What your network must allow
The ORelay Agent only connects out. Nothing on a computer listens for connections, so there is no port to open towards it, on a router or anywhere else.
Outbound connections
Allow these by name: the addresses behind them can change. Remote desktop, terminals and file transfers travel over the agent’s connection, so they need nothing more.
| What | Name | Port | Notes |
|---|---|---|---|
| The agent’s connection | agents.orelay.io | TCP 50051 | Mutual TLS with the computer’s own certificate, held open while the computer is on. It does not go through a web proxy, and it cannot be inspected: each end checks the other’s certificate. |
| Joining and updates | api.orelay.io | TCP 443 | TLS 1.3. The agent trusts the certificate authorities it carries, not the computer’s own, so leave api.orelay.io out of TLS inspection. |
| Installers, and our package signing key | orelay.iodownloads.orelay.io | TCP 443 | Only while installing: the deploy scripts download the installer, and the Linux script our package signing key. |
| People | viewer.orelay.ioapi.orelay.io | TCP 443 | The web viewer and the ORelay apps, wherever people work from. |
What does not work today
- A network that lets only port 443 out cannot connect ORelay’s agents: they need port 50051 to agents.orelay.io.
- Port 50051 has to be open directly. If your computers reach the internet only through a proxy, tell us before you roll ORelay out.
Clocks
Each computer’s clock has to be right to within a few minutes. Certificates are checked against it, and a computer whose clock is far off cannot join or connect.
A server of your own
If your agents connect to a server of your own, allow its names instead of agents.orelay.io and api.orelay.io: the agents’ host and port you gave the installers, and your API’s address.
Rolling ORelay out to many computers? Deploy ORelay to many computers.