Remoteer
TR EN

Network and firewall requirements

For IT administrators: what Remoteer connects to, what to allow on a strict network, and how to tell a firewall problem from something else. Written for Remoteer 0.1.38; where something needs 0.1.38 or later, it says so.

1. In short

  • Remoteer only makes outbound connections. You never open an inbound port or set up port forwarding, neither on the router nor on the computers.
  • It talks to one server, remote.cpleks.com (31.220.89.164), and straight to the other computer over UDP when the network allows it.
  • The two computers encrypt the connection between them end to end (WebRTC: DTLS and SRTP). When they cannot reach each other directly, our relay passes on packets it cannot read.
  • On a strict network, allow these outbound:
remote.cpleks.com   TCP 443
remote.cpleks.com   UDP 3478, TCP 3478
31.220.89.164       UDP 49152-49999

remote.cpleks.com is 31.220.89.164. A direct connection between the two computers also needs outbound UDP to any address; without it, Remoteer uses the relay.

2. What Remoteer connects to

DestinationPortWhat for
remote.cpleks.com
31.220.89.164		 TCP 443
HTTPS, WebSocket		 The website and the web client (/app/); sign-in and your account; signaling, which finds the other computer and sets up each connection (wss://remote.cpleks.com/ws); the connection settings (/api/ice); update checks and downloads (/downloads/).
remote.cpleks.com
31.220.89.164		 UDP 3478
TCP 3478
STUN, TURN		 Finding the computer's public address, and our relay, for when the two computers cannot reach each other directly.
31.220.89.164 UDP 49152–49999 The relay's own ports: traffic to the other computer's address on the relay.
The other computer UDP, any port The direct connection between the two computers. Each side sends from a random port; the replies come back the same way, which every stateful firewall allows.
Relay over TLS Coming TCP 443 For networks that allow only web traffic. Remoteer 0.1.38 and later, and the web client, will use it as soon as we switch it on. Its name and address will be listed here.

Remoteer picks the path itself, best first: direct UDP; the relay over UDP 3478; the relay over TCP 3478 (about a second later); and, once it is on, the relay over TLS on 443.

Buying Pro on the website also loads our payment provider, Paddle, at the checkout only. Apart from that, Remoteer uses no other servers: no third-party STUN server (such as Google's), no analytics.

3. Strict firewalls

  • Write the rules for outbound traffic only. Use the name remote.cpleks.com where your firewall supports name-based rules, and its address where it doesn't. If the address changes, this page will say so.
  • The smallest set that works: TCP 443 and TCP 3478 to remote.cpleks.com. Sessions and tunnels then go through the relay over TCP: they work, a little slower.
  • Best: add UDP 3478 and UDP 49152–49999 to 31.220.89.164, and outbound UDP to any address, so that most sessions connect directly.
  • Only web traffic (TCP 80 and 443) allowed: Remoteer signs in and shows the other computer as online, but sessions and tunnels cannot connect yet, because the relay is not on port 443. They end saying there is no network path to the other computer, or that setting up timed out. Allow TCP 3478 to remote.cpleks.com, or wait for the relay on 443 (coming).
  • Firewalls that look inside traffic (deep packet inspection, "next-generation" firewalls) must let STUN, TURN and DTLS through to these addresses, or they drop them as unknown.
  • Application or category filters: a filter that blocks "remote access" tools or new domains may block Remoteer too. Allow the application or remote.cpleks.com.

4. TLS inspection

Exclude remote.cpleks.com from TLS (HTTPS) inspection.

  • Remoteer checks the server's certificate against the certificates installed on the computer, so signaling may get through inspection when your company's certificate is installed. Even so, inspection devices often cut long-lived WebSocket connections, and Remoteer keeps one open all the time.
  • The relay over TLS on 443 (coming) cannot work through inspection at all. When it has its own name, the name will be listed here; exclude it too.

5. Proxy servers

  • The app's window (signing in, viewing another computer) and the web client reach remote.cpleks.com through the computer's proxy settings, as a browser does.
  • Updates are downloaded by the app itself, not by its window. They use the system's fixed proxy setting (a server and port entered by hand), but not PAC files, WPAD, NTLM or Kerberos authentication, or the proxy entered in Remoteer's Settings. Where updates cannot get through, download the new version from the website, or let remote.cpleks.com bypass the proxy.
  • 0.1.38 and later: Remoteer's own network code (it keeps this computer reachable, and carries the sessions to it and the tunnels) also works through an HTTP proxy. It uses the system's proxy settings, or a proxy entered in Settings → Network & Relay.
  • Not supported: automatic proxy configuration (PAC files, WPAD) and NTLM or Kerberos authentication (signing in with Windows). Where you use those, enter the proxy in Settings by hand, or let remote.cpleks.com bypass the proxy.
  • A proxy carries TCP only. A session's data still needs one of these: outbound UDP (direct or to the relay); the relay over TCP 3478 through the proxy (0.1.38 and later; the proxy must allow CONNECT to remote.cpleks.com port 3478, which many proxies refuse by default); or the coming relay on 443.

