Three Ways to Reach the Server

FSRdp runs on your own server. You decide who can reach it. Three setups cover practically every situation, from an isolated company network to public access for every customer.

The difference between these setups is the firewall, rather than the software: which of the three ports can be reached from outside? Rooms, licenses and features remain the same. This page illustrates each case and lists the port access and certificates you need.

8888 Main Channel – Screen, Chat, Files and Remote Control

8889 Audio Channel – Voice

8890 Browser Access – Join without Installation

Case 1

Everything Stays in Your Network

The server, workstations and browser viewers are on the same network. No ports are open to the outside; the server is simply unreachable from the internet. A typical setup for training, factory floors and anything that should stay on site.

Without port access, every session stays within your network, including browser access.

Open to the Outside: nothing
Certificate: an internal certificate is sufficient; browsers must trust your internal certificate authority for browser access
Who Can Join: anyone on the company network
Browser Address: internal address, e.g. https://fsrdp.firma.local:8890/

Case 2

Remote Work / Field Staff via VPN – with Optional Browser Access

Like case 1, but staff connect to the company network from elsewhere. For FSRdp, nothing changes: anyone on the VPN is on the network, and no FSRdp ports need to be opened.

If customers without VPN access should also be able to join, open a single additional port: 8890. Customers can then join in a browser while the two channels for the screen, remote control and files remain reachable only internally. In practice, this is often the most useful compromise.

The tunnel ends at the VPN gateway; from there the server is an ordinary computer on the same network. The dashed path above shows the one opening that lets customers join without a VPN. Without it, this is case 1 with remote network access.

Open to the Outside: your VPN; optionally 8890 as well – never 8888 or 8889
Certificate: as in case 1; publicly accessible browser access additionally needs a publicly trusted certificate (e.g. Let's Encrypt), since browsers do not accept an internal one
Who Can Join: anyone on the company network or VPN; with 8890 open, any browser user who knows the room number can also join
Keep in Mind: The VPN must resolve the server name used in its certificate; an IP address alone is insufficient

Case 3

All Three Ports Open

The setup for remote support across company boundaries: your technician connects from home, the customer installs the client or joins in a browser, and no one needs a VPN. This is also how we currently run our own server.

Two access paths, three ports – every session still runs exclusively through your own server.

Open to the Outside: 8888, 8889 and 8890
Certificate: issued for the public server name and trusted by the clients
Who Can Join: anyone who knows the room number, in the client or browser
Keep in Mind: Room names can be reserved for a supporter and protected by a room password

Exception

Live Captions Send Audio Outside Your Network

The three setups above determine who may connect from outside . One feature goes in the other direction: when you enable live captions and simultaneous translation, your server sends room audio to the configured transcription service. By default this is an OpenAI-compatible internet service. This happens regardless of which incoming ports your firewall allows, and therefore also applies to case 1.

The feature is disabled by default and must be enabled in three places: the license, the server configuration and an API key. The room owner also enables it for each room, and all participants see a prominent notice while it is active. Without these steps, no bytes leave your network.

What Is Sent: spoken room audio when someone speaks; silence is not sent
What Is Not Sent: screen, camera, chat and files; recognized text is logged only if the room owner starts a session recording
Destination: the service configured in appsettings.json , optionally through your proxy; the service address can be changed
Your Responsibility: With the default OpenAI service, this is a transfer to a third country: address it in your privacy policy and enter into a data processing agreement with the provider

On a network with no internet access at all, the strictest form of case 1, this feature cannot be used. Leave it disabled: every other FSRdp feature works without external contact.

The Three Cases Side by Side

	Case 1internal only	Case 2VPN, optional 8890	Case 3all ports open
8888 · 8889 from outside	no	no	yes
8890 from outside	no	optional	yes
Public Certificate Required	no	only with 8890 open	for all three
External Participants	none	VPN access, optional browser	in the client and browser
Remote Control from Outside	no	yes	yes

Browser access never transmits mouse or keyboard input, even in case 3. Remote control is available exclusively between installed clients, and only when the room owner explicitly grants it.

What Applies in All Three Cases

Every connection uses TLS encryption, including internal connections.
Everything runs through your server, never through a service of ours. Screen, audio and files are forwarded without being stored. The one exception is optional live captions, as described above.
Browser access is disabled by default and must also be enabled in the license. The room owner decides for each room whether viewers receive screen and audio.
Switching between setups means changing the firewall and a setting, rather than reinstalling.

Set Up the Server Which Setup Fits Your Needs? Get in Touch