Remote Access

NetDefense provides secure remote access to your devices through the PathFinder relay. This works even when the device is behind NAT or a firewall, because NDAgent creates an on-demand outbound WebSocket connection to PathFinder, which is then used as a secure relay channel.

Tip

No port forwarding or firewall rules are required on the device side. NDAgent initiates an outbound connection to PathFinder, so the relay works from any network — even behind strict NAT or CGNAT.

Connect to a Device

ndcli device connect fw-hq-primary

View in NDWeb

This command establishes a WebSocket tunnel through PathFinder to the device’s NDAgent and automatically launches an interactive shell session on the firewall.

In addition to terminal access, the same command also creates a local port-forwarding tunnel to the device’s web administration interface. You can open your browser and connect to the assigned local port to interact with the firewall’s web UI as if you were directly connected to the local network. The web administration tunnel establishes an automatically authenticated session, so no additional credentials are required.

If you only need terminal access and want to prevent the web administration tunnel from being created, use the --no-webadmin flag:

ndcli device connect fw-hq-primary --no-webadmin

You can select your preferred terminal session (the default OPNsense terminal menu or any available shell such as sh, csh, tcsh, etc.) by configuring the PathFinder options in the Advanced section of the OPNsense plugin.

Read-only sessions

A Read-Only member’s session is read-only, and so is every session to a device whose Remote Access Policy is Read-only web UI only: the web administration interface only, with no shell, and no configuration changes. The device enforces this itself, not the browser.

From ndagent 1.20.1, a read-only session also blanks the secrets the device stores — password hashes, private keys, pre-shared keys and the like — and refuses private-key and PKCS#12 exports, dashboard or menu-favorite saves, and actions such as clearing a log or restarting a service. Logs and free-text settings stay readable, and a search of the lists that hold secrets can still recover one, so treat read-only access to a device as access to those secrets. See Read-only sessions are enforced on the device for what’s hidden and what isn’t.