network

On macOS, iOS, or Android, open the Windows App (formerly Microsoft Remote Desktop) and add a PC with field-workstation-01.firezone.network as the PC name.

On Linux, most clients take the address directly:

xfreerdp3 /v:field-workstation-01.firezone.network /u:technician

Any other service you allowed in Step 2 works the same way, against the same address. ssh technician@field-workstation-01.firezone.network, for instance.

Step 6: Done!

You now have peer-to-peer remote desktop access to a fleet of machines, with no Gateway deployed and no inbound access configured on your network firewall.

Troubleshooting

The pool doesn't appear in a user's Client. Their Client is probably too old. Device Pools are hidden entirely from Clients that don't support them, so they won't see an error. Check the version against the requirements.

The device's DNS name does not resolve. Check the slug in the admin portal and confirm that the signed-in user has a Policy granting access to a pool containing that device. A device name alone does not grant access.

The connection fails to a specific member. The member has to be online for a peer-to-peer connection to work; Firezone can't wake a sleeping machine. The Pool Members tab shows who's online right now.

The connection fails between two specific Clients. Both Clients must be on the same major and minor version, so a Client on 1.5.x can't reach one on 1.6.x. This usually shows up mid-upgrade and resolves once both ends are on the same release.

RDP connects but rejects the login. That's the target machine's own authentication, not Firezone. Check that the account exists on that machine and is allowed to sign in remotely.

Need help? See all support options.

Found a problem with this page? Open an issue
Last updated: November 03, 2026