Help › Set up › B7

Allow access only from trusted networks

Console and device control only from the company network or via VPN — with lists of allowed networks for the relay and per access.

Preview this guide has not yet been clicked through on a real device. Button names and steps come from the program but may differ in details.

For: Account administrator · Own-relay operator
Applies to: Cloud · Own relay
Right in the console: System administrator (relay list); administrator of the access (lists of the access)
Control from: Browser
from version: 20261010.40

What it is for

You decide from which networks someone may open the console and control your devices — for example only from the company network and via your VPN. There are three lists:

List	Where	Binds
Console of the relay	Settings → Admin access → Trusted networks	every request to the console, including the sign-in page and API tokens (own relay only)
Console of the access	Edit tenant → tab Security	administrators and other accounts bound to this access
Viewers of the access	same place	connecting, waking and restarting devices of the access — from the program, browser, console, by quick code

An empty list means: no restriction.

What you need

The addresses of your networks in CIDR notation, for example 203.0.113.0/24 or 2001:db8::/48.
For the lists of an access: an account as administrator of the access. In the console an access is called a tenant.
For the relay list: your own relay and an account as system administrator.

How to do it

Lists of an access

Tenants → double-click the access (Edit tenant) → tab Security.
At the top it says Your address as the relay sees it:. Insert my address adds it to the list.
In Console: administrators of this access and Viewers: connect, wake up, restart enter one network per line.
Save networks.

Relay list (own relay)

Settings → Admin access → section Trusted networks.
Enter networks, one per line — your own first (Insert my address).
Save networks.

How you know it worked

After saving: “Trusted networks saved.”
From outside, the console shows: “The console cannot be reached from your address — it is outside the trusted networks. …”
A viewer from outside gets: “This device can only be controlled from the trusted networks of its access — your address is not one of them. …” The BrowserDesk program shows this sentence in German: „Dieses Gerät lässt sich nur aus den vertrauten Netzen seines Zugangs steuern — …“
Every refusal is recorded in the audit log.

Good to know

You cannot lock yourself out: if your current address is not in the new list, the console does not save and tells you so.
Behind a reverse proxy the lists do not work. The relay only sees the proxy's address. If Your address as the relay sees it: shows 127.0.0.1 or the proxy's address, run the relay without the proxy (B9).
IPv4 always with four parts. 10 or 10.1 are not understood as networks. Bits after the prefix are cut off (10.1.2.3/8 becomes 10.0.0.0/8).
Running sessions stay when you save; the list applies from the next connection. Open console sign-ins stop working from the next request.
Not covered: the sign-in in the program and under “My devices” itself. A viewer list only exists per access, not for the whole relay.
Specific computers instead of networks: tab Governance policy → Control only from the device's own tenant → Only computers of the tenant (B6). Both can be combined: first the network is checked, then the computer.
System administrators are only bound by the relay list, not by the list of an access.

If it does not work

You see	Meaning and fix
“Your current address is not in the list — you would lock yourself out. …”	Your network is missing. Insert my address, then Save networks.
“Your address is unknown — with this list you would be locked out. …”	The relay does not know your address. Nothing was saved.
Locked out as administrator of an access	The system administrator empties the list in the console. In the Cloud: info@browserdesk.de.
Own relay, console unreachable from anywhere	Emergency exit on the server, as the service's user: `BrowserDesk.Relay --set-setting trustednets.system --clear` (on Windows `BrowserDesk.Relay.exe` in the relay's program folder). To empty an access: `--set-setting trustednets:<access> --clear`. Takes effect within 15 seconds. If your relay has a `BD_KEYRING_KEY`, the call must have it in its environment, otherwise it aborts (B9).
Everyone is locked out, or everyone gets in	The relay is behind a proxy (see above).
Viewer: “This device can only be controlled from the trusted networks of its access — …”	Connect from the company network or via VPN, or ask the administrator to allow the network (D9).

← Keep customers cleanly apart and appear under your own brand Update, back up and move your own relay to a new server →