Network Requirements
How Remotle Connects
This page explains how a session is set up between a user’s device and a workstation. It is for IT teams who want to understand what they see in firewall logs and in the app’s Diagnostics, and for anyone deciding whether their network needs changing. It does not.
The three parties
Section titled “The three parties”| Party | Role | Sees the session content |
|---|---|---|
| Remotle client | Asks for a workstation, checks the workstation’s identity, decodes the picture | Yes, it is one end |
| Connection service | Checks the user may connect to that workstation, introduces the two ends, hands each a secret for this session | No. It never carries the picture, sound or input. |
| Relay | Forwards encrypted packets between the two ends when no direct path exists. Computle operates relays in London, New York and Canada. | No. The session is encrypted end to end between the client and the host, and the relay is never given the session keys. |
| Computle (Remotle) Host | Streams the desktop, applies input | Yes, it is the other end |
Both the client and the host connect outbound to the connection service over TCP 443 and keep that connection open. The host sends a heartbeat every 30 seconds; a host that misses heartbeats for 90 seconds is shown as offline. Because every connection is made outbound, nothing on the workstation or the user’s device listens on a port.
Setting up a session
Section titled “Setting up a session”- The request. The user picks a workstation. The client sends the connection service a token from the sign-in, which names the user and the workstation, lasts 5 minutes and can be used once.
- The introduction. The connection service checks the token, confirms the user may connect to that workstation, and allocates the session on a relay. It gives both ends the session id, the relay to use, and a secret for this session. The client is also told exactly which certificate the workstation must present.
- The race. Both ends start two paths at once. The relay path joins the relay from each end. The direct path has each end learn its own public address from a STUN server, exchange addresses through the connection service, and send probes to each other. The race lasts up to 3 seconds. The relay usually completes first, so the direct path is given a 700 millisecond head start before the relay is allowed to win.
- The checks. On whichever path completes, the two ends perform a TLS 1.3 handshake over QUIC. The client checks that the workstation’s certificate is the one the connection service named and was issued by Computle for that workstation and that organisation. Both ends then prove they hold the session secret. A relay that forwarded the packets cannot pass either check.
- The session. The first path to pass both checks carries the session. One QUIC connection carries video, audio, keyboard, mouse, pen, clipboard and USB. The host creates its virtual monitors and sends the first frame.
See Security for what each check protects against.
Direct and relay paths
Section titled “Direct and relay paths”| Direct | Relay | |
|---|---|---|
| Route | Straight between the user’s device and the workstation, over UDP | Through a Computle relay in London, New York or Canada, over UDP 4443 |
| When | When both networks let a UDP flow through after the probes, which most home and office routers do | Always available. Used when the direct path fails, or until it succeeds. |
| Latency | The lowest the network allows | Adds the round trip to the relay |
| Encryption | TLS 1.3 over QUIC, end to end | TLS 1.3 over QUIC, end to end. The relay sees encrypted packets only and applies a bandwidth cap and a duration limit to each session. |
| Shown in the app as | Direct | Relay, with the relay’s name |
A session that starts on the relay keeps trying for a direct path: 10 seconds after it starts, then 20, 40 and 80 seconds, then every two minutes. When a direct path is found it is tested for 3 seconds before it carries anything, and the session moves to it without interruption. If the direct path then goes quiet for half a second, the session moves back to the relay. For its first 10 seconds the direct path must also carry at least a quarter of what the relay carried; if it does not, the session moves back to the relay and that workstation stays on the relay from that device for 30 minutes.
Users can see which path a session is on in Connection Figures. An administrator can see what the device can reach in Diagnostics.
Which relay
Section titled “Which relay”Computle operates relays in London, New York and Canada. The connection service offers the client the relays it may use, nearest first, and the client races them. The first to complete carries the session, which is normally the nearest. One other relay is kept warm as a standby, so if the relay in use stops answering, the session moves to the standby without reconnecting.
The relays and their addresses are listed on Network Requirements.
When the network changes
Section titled “When the network changes”| Event | What happens |
|---|---|
| The device moves network, for example Wi-Fi to a phone’s hotspot | The session continues from the new address. The host recognises the same session rather than a new client, so nothing is torn down. |
| The connection to the connection service drops | Each end reconnects to it on its own. The session between the two ends is unaffected. |
| The connection service instance is unavailable | Each end moves to the next one in its list and comes back to its preferred one when that is healthy again. |
| The relay in use stops answering | The session moves to the standby relay. |
| The session is interrupted | The client holds a resume ticket, valid for 12 hours, that lets it re-establish the session without signing in again. A resumed session gets fresh secrets. |
| The workstation restarts | The host registers again when it starts. The client reconnects. |
Timings
Section titled “Timings”| Item | Value |
|---|---|
| Host heartbeat | Every 30 seconds, 90 seconds grace |
| Connection token | 5 minutes, single use |
| Path race | