FusionTermNetwork and ports
| From | To | Port | Why |
|---|---|---|---|
| People's browsers and phones | FusionTerm | 5577 (or 443 behind your HTTPS proxy) | Using FusionTerm |
| FusionTerm | Your Linux servers | 22 (or each server's SSH port) | SSH, files, tunnels |
| FusionTerm | Your Windows servers | 3389 | RDP |
| FusionTerm | guacd | 4822, inside Docker's network | RDP gateway — don't publish it |
| FusionTerm | Your identity provider | 443 | Only if you use single sign-on |
| FusionTerm | hub.docker.com | 443 | Optional daily update check |
Only the FusionTerm server needs to reach your servers — people's laptops and phones don't. That's what lets you keep SSH and RDP closed to everything except FusionTerm.
Closed networks
FusionTerm works without internet access: license keys are checked offline, fonts and help pages are built in. Turn off the update check with FUSIONTERM_UPDATE_CHECK=0; download new versions on a connected machine and move the image across with docker save / docker load.
Net Tools
Net Tools checks run from the FusionTerm server, so they need whatever network access you're testing (DNS, ICMP for ping, the ports you scan).