Docs / Obsidian Remote / Reference
Ports and firewalls
Obsidian Remote needs very little from your firewalls: one port on the server, and nothing inbound from the internet on your PCs.
The server
| Port | Direction | What for |
|---|---|---|
| TCP 21114 (or 443 behind a reverse proxy) | inbound, from your PCs, technicians and browsers | Everything: PCs registering, connection requests, relayed sessions, the admin console and the web viewer all share this one HTTPS port. |
The server makes no outbound connections of its own. You can change the port with port in server.json (see Installing the server).
The PCs
| Port | Direction | What for | Needed? |
|---|---|---|---|
| TCP 21114 (or 443), to your server | outbound | Registering with the server, and relayed sessions | yes |
| TCP 21118 | inbound, from the local network | Direct connections from viewers on the same network | optional |
| UDP 21119 | inbound, from the local subnet | Answering LAN discovery | optional |
No inbound ports from the internet and no port forwarding: a PC keeps its own connection to the server open, and sessions between networks go through the server's relay.
The MSI adds Windows Firewall rules for TCP 21118 and UDP 21119, for ObsidianRemote.Host.exe, on domain and private networks only, and only from the PC's own subnet. On a network Windows treats as public, PCs don't accept direct connections or answer discovery, and sessions use the relay instead. The portable copy adds no firewall rules.
The port for direct connections can be changed on each PC (Settings > Security > Port).
Proxies and HTTPS inspection
PCs connect straight to the server's address. If your network inspects HTTPS traffic (a firewall or proxy that decrypts and re-encrypts it), PCs that check the server's key from the client config string will refuse the connection, because they see the inspection device's certificate instead of your server's. Either exclude the server's name from inspection, or give the server a certificate from a certificate authority your PCs trust (see Installing the server).
The relay's limits
Your server closes a relayed session after 2 minutes without any traffic in either direction (relayIdleSeconds). A normal session always has traffic; an idle tunnel may not. It also caps each relayed session's speed (relayKbpsCap, 20 Mb/s by default - far more than a remote desktop needs).