Firewalls and proxies

What the agent needs

• Required: outbound HTTPS (TCP 443) to app.remotehub.app.
• Recommended: outbound UDP to any address, so the agent can make direct peer-to-peer connections.
• Relay fallback: TCP and UDP 443 and UDP 3478 to Cloudflare's relay network. If direct paths are blocked, sessions go through these relays automatically.

No inbound ports are needed, and you do not need to set up port forwarding.

Why am I always on a relay?

Strict firewalls, symmetric NAT or blocked UDP prevent direct connections. Relayed sessions are still encrypted end to end but may have more delay. Allow outbound UDP on the network with the agent to improve this.

Proxies

The agent uses the system proxy settings for its HTTPS connection. The proxy must allow long-lived WebSocket connections to app.remotehub.app; if it inspects TLS, add remotehub.app to its bypass list.