Remote SSH through a customer's firewall: what to ask IT

You do not need an open port. You need one outbound rule, and two settings that do not get in the way.

The rule to ask for

• Outbound TCP 443 from the device to app.rescueshell.com. Nothing inbound.
• To install or update the agent, also releases.rescueshell.com on 443.

Two settings that break shells

• WebSocket blocked: shells run only over WebSocket. The device can still report in over plain HTTPS, so it looks online while every shell fails. Ask IT to allow WebSocket to the relay host.
• TLS inspection: the agent checks the relay's certificate against the device's CA list. A firewall that re-signs traffic fails that check. Exempt the relay host, or add the firewall's CA to the device.

The agent connects directly and does not use an HTTP proxy. A network where web traffic only leaves through a proxy will not work.

What their IT team gets

• No inbound port and no VPN into their network.
• No tunnel into the LAN. Port forwarding through a session is off; the shell runs on the device only.
• One open shell per device at a time.
• Admins see who opened a shell on which device, and when. See security.

A mail you can send

Our device needs one outbound rule: TCP 443 to app.rescueshell.com.
Nothing inbound. Please allow WebSocket to that host and leave
it out of TLS inspection. Installs and updates also use
releases.rescueshell.com on 443.

€0.10 a device a month, billed yearly, at least €6 a year. Also see SSH without port forwarding.