Remote Access

NetDefense provides secure remote access to your devices through its connection relay. This works even when the device is behind NAT or a firewall, because NDAgent creates an on-demand outbound WebSocket connection to the relay, which then serves as a secure channel.

Tip

No port forwarding or firewall rules are required on the device side. NDAgent initiates an outbound connection to the relay, so remote access works from behind NAT or CGNAT, as long as the firewall can open an outbound HTTPS connection to the relay (its address is on Service Endpoints).

Connect to a Device

Web

Open the device from Devices and click Connect. The page that opens has two tabs: Terminal, a shell on the firewall in your browser, and WebAdmin, the firewall’s own web interface through the same tunnel, already signed in. Pop Out moves the terminal to its own window, and Disconnect ends the session. See Device detail.

View in NDWeb

CLI

ndcli device connect fw-hq-primary

This command establishes a WebSocket tunnel through the connection relay to the device’s NDAgent and automatically launches an interactive shell session on the firewall.

In addition to terminal access, the same command also creates a local port-forwarding tunnel to the device’s web administration interface. You can open your browser and connect to the assigned local port to interact with the firewall’s web UI as if you were directly connected to the local network. The web administration tunnel establishes an automatically authenticated session, so no additional credentials are required.

If you only need terminal access and want to prevent the web administration tunnel from being created, use the --no-webadmin flag:

ndcli device connect fw-hq-primary --no-webadmin

You can select your preferred terminal session (the default OPNsense terminal menu or any available shell such as sh, csh, tcsh, etc.) with the Pathfinder Shell setting in the Advanced section of the OPNsense plugin.

Read-only sessions

Note

A Read-Only member’s session is in early access.

A Read-Only member’s session is read-only, and so is every session to a device whose Remote Access Policy is Read-only web UI only: the web administration interface only, with no shell, and no configuration changes. The device enforces this itself, not the browser.

From ndagent 1.20.1, a read-only session also blanks the secrets the device stores — password hashes, private keys, pre-shared keys and the like — and refuses private-key and PKCS#12 exports, dashboard or menu-favorite saves, and actions such as clearing a log or restarting a service. Logs and free-text settings stay readable, and a search of the lists that hold secrets can still recover one, so treat read-only access to a device as access to those secrets. See Read-only sessions are enforced on the device for what’s hidden and what isn’t.