Access a Device via SSH or RDP

In this guide, we'll set up a Device Pool so a support team can open a remote desktop session on the Windows workstations they support, wherever those machines happen to be.

Unlike other Resources, this does not involve a Gateway. The two Clients connect straight to each other over an encrypted peer-to-peer tunnel, so nothing needs to be deployed and no ports need to be opened on either side.

Prerequisites

• The machines you want to reach are signed in to a Firezone Client and appear under Clients in the admin portal.
• Remote Desktop is turned on for the machines you want to reach. Firezone carries the traffic; it does not turn the service on for you.
• Every Client involved, on both ends, is new enough to support Device Pools. See the version requirements.

Step 1: Create the Device Pool

1. In your admin portal, open Resources in the left sidebar and click New Resource.
2. Select Device Pool as the Resource type. There's no address to enter and no Site to choose.
3. Name it something descriptive, like Field Workstations. You'll refer to this name when creating a Policy in Step 3.
4. In the Devices field, search for each machine you want to make reachable and add it to the pool.
5. Click Create Resource.

Step 2: Restrict the pool to remote access

Since these are people's working machines, grant only the services you actually need rather than the whole device.

1. In the Traffic Restrictions section of the Resource form, click Add protocol and choose TCP.
2. Enter 3389 as the port. That's RDP.
3. Add UDP as well with port 3389 if you want RDP's UDP transport, which gives a smoother session on lossy networks. RDP falls back to TCP without it.
4. Save.

Now only remote desktop traffic will reach pool members. Everything else is dropped. If you want SSH too, add 22 to the TCP ports.

Step 3: Create a Policy

1. Open Policies in the left sidebar, then click New Policy.
2. Select the Group that should get access, such as Support, and the Device Pool you created in Step 1.
3. Click Save.

Step 4: Find the address to connect to

1. Open Resources and select your Device Pool.
2. Open the Pool Members tab.
3. Find the machine you want to reach. Its Tunnel IPv4 is shown in the row, and expanding the row shows the Tunnel IPv6 as well. Click either to copy it.

These addresses belong to the Client and don't change, so you can save them.

Step 5: Connect

From any Client in the Support Group, connect using the tunnel address. Sign in with an account that already exists on the target machine.

On Windows, use the built-in Remote Desktop Connection:

mstsc /v:100.96.0.24

On macOS, iOS, or Android, open the Windows App (formerly Microsoft Remote Desktop) and add a PC with 100.96.0.24 as the PC name.

On Linux, most clients take the address directly:

xfreerdp3 /v:100.96.0.24 /u:technician

Any other service you allowed in Step 2 works the same way, against the same address. ssh technician@100.96.0.24, for instance.

Step 6: Done!

You now have peer-to-peer remote desktop access to a fleet of machines, with no Gateway deployed and no inbound firewall rules on either end.

Troubleshooting

The pool doesn't appear in a user's Client. Their Client is probably too old. Device Pools are hidden entirely from Clients that don't support them, so they won't see an error. Check the version against the requirements.

The connection fails to a specific member. The member has to be online for a peer-to-peer connection to work; Firezone can't wake a sleeping machine. The Pool Members tab shows who's online right now.

The connection fails between two specific Clients. Both Clients must be on the same major and minor version, so a Client on 1.5.x can't reach one on 1.6.x. This usually shows up mid-upgrade and resolves once both ends are on the same release.

RDP connects but rejects the login. That's the target machine's own authentication, not Firezone. Check that the account exists on that machine and is allowed to sign in remotely.

Need help? See all support options.