Obsidian SuiteDocumentation
Obsidian Remote: all chapters

Docs / Obsidian Remote / During a session

TCP tunnels

A tunnel carries a port on your PC to a computer and port that the remote PC can reach, end-to-end encrypted. Use it to reach Remote Desktop, a web admin page, a printer's setup page or a database on the remote network, as if you were sitting there.

Open the tunnel window

  • During a remote-control session, click TCP tunnel on the toolbar.
  • Or, without the picture, use the Tunnel button under the box in the main window.

Start a tunnel

  1. Remote host (as the remote PC sees it): 127.0.0.1 for a service on the remote PC itself, or the address of another machine on its network, for example 10.0.0.5.
  2. Remote port: the port of the service, for example 3389 for Remote Desktop, 443 for a web page.
  3. Local port (0 = any free one): the port on your PC. Leave it at 0 unless your program needs a particular port.
  4. Click Start tunnel.

The tunnel appears under Active tunnels with its local address, for example 127.0.0.1:52144. The copy button copies it. Point your program at that address: a browser at https://127.0.0.1:52144, a database tool at 127.0.0.1 port 52144, and so on. The stop button ends that tunnel. All tunnels end with the session.

Remote Desktop in one click

Remote Desktop (RDP) sets the remote host to 127.0.0.1 (the remote PC itself) and the port to 3389, starts the tunnel and opens the Windows Remote Desktop app (mstsc) pointed at it. Sign in as you normally would. Remote Desktop must be turned on, on that PC.

To reach Remote Desktop on another computer on the remote network, type its address as the remote host and 3389 as the port, click Start tunnel, and connect the Remote Desktop app to the local address the tunnel shows.

Things to know

  • Tunnels are refused while nobody is signed in at the remote PC.
  • On an installed remote PC, the tunnel's connections leave that PC under its system account, not as the signed-in person. For most services that makes no difference; a service that checks who is connecting sees the computer, not the person.
  • The remote PC must allow Tunnels for your session. Its owner or your administrator can turn them off for everyone (see Policies), and the person at the PC can untick them when they accept you.
  • The web viewer can't open tunnels. Use the Windows app.