Group policy & TCP forwards
Once your team is set up, use group policy and TCP forwards to control how members' devices route traffic and reach internal systems — all pushed from the admin dashboard, with nothing for members to configure themselves.
Group policy
TYO Reach uses a Meraki-style policy model: each client polls /api/v1/policy at
startup and applies whatever the server returns, then checks in again periodically while
running. This lets a group owner push configuration to every member without anyone
needing to reinstall or reconfigure manually.
The group policy editor is live in the admin dashboard. From there you can control, per group:
- Browser routing — which browsers are proxied
- Gateway selection — which regional gateway the group uses
- TCP forwards — forwards pushed to every member (see below)
- Proxy rules — routing rules applied to member traffic
Changes take effect the next time a client polls, which happens at each startup and periodically while running.
TCP port forwarding
TCP port forwarding is built into the desktop tray app on Windows and macOS. It tunnels a local port on the user's machine through Reach to any remote host — useful for reaching internal services that aren't exposed to the public internet.
Common use cases
| Use case | Remote port | Notes |
|---|---|---|
| Windows Remote Desktop (RDP) | 3389 | .rdp file generated automatically |
| SSH | 22 | Use with any SSH client |
| Internal web app | 80 / 8080 | Open in browser as http://localhost:PORT |
| PostgreSQL | 5432 | Connect any SQL client to localhost:PORT |
| MySQL / MariaDB | 3306 | Connect any SQL client to localhost:PORT |
Adding a forward
- Open the TYO Reach tray menu.
- Go to TCP Forwards → Add Forward…
- Enter a label, the remote host and port, and optionally a preferred local port.
- Click Add.
The slot appears in the menu as:
Label → remote.host:PORT (localhost:LOCAL)
Click the slot to copy localhost:LOCAL to your clipboard, then paste it into your
application as the connection address.
Forwards are saved in the app config and reconnect automatically each time the app starts.
RDP files
When the remote port is 3389, a second item appears beneath the slot:
↳ Save Label.rdp
Click it to save a pre-configured .rdp file to your Downloads folder. Open it to
connect directly without entering the address manually.
Removing a forward
Ctrl+Click a forwarding slot in the tray menu to remove it.
Group-managed forwards
As a group owner you can push TCP forwards to every member from a single place. Members
see these automatically with a [group] suffix in their tray — no action needed on
their part. Group-managed forwards cannot be accidentally removed by Ctrl+click.
How it works: the effective forward list for each member is the union of group forwards and their own forwards. If a member and the group define a forward to the same remote host and port, the group entry wins — unless an admin sets an override flag on that group forward.
With the override flag set, the member's own entry replaces the group entry for that
destination. Without it, the group entry is locked and the member sees [group] with no
Ctrl+click.
Agent mode and reverse tunnels
Agent mode turns a desktop client into a relay agent inside your local network. Other group members can then reach services inside that LAN from outside — without any firewall or NAT changes, because the agent initiates the outbound connection.
Typical use cases:
- WFH staff accessing office-only systems (shared drives, internal apps, printers)
- Servers or NAS devices without a public IP
- Branch office administration from headquarters
To enable: open the tray menu, go to Settings, and turn on Agent mode. (It can also be pushed via group policy so it activates automatically on designated machines.)
Once active, group members connect to the agent's LAN services through their normal TCP forwarding setup — they add a forward pointing to the internal host, and the traffic travels through the agent's tunnel.