TCP forwards

A TCP forward binds a port on a member's own machine — localhost:13000, say — and carries everything sent to it through Reach to a remote host and port. Point Remote Desktop, an SSH client or a database tool at the local port and it connects as if the server were next to you. Forwards can be added by each member in the tray, or pushed to the whole organisation from the dashboard.

Add a forward in the tray (any member)

  1. Open the Reach tray menu → TCP Forwards → Add Forward…

  2. Enter the remote host and port. Reach names the forward from the port (RDP for 3389, SSH for 22, VNC for 5900, otherwise TCP:port).

  3. Click Add. The forward appears as

    RDP → server.example.com:3389   ↳ localhost:13000 · gw 42ms · direct

Click the entry to copy localhost:13000 to your clipboard; Ctrl+Click removes it. Forwards are saved and reconnect automatically at every start, and your own forwards are synced to your account so they follow you to your other devices.

Available in the Windows, macOS and Linux tray (macOS and Linux since 1.9.31).

Where the traffic goes

  • direct — the gateway connects to the remote host. The host must be reachable from the gateway: on the public internet, or allowlisted for the gateway's exit IP (see IP allowlisting & cloud firewall).
  • via relay — the connection goes through an organisation agent inside a LAN, for hosts that aren't reachable from the internet at all.

The tray shows the current gateway latency next to each forward.

Push forwards to every member (organisation owner)

On the organisation's Forwards tab:

FieldMeaning
LabelOptional; shown in members' trays. Defaults to host:port.
Remote hostHostname or IP the gateway (or agent) should connect to
PortRemote port, e.g. 3389
LocalLocal port on each member's machine — leave blank for auto

Forwards are delivered when members' clients refresh their policy: at startup, periodically while running, and immediately when a member clicks Refresh Policies in the tray.

Members see group forwards with a [group] suffix; they can't Ctrl+Click those away. A member's own forwards and the group's are merged, and where both target the same remote host and port, the group entry wins. (An admin-set override flag lets a member's own entry win instead; it isn't exposed in the dashboard yet — ask support if you need it.)

Connection files: RDP, VNC, SSH

For a forward on port 3389 the tray adds ↳ Save Label.rdp, which writes a pre-configured Remote Desktop file to Downloads. Built-in file templates ship for RDP (3389), VNC (5900) and SSH (22).

Organisations can customise them on the Templates tab: click + Remote Desktop (RDP), + VNC, + SSH or add a custom port, set a Type, a Filename template such as {{label}}.rdp, and the file Content. Variables available: {{host}}, {{local_port}}, {{remote_host}}, {{remote_port}}, {{label}}, {{username}}, {{username_prefix}}. Leave the content empty to inherit the built-in default. Templates override per port for every member of the organisation.

Common examples

UseRemote portConnect your client to
Windows Remote Desktop3389the generated .rdp file, or localhost:PORT
SSH22ssh -p PORT user@localhost
Internal web app80 / 8080http://localhost:PORT
PostgreSQL5432host localhost, port PORT
MySQL / MariaDB3306host localhost, port PORT

Common questions

The forward is listed but the connection times out.

For a direct forward the gateway must be able to reach the host — check the server's firewall allows the gateway exit IP. For a via relay forward the organisation agent must be online and the host listed in Shared Resources.

Can members change a group forward?

They can add their own forwards alongside it, but a group forward itself can only be changed on the Forwards tab.

Does a forward need the proxy switched on?

The forward listens locally as soon as Reach is running; traffic still needs a reachable gateway (or agent) to complete the connection.