There are two ways to let users log in to the Teramind dashboard from outside your local network: configure a VPN or make the server public.
Configure a VPN (Recommended)
Set up a VPN so that employees can connect to the corporate network from the public internet. This option is more secure, because VPN traffic is usually encrypted, and the Agents keep connecting to the server address they already use.
Make the Server Public
Expose your Teramind server to the internet by assigning it a public IP address and a valid domain name.
To let the Agents connect to the server both inside and outside the corporate network without a VPN, create a public FQDN (fully qualified domain name) and the firewall rules it needs. Add DNS records to both your internal and public DNS so that the FQDN (for example, teramind.corporatedomain.com) resolves to the Teramind server's IP address from inside and outside the network.
The server uses two ports that you configure under Configurations > Settings > Server > Server ports: a management interface port for the dashboard and a load balancer port for the Agents. Open only these two ports on your firewall. To check that the Agents can reach the server, see:
To make the dashboard accessible outside the corporate network, set a public hostname and upload a trusted SSL certificate:
Hostname: Configurations > Settings > Security > Hostname. Teramind uses this hostname in dashboard links and email notifications. Changing it doesn't change the server address that the Agents connect to.
SSL: Configurations > Settings > Security > SSL. A trusted certificate prevents browser warnings for users who open the dashboard. The Agents don't require a trusted certificate and also work with a self-signed one.
Note: Agents connect to the server address they were installed with. If that address changes, you might be able to redirect them instead of redeploying. See the options in the next section.
Redirect Agents to a New Server Address
If the Agents need to connect to a new server IP address or hostname, you don't need to reinstall them. Use one of the following options:
Update DNS: If the Agents were installed with a hostname, update the DNS record for that hostname to point to the server's current IP address. The Agents reconnect without any changes on the monitored computers. This option doesn't work if the Agents were installed with an IP address.
Edit the Agent Configuration: Change the server address in the Agent configuration file on each monitored computer and restart the Agent service. For steps, see How to Edit the Agent Configuration to Connect to a New Server IP or Hostname (On-Premises).
Revealed Agent: On computers running the Revealed Agent, change the server address in the Server field under the Agent's Advanced settings.
Redeploy the Agents: Uninstall the Agents and install them again with the new server address. When many computers are affected, deploying the Agents remotely can be easier than editing the configuration file on each one. See How to Install the Windows Agent Remotely (On-Premises) and How to Install the Mac Agent Remotely Using Jamf.
Security Recommendations
Open Only Needed Ports: Expose only the management interface port and the load balancer port to the internet.
Restrict Dashboard Access by IP: Limit which IP addresses can open the dashboard under Configurations > Settings > Authentication > Allowed IP Addresses for Dashboard Access.
Turn On 2FA: Require two-factor authentication for dashboard users under Configurations > Settings > Authentication > Two-Factor Authentication (2FA).