Help › Functions
DeskRanger on a company network: what IT needs to allow
Which addresses and ports DeskRanger needs, what helps with firewalls, proxies and TLS inspection, and how to keep working in the browser.
Many company, school and hotel networks let only certain services through their firewall. DeskRanger works there as long as a few addresses can be reached. This page is for you and for the IT department that runs the network.
How to recognize the problem
Under Reachability you see Limited – relays blocked with this hint below it:
> Tip: this network blocks DeskRanger. It often works in the browser.
This means DeskRanger can reach the internet but none of its relays. Without a relay, no device outside your network can connect to this device, and you can reach other devices only if a direct connection works.
macOS
You can find Reachability under This Mac: click This Mac at the bottom of the sidebar.
Windows
You can find Reachability under This PC: click the Reachability row in the sidebar.
iPhone & iPad
This function is coming soon to iPhone & iPad.
Android
You can find Reachability in the menu: tap the connection status (bars and text) at the bottom of this device's card.
Keep working in the browser
Connect in the browser opens DeskRanger in your browser. The browser uses the proxy, the automatic proxy configuration and the certificates your company has set up for it. That is why DeskRanger often works in the browser even when the network blocks the app. Sign in there with your account and connect to your devices as usual.
In the browser, every connection goes through a relay and is end-to-end encrypted, just as in the app. This device itself cannot be shared from the browser.
What IT needs to allow
The simplest approach is to allow outgoing connections to all addresses under deskranger.app over HTTPS (TCP 443). In detail:
| Purpose | Address | Port |
|---|---|---|
| Sign-in, account, device list and connection setup | *.deskranger.app | TCP 443 |
| Relays (encrypted connections) | *.relay.deskranger.app | TCP 443 |
| Measuring reachability (recommended) | *.relay.deskranger.app | UDP 7842 |
| DeskRanger in the browser | app.deskranger.app | TCP 443 |
| Direct connections (recommended) | any destination | Outgoing UDP and the replies to it |
The relays use WebSocket over TLS. A firewall that only allows HTTP and HTTPS must also allow the switch to WebSocket (Upgrade: websocket).
DeskRanger still works without UDP, but every connection then goes through a relay. Under Reachability, you then see Limited – relay only. Direct or via relay explains why this can be slower.
TLS inspection and company certificates
Some firewalls open encrypted connections for inspection using a company certificate. DeskRanger trusts the same certificates as the operating system. If the company certificate is installed there, TLS inspection lets DeskRanger through.
Your sessions stay protected: screen content, input, files and terminal data have an additional layer of end-to-end encryption between your devices. TLS inspection sees only encrypted data, just like the relay.
Proxy
DeskRanger uses the proxy your operating system prescribes for internet access: the system's proxy setting, an automatic proxy configuration (PAC) and automatic detection (WPAD). You do not have to set anything up. This applies to the connection to our servers and to the relays; direct connections between two devices do not go through a proxy. Behind a proxy that does not let UDP through, sessions therefore run over a relay.
If you need a different proxy than the system's, enter it yourself. You find the field under Proxy server in the settings:
macOS
Open the settings and choose This Mac.
Windows
Open the settings and choose This PC.
iPhone & iPad
Open Settings (on the iPhone under More) and there the page of your device (This iPhone or This iPad). Scroll to Proxy server.
Android
Open the settings and choose This device.
Enter the address and port, for example proxy.example.com:8080, and click Apply. DeskRanger checks your entry as you type. Under Currently in use you see which proxy DeskRanger uses right now and where it comes from. The connection over a relay takes a change only at the next connection setup: Takes effect on the next connection.
If the background service runs on the device, the entry applies to the whole device, also before anyone signs in. Changing and removing it then asks for an administrator: An administrator must confirm changes or removal. Without the background service the entry applies only to you, and you need no administrator.
Proxies that ask for a user name and password are not supported yet. Until then, Connect in the browser helps.