Use this article when Teramind Agents appear offline or aren’t reporting because a firewall or proxy is blocking their traffic.

Symptoms

You might be affected if:

The Teramind Dashboard is slow, doesn’t load or shows errors.
Computers / employees show as offline or “not reporting”.
Live screen or video doesn’t connect or keeps disconnecting.
Users’ internet stops working or becomes very slow after installing the Teramind Agent.

1. Quick Checks

Try these simple checks first:

Test Normal Internet Access:
- Open a few common sites (e.g., https://www.google.com, https://www.wikipedia.org).
- If these don’t load, it’s a general network problem, not just Teramind.
Try a Different Network (If Allowed):
- If possible, briefly connect to another network (home Wi-Fi or mobile hotspot).
- Open the Teramind Dashboard and wait a few minutes for the Agent to report. If Teramind works there, it’s very likely that your company firewall or proxy is causing the issue.

1. Solution

Contact your IT or network team and provide them with the specific Teramind hosts and ports that need to be allowlisted (see the What to Allowlist section below for the exact values). Don’t just ask them to "open Teramind". Give them the specific domains, ports and protocol requirements.

2. 'Forbidden' or 'Access Denied' Login Errors

If users receive a 'Forbidden' or 'Access Denied' error when logging in, this is usually caused by one of the following:

IP-Based Login Restrictions: The user’s current IP address is not on the allowlist. This is common when users work from a new location, connect via VPN or change networks.
Wrong URL: The user is accessing the wrong URL. Make sure they are using the correct instance URL (e.g., yourcompany.teramind.co) rather than a generic portal link.
License Limits Exceeded: If all license seats are in use, new connections may be rejected.

2. Solution

To resolve IP restriction issues, a Teramind administrator needs to log in from an unrestricted network and update the Allowed IP addresses for dashboard access field under Configurations > Settings > Authentication. If the administrator is also locked out, contact Teramind support.

Note: This setting only restricts dashboard login and usage. It doesn’t affect monitored Agents.

3. Checks for Firewall & Proxy

Check out the How to check if Teramind IP addresses, hosts, and ports are reachable article.

That article shows you how to:

Confirm the Teramind server/hostnames are reachable from user machines.
Check that the required ports are open (for the dashboard, Agent reporting, live screen, etc.).
Run quick network tests (PowerShell Test-NetConnection, Telnet, curl or Netcat) to prove where traffic is blocked.
If any of these tests fail, your firewall or proxy is blocking or filtering Teramind traffic.

Common firewall / proxy issues to look for:

When reviewing your firewall rules and logs, check for:

Blocked outbound traffic to Teramind hosts or ports.
SSL inspection / HTTPS decryption breaking WebSocket or long-lived connections (affecting live screen and video).
A forward proxy that denies or times out HTTPS connections to the Teramind server, or doesn’t support WebSocket over HTTPS properly.
DNS filtering that blocks Teramind domains.

3. Solution

Add Teramind’s hosts and ports to your allowlist / bypass list in the firewall and proxy (see What to Allowlist below).
Allow WebSocket over HTTPS to the Teramind server.
If the Agent connects only when the system proxy is turned off, either allow Teramind traffic through the proxy or configure the Agent’s proxy settings. Check out the connectivity article above for details.
Use the connectivity article above to confirm everything is reachable after you adjust the rules.

What to Allowlist

Provide your IT or network team with the following information:

Cloud Deployments

Allow outbound traffic to the server IP addresses, hosts and ports listed on the My Account screen under Server & Port:
- Your Instance Servers: Each Cloud instance has its own server IP and port (e.g., 203.0.113.10 on port 41840). Some instances have more than one server for load balancing, each with its own IP and port, so allow all of them. Use the exact values shown for your instance.
- Shared Teramind Services: rt.teramind.co and www.teramind.co on port 443.
Allow WebSocket connections (WSS) over port 443. Many proxies block long-lived WebSocket connections by default.
Exclude Teramind domains and your instance server IPs from SSL/TLS inspection. SSL decryption will break the Agent-to-server connection.

On-Premises Deployments

Allow outbound TCP port 443 to your Teramind server IP or hostname.
Allow outbound TCP port 10000 to your Teramind server IP or hostname (single-node), or ports 10000–11000 to your application server nodes (multi-node).
Allow WebSocket connections over port 443.
Exclude the Teramind server IP or hostname from SSL/TLS inspection.

All deployments may also need TCP port 80 for Agent deployment and updates, and UDP ports 1000–65535 if audio recording is enabled. For the full list of ports, check out the How to check if Teramind IP addresses, hosts, and ports are reachable article.

You can find your server addresses and ports on the My Account screen under Server & Port (Cloud), or under Configurations > Settings > Server (On-Premises). After the rules are updated, use the How to check if Teramind IP addresses, hosts, and ports are reachable article to verify that everything is reachable.

How to address firewall or proxy issues with Teramind