> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/for-devops-and-administrators/automate/network-and-proxy.md).

# Use Devolutions CLI behind a firewall or proxy

Which addresses Devolutions CLI connects to, why it needs no inbound port, and how timeouts, proxies and Windows authentication work on a locked-down network.

Devolutions CLI itself makes **outgoing HTTPS requests to the Devolutions Cloud and Devolutions Server addresses you sign in to**, plus Devolutions Account for a browser sign-in to Devolutions Cloud. It doesn't wait for connections from other computers. On a locked-down network or a build agent, that's usually all you need to open.

## What Devolutions CLI connects to

<table><thead><tr><th width="220">WHEN YOU USE</th><th>DEVOLUTIONS CLI CONNECTS TO</th></tr></thead><tbody><tr><td><strong>A Devolutions Cloud context</strong></td><td>The address you gave with <code>--cloud</code>, for every command that uses this context.</td></tr><tr><td><strong>Browser sign-in to Devolutions Cloud</strong> (<code>--oauth</code>)</td><td>Also <code>https://login.devolutions.com</code>, to sign you in, renew your session, and read your profile. Devolutions CLI refuses sign-in addresses that this service returns on another host.</td></tr><tr><td><strong>A Devolutions Server context</strong></td><td>The address you gave with <code>--server</code>, for every command that uses this context, including browser sign-in. Devolutions CLI refuses sign-in addresses that your Devolutions Server returns on another host.</td></tr><tr><td><strong>A local profile context</strong></td><td>No address of its own: a local profile is read from a folder on your computer.</td></tr><tr><td><code>devo info --cloud &#x3C;url></code> or <code>--server &#x3C;url></code></td><td>That address, without a saved context.</td></tr></tbody></table>

Every connection uses HTTPS. Devolutions CLI refuses a plain `http` address unless it points at your own computer.

The telemetry preference (`devo config telemetry`) is only saved on your computer: Devolutions CLI has no telemetry connection of its own.

### Write the firewall rule

* **Allow outgoing HTTPS** from the agent or computer to the address and port of each workspace URL, and to `login.devolutions.com` if you use browser sign-in to Devolutions Cloud.
* **Allow the `devo` file** (`devo.exe` on Windows) if your firewall filters by program. The commands you type and the background process that sends most requests to your workspace are the same file. See [How Devolutions CLI works](/cli/guides/understand/how-it-works.md).
* **Open no inbound port.** Devolutions CLI doesn't need any port opened for incoming connections.

## Why no inbound port is needed

<table><thead><tr><th width="220">PART</th><th>HOW IT COMMUNICATES</th></tr></thead><tbody><tr><td><strong>Background process</strong></td><td>Over a local channel on your computer: a named pipe on Windows, a socket file on macOS and Linux. On Windows, the pipe's access rules allow your account and the system account (if Windows refuses those rules, the pipe keeps its default security); on macOS and Linux, only your account can open the socket file. Every request other than a status check must also carry the token of the current background process session. See <a href="/cli/guides/understand/platforms.md">Devolutions CLI on Windows, macOS, and Linux</a>.</td></tr><tr><td><strong><code>devo mcp</code></strong></td><td>Over the standard input and output of the <code>devo</code> process that your AI client starts. No port.</td></tr><tr><td><strong>Browser sign-in</strong> (<code>--oauth</code>)</td><td>Your browser returns to <code>devo</code> through a temporary listener on your own computer, open for at most 5 minutes. For Devolutions Cloud, it listens on <code>localhost</code>, on a port between <code>60370</code> and <code>61370</code>. For Devolutions Server, it listens on <code>127.0.0.1</code>, on a free port. Devolutions CLI refuses to start the listener if <code>localhost</code> doesn't point only at your own computer.</td></tr><tr><td><strong>Device code sign-in</strong> (<code>--oauth --use-device-code</code>)</td><td>No listener at all. Devolutions CLI prints an address and a code, and waits while you confirm the sign-in in a browser. Use it on a computer without a browser.</td></tr></tbody></table>

{% hint style="info" %}
If the ports `60370` to `61370` are all in use, browser sign-in to Devolutions Cloud can't complete. Free a port in that range, or sign in with an application key instead: a device code sign-in to Devolutions Cloud can't read your data. See [Sign in to Devolutions Cloud](/cli/guides/connect/devolutions-cloud.md).
{% endhint %}

## Set the request timeout

By default, Devolutions CLI waits up to **15 seconds** for each request. On a slow link or through a busy proxy, give `devo login` more time with `--timeout`, in seconds, from `3` to `600`:

```bash
devo login <context-name> --server https://<your-server-address> --oauth --timeout 60
```

`--timeout` applies to the requests of that `devo login` only. It isn't saved in the context: later commands wait up to 15 seconds per request. A request that runs out of time fails with `cloudRequestTimeout` or `serverRequestTimeout`. See [Sign-in fails or the session expired](/cli/help/troubleshooting/sign-in-fails.md).

## Windows authentication

With `--windows-auth`, Devolutions CLI signs in to Devolutions Server with the credentials of the Windows account that runs `devo`. You don't give a password, and the background process uses the same account. This option is available on Windows only.

## Proxies

Devolutions CLI has **no proxy option**, and doesn't set a proxy of its own.

If your network requires a proxy, check that the computer can reach your workspace address through it before you sign in, for example with `devo info --cloud <url>` or `devo info --server <url>`.

## Certificates

Devolutions CLI has no option to skip certificate validation or to add a certificate, and doesn't change how certificates are validated.

## Good to know

* A local profile context doesn't sign in to any address. See [Use a local Devolutions Remote Desktop Manager profile](/cli/guides/connect/local-profile.md).
* To see what Devolutions CLI sends, and what stays on your computer, see [What data Devolutions CLI sends](/cli/guides/understand/privacy.md).
* If a sign-in times out or the address can't be reached, see [Sign-in fails or the session expired](/cli/help/troubleshooting/sign-in-fails.md).

## Next

* [Sign in from a CI pipeline](/cli/for-devops-and-administrators/automate/ci-sign-in.md)
* [Install Devolutions CLI on build agents](/cli/for-devops-and-administrators/automate/install-on-runners.md)
* [Devolutions CLI on Windows, macOS, and Linux](/cli/guides/understand/platforms.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/for-devops-and-administrators/automate/network-and-proxy.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.