Browser terminals and RDP sessions are opened by the Shellius backend, not by the user's machine. Put Shellius inside the private network, expose only its web interface, and people can reach 10.x hosts from anywhere.

• Connection Shellius opens for you
• Connection your own machine opens
• API call

With Shellius inside the private network, a browser session needs no VPN: your laptop only ever talks to Shellius. The terminal client connects from your laptop, so your laptop needs its own route.

1. Place Shellius inside the network

Run the stack on a machine that can reach your hosts on port 22 (and 3389 for RDP). Verify from inside the backend container, not from your laptop:

docker compose -f docker-compose.prod.yml exec backend sh -lc 'nc -vz 10.0.0.5 22'

2. Expose only HTTPS

Publish port 443 through your reverse proxy, and nothing else. See Ports and firewalls.

3. Let hosts reach Shellius

Each bootstrapped host calls the Shellius API over HTTPS on every login. Inside one network this usually just works; across segments, allow it.

What this does and does not give you

It does remove the need to give every user a VPN account for shell and desktop access.

It does not make the terminal client work from outside: shellius connect runs ssh on the user's machine, which still needs its own route.

You are concentrating trust

On browser routes Shellius terminates the session, which is what makes recording possible — and means a compromised Shellius host can observe those sessions. It is now your most sensitive machine. Work through the hardening checklist, and put SSO and two-factor in front of it.

Next steps

Network reachabilityThe full explanation, route by route.Single sign-onProtect the one door you just opened.Threat modelWhat a compromise of Shellius would mean.