[GH-ISSUE #1400] Separate MeshCentral Agent + Web Console ports #2823

New issue

Open

opened 2026-03-14 05:37:34 +03:00 by kerem · 2 comments

kerem commented

2026-03-14 05:37:34 +03:00

Owner

Originally created by @joeldeteves on GitHub (Jan 10, 2023).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/1400

We've discussed this previously in Discord, and I think it's time to open an issue for it.

As the description says, I am requesting that the MeshCentral Agent + Web Console ports be separated.

This is to allow for more fine-grained control and better security of the bundled MeshCentral instance.

For example, if the Agents run on their own port, we can proxy in front of the web console while still allowing agents to communicate, set firewall rules only allowing access from certain IPs to the Mesh Console, etc.

Happy to help out with this one on the Docker side - unsure what, if anything needs to change on the TRMM side.

Thank you,

EDIT: Here is an explanation from Ylian on how this works:

Originally created by @joeldeteves on GitHub (Jan 10, 2023). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/1400 We've discussed this previously in Discord, and I think it's time to open an issue for it. As the description says, I am requesting that the MeshCentral Agent + Web Console ports be separated. This is to allow for more fine-grained control and better security of the bundled MeshCentral instance. For example, if the Agents run on their own port, we can proxy in front of the web console while still allowing agents to communicate, set firewall rules only allowing access from certain IPs to the Mesh Console, etc. Happy to help out with this one on the Docker side - unsure what, if anything needs to change on the TRMM side. Thank you, EDIT: Here is an explanation from Ylian on how this works: ![image](https://user-images.githubusercontent.com/33190570/211464342-04312797-7540-428b-bdba-52074df82d71.png)

kerem added the

dev-triage

label

2026-03-14 05:37:34 +03:00

kerem commented

2026-03-14 05:37:45 +03:00

Author

Owner

@joeldeteves commented on GitHub (Jan 10, 2023):

Just a FYI, I found a workaround on this.

I was able to use Path on my Traefik reverse proxy to exclude the agent paths.

However, for users who want to use another method e.g. firewall/vpn, it would be good to have the ports separated.

@joeldeteves commented on GitHub (Jan 10, 2023): Just a FYI, I found a workaround on this. I was able to use `Path` on my Traefik reverse proxy to exclude the agent paths. However, for users who want to use another method e.g. firewall/vpn, it would be good to have the ports separated.

kerem commented

2026-03-14 05:37:51 +03:00

Author

Owner

@Trapulo commented on GitHub (Feb 28, 2024):

Can you explain what did you do?
I'm using HAProxy as reverse proxy + SSL offloading behind the Tactical docker env.

@Trapulo commented on GitHub (Feb 28, 2024): Can you explain what did you do? I'm using HAProxy as reverse proxy + SSL offloading behind the Tactical docker env.