Remote desktop without port forwarding

At home and in most offices, all your devices share one public internet address, the one your router has (our What's my IP address tool shows yours). Inside, each device has a private address, like 192.168.1.20. Your router keeps track of which device asked for what, so replies to outgoing requests find their way back to the right device. This is called network address translation, or NAT.

The catch is that the router only knows where to send traffic it was expecting. When a connection arrives from the internet out of the blue, the router has no idea which device it's for, so it drops it. That's great for security, but it means another computer can't just dial in to your PC. Many internet providers go further and share one public address between many customers, so even the router itself can't be reached from outside. That's common on mobile and satellite internet; see remote access behind CGNAT, 4G/5G and Starlink.

Port forwarding is a rule on your router: "send anything arriving on port X to this PC." It lets a remote desktop connection reach your PC, but it has real downsides:

• Anyone on the internet can now knock on that port, not just you. Automated scanners look for open remote desktop ports around the clock and try passwords against them.
• Your PC's own sign-in becomes the only thing standing between it and the internet, so a weak password or an unpatched service is directly exposed.
• It breaks easily: a new router, a changed private address or a provider that shares public addresses, and it stops working.
• Setting it up means logging in to the router, which many people understandably don't want to touch.

A VPN avoids exposing the PC, but it's another thing to set up and keep running, on the router or a server, and on every device you connect from.

Routers happily allow outgoing connections; that's how you browse the web. RemoteAccessApp uses that. Both ends connect out to the RemoteAccessApp relay, and the relay joins the two connections together. Nothing needs to accept a connection from the internet, so there's no port to forward and nothing new to scan.

1. 1

   Step 1: The PC checks in

   The RemoteAccessApp Agent on the PC keeps an outgoing connection to your account, so it shows as online.

2. 2

   Step 2: You ask to connect

   Your Console, or the website in your browser, asks the relay for that PC. The relay checks it's in your account.

3. 3

   Step 3: The PC decides

   Unless unattended access is on for your console, the person at the PC is asked to allow the session. Nothing is shown until they do.

4. 4

   Step 4: The relay passes data along

   Once allowed, the relay forwards the session between the two ends until you disconnect.

From the RemoteAccessApp app, no. The session is encrypted end to end between your Console and the PC. The relay only forwards encrypted data it can't read, and nothing in the session is recorded.

In a web browser, it's different. Our website acts as your console, so it decodes the picture in memory to show it in your browser. The connection is still encrypted all the way, and the website never records or stores the session, but it isn't end to end. When that matters, use the Console on Windows. The details are in your data, in plain English and on the security page.

PCs set up for local-network access can connect directly on your network, without going through the relay at all. That keeps working even if our servers are having a bad day, and the status page tells you if they are.

There's nothing to configure on your router. Install RemoteAccessApp on the PC you want to reach, add it to your free account, and open it from your other PC or a browser. The full walkthrough is in how to access your PC remotely for free. If you already forwarded a remote desktop port for an older setup, consider closing it once you've switched, and use our open port checker to confirm it's closed.