6. IPv6

IPv4 onlyFor now, Remoteer works over IPv4 only: allow the IPv4 address above. Networks with both IPv4 and IPv6 need nothing more. Networks with IPv6 only reach Remoteer through their NAT64 gateway, the way they reach any IPv4 address. When our server can be reached over IPv6 directly, its address will be listed here.

7. Windows

  • Remoteer installs per user, without administrator rights, in %LOCALAPPDATA%\Programs\Remoteer, and adds no firewall rules.
  • The first time someone connects to the computer, or it opens its first tunnel, Windows Defender Firewall may say it has blocked some features of Remoteer. If you are an administrator, tick Private networks (and Domain networks on a computer in a company domain), leave Public networks unticked, and choose Allow access. If you are not, choose Cancel.
  • Either way, sessions and tunnels should still connect: Remoteer only makes outbound connections, and Windows lets the replies to them back in. Allowing access can help two computers on the same office network reach each other directly instead of through the relay.
  • If your computers block outbound traffic by default, allow %LOCALAPPDATA%\Programs\Remoteer\Remoteer.exe to the destinations above, and Microsoft Edge WebView2 (msedgewebview2.exe), which the app's window uses.

8. macOS

  • The macOS firewall needs no change. Remoteer needs no incoming connections; it is also signed and notarized by Apple, and the firewall allows signed apps by default.
  • Local Network permission (macOS 15 and later): the first time Remoteer on a Mac reaches a device on that Mac's network (during a session, or for a tunnel to, say, a NAS at 192.168.1.50), macOS asks whether Remoteer may find and connect to devices on your local network. Choose Allow.
  • If someone chose Don't Allow: turn Remoteer on in System Settings → Privacy & Security → Local Network. Without it, tunnels from that Mac to other devices on its network fail; tunnels to the Mac itself (127.0.0.1) and to the internet keep working.
  • Screen Recording and Accessibility are separate permissions, for showing the screen and for mouse and keyboard: see the guide.

9. Tunnels

A tunnel is a Remoteer connection that carries one TCP port: on any network where a session connects, a tunnel connects too. Both ends run in the desktop app.

  • On your computer, once connected, the tunnel listens only on 127.0.0.1, at the port you chose. No firewall prompt applies, and nothing else on your network can reach it.
  • On the remote computer, Remoteer connects to the address and port you chose, from that computer, like any program running there. The remote computer's own firewall does not stop this outbound connection; the target device's firewall does apply.

When a tunnel does not work

  • Use 127.0.0.1, not localhost. Some programs try the IPv6 form (::1) first, and the tunnel does not listen there.
  • Cannot listen on 127.0.0.1:… means another program already uses that port on your computer; choose another. On Windows, Hyper-V, WSL and Docker also reserve ranges of ports: list them with netsh interface ipv4 show excludedportrange protocol=tcp and choose a port outside them.
  • Your program connects, but the connection closes at once: the target refused it (the port is wrong, the service is not running, or the service only accepts connections from its own computer), the remote computer could not resolve the name you gave, or the address is one Remoteer does not forward to: link-local (169.254.x.x, fe80::), multicast or broadcast. Printers and storage devices cabled straight to a computer, with no DHCP server, often have a 169.254 address.
  • It closes after about 10 seconds: nothing answered. Usually the target device's firewall drops the connection. On a Windows target, allow the service (for example Remote Desktop, port 3389, or File and Printer Sharing, port 445) from the computer that runs Remoteer.
  • The remote computer is a Mac and the target is another device on its network: check its Local Network permission.
  • The tunnel never comes up (no network path, or setting up timed out): the network blocks the connection itself, as it would a session. See Strict firewalls.

10. Limits that look like a firewall

  • Free plan: every session, tunnels included, ends after 15 minutes. Connect again straight away, or use Pro, which has no time limit.
  • The relay, per public address: about ten sessions can start every ten minutes from one public IP address with the relay available (with IPv6, one /64 counts as one address). Every session counts, direct or relayed, and so does a connection request the other side declines or leaves unanswered; a voice or video call inside a session uses more. What counts is the address of the person who connects, so sessions between two computers in the same office count against that office's address too. Past that, new sessions from that address get no relay until the ten minutes are up, and on a strict network they fail. If your office reaches this, write to us.
  • A computer being connected to lends the relay to at most 6 connection attempts a minute that have not yet proved their PIN or password.
  • Online status: per public address, the server answers 120 online-status checks a minute. Each open Remoteer with saved computers checks every 5 seconds, so with more than about ten open behind one office address, saved computers can show as offline for part of each minute. Connecting to them still works. If your office reaches this, write to us.
  • Per public address, the server takes 60 connection requests and 60 sign-in requests a minute.

11. Checking a network

  • In a browser on that network, open https://remote.cpleks.com/api/ice. A short line starting with {"success":true means TCP 443 and the server are fine.
  • For TCP 3478, in Windows PowerShell, Test-NetConnection 31.220.89.164 -Port 3478 should show TcpTestSucceeded : True. On a Mac, in Terminal, nc -vz 31.220.89.164 3478 should say "succeeded".
  • During a session, the wave icon in the session bar opens Session diagnostics. Its badge says RELAY when the session goes through our relay, and HOST, SRFLX or PRFLX when it is direct.
  • Still stuck: send the support log (Settings → General → Support log) and the time it failed to support@remote.cpleks.com.