Help › Connect › D7

Connect directly in the company network — without a relay and without internet

If the device is in the same network, you connect directly by IP address or computer name — even when the internet is down. The administrator has to allow this in the console first.

Preview this guide has not yet been clicked through on a real device. Button names and steps come from the program but may differ in details.

For: Technician · Account administrator
Applies to: Own relay
Right in the console: Policy “Allow direct LAN connections (without relay)” (directLanAllowed)
Controlled device: Windows · macOS · Linux
Control from: Program (Windows, macOS, Linux)
from version: 20261010.43

What it is for

Normally every connection goes through a relay — even when your computer and the device sit next to each other in the same network. If the internet is down, or the workshop has none at all, nothing works. With direct LAN you connect to the device directly by IP address or computer name. A fingerprint makes sure you really talk to the right device.

What you need

The administrator's approval: in the console, Allow direct LAN connections (without relay) must be switched on for the device or the access. It is off by default. The approval cannot be set at the device itself.
At the device: BrowserDesk version 20261010.43 or later on Windows, macOS or Linux, with the switch Direkte Verbindungen im eigenen Netz annehmen (Accept direct connections in the own network) switched on.
On your side: the BrowserDesk program on your computer. Direct LAN does not work in the browser.
Both in the same network: home or company network, also a cable straight between two computers. It does not work over VPN networks such as Tailscale.
The device password (D2).
Firewall: on Windows, TCP port 47420 has to be open in the private network. BrowserDesk does not change the firewall itself.

How to do it

Administrator and device (once)

In the console open the device's (or the access's) settings, section Reachability.
Switch on Allow direct LAN connections (without relay). Optionally also Switch on direct LAN connections — then the switch at the device is fixed to on.
At the device: EinstellungenFernzugriff (Settings > Remote access) → card Direkt im LAN (Direct in the LAN) → switch on Direkte Verbindungen im eigenen Netz annehmen unless the console already does it.
The card now shows "Erreichbar unter …" (reachable at …) with address and port, and a fingerprint. Note both or pass them to the technician.

Technician (connect)

On the start page, below the connect field, click Direkt im LAN verbinden … (Connect directly in the LAN …).
Enter "IP-Adresse oder Rechnername[:Port]" (IP address or computer name[:port]), for example 192.168.1.20. Only add the port if it is not 47420.
Enter "Kennwort des Geräts" (device password), Verbinden (Connect).
The first time, BrowserDesk shows the device's fingerprint: Gerät zum ersten Mal — Fingerabdruck vergleichen (device for the first time — compare fingerprint). Compare it with the display at the device. Only if both match: Stimmt überein — verbinden (Matches — connect).
Only then does the password go to the device. The fingerprint is remembered for this address.

How you know it worked

The session window with the device's screen opens — even without internet. The history lists the session as "Direkt …" (direct …) with the address.

What the other side sees

The same as via the relay: password, lock-out after failed attempts and the question Zugriff erlauben? (Allow access?) apply unchanged (F1).

Good to know

The access's rules do not apply here. Without a relay nobody checks, for example, "control only from the own access". That is why the administrator's approval is needed. The rights at the device (control, files …) apply as usual.
Log: the device records every direct connection locally and reports it to the relay as soon as the relay is reachable again.
Only addresses from the own network are accepted. One session at a time.
Reinstalled: after a reinstallation the device has a new fingerprint. BrowserDesk then warns you.
Restarting BrowserDesk remotely is not available in direct mode.
Approval withdrawn: the device closes direct access as soon as it signs in to the relay again.

If it does not work

You see	Meaning and fix
"… antwortet nicht. Ist „Direkt im LAN“ am Gerät eingeschaltet und freigegeben, und lässt die Firewall den Port zu? …" (does not answer — is direct LAN switched on and approved, does the firewall allow the port?)	Switch at the device off, no approval, wrong address, or the firewall blocks port 47420. On Windows, have a firewall rule for TCP 47420 in the private network created.
"Adresse nicht lesbar — z. B. 192.168.1.20 oder pc-buero.fritz.box:47420" (address not readable)	Typo in the address.
Fingerabdruck hat sich geändert (fingerprint has changed)	Normal after a reinstallation at the device. Otherwise another device may have put itself in between. Only continue with Neuen Abdruck übernehmen (accept new fingerprint) if it matches the display at the device.
At the device: "Nicht freigegeben — der Verwalter schaltet „Direkt im LAN erlauben“ in der Konsole frei." (not approved)	The approval in the console is missing (see above).
At the device: "Vom Gerätebesitzer gesperrt (lokale Richtlinie)." (blocked by the device owner)	The device owner has forbidden direct LAN. This overrides the console too.
At the device: "Vom Administrator festgelegt (aus) — hier nicht änderbar." (set by the administrator)	Switch on direct LAN connections is set to off in the console.
Connecting over VPN does not work	Intended: direct LAN only accepts addresses from the own network. Use the relay over VPN.

← From home to your own office computer — with “My devices” and a second factor Many devices at a glance — the control room (Leitstand) →