Agent mode (relay)

Agent mode turns the Reach desktop client on a machine inside your office network into an agent: it opens an outbound connection to a Reach relay and, from then on, members can reach services on that LAN through it — an internal web app, a database, a file server — without any inbound firewall or NAT changes. What the agent may expose is controlled by the organisation's Shared Resources list.

How it works

  1. A machine on the LAN switches on Agent mode in the Reach tray. The client registers with the relay over an outbound connection and keeps it open.
  2. A member elsewhere connects to a TCP forward whose destination is a host on that LAN. The tray marks such forwards via relay rather than direct.
  3. The relay checks the organisation's Shared Resources rules, then bridges the member's connection to the agent, which connects to host:port on the LAN.
  4. Every relayed connection is written to the organisation's connection audit log (Logs tab).

The agent initiates everything outbound, so nothing on your network needs to be exposed to the internet.

Requirements

  • Account: agent mode is available to members of an organisation and to personal Pro and Business plans.
  • Platform: the Agent mode toggle is in the Windows tray today. macOS and Linux clients don't yet expose it.
  • Relay: the client needs a relay endpoint from its policy. If the tray shows "Relay not configured — ask your admin", contact TYO support to have the relay enabled for your organisation.

The toggle remembers its state, so an office PC re-registers as an agent after a restart.

Who can use an agent

By default an agent is reachable only by its owner's own devices — handy for reaching your own office PC from home, but not a team feature.

To open it up, the organisation owner ticks Allow all members to reach each other's agents through the relay on the Gateways tab. Every member's agent then becomes usable by the organisation, subject to the Shared Resources rules below.

Shared Resources: what the agent may expose

On the Resources tab, define the host:port pairs members are allowed to reach through your agents:

FieldMeaning
LabelOptional friendly name, e.g. Finance DB
HostHostname or IP as the agent sees it, e.g. db.internal or 192.168.1.20
Port1–65535
AccessAll members, or tick specific members
StatusEnabled / Disabled — disable to pause a resource without deleting it

The relay enforces these rules on every connection.

Agent mode vs Share this PC vs TCP forwards

  • Share this PC gives a named person a desktop session (RDP or VNC) on one specific machine. It's per-machine and per-person.
  • Agent mode exposes services on a whole LAN to the organisation, filtered by Shared Resources.
  • TCP forwards are how members actually connect in both the agent case (via relay) and the ordinary case, where the gateway reaches a host that's on the public internet or allowlisted for the gateway IP (direct).

Common questions

Do I need a dedicated machine for the agent?

No — any Windows PC that stays on and on the LAN will do, but a small always-on box is the sensible choice so nobody's laptop going to sleep takes the office offline.

Can two agents run in the same organisation?

Yes. Each registers separately; Shared Resources rules apply to all of them.

Does agent traffic count against data allowances?

Members of an organisation are unmetered, so no.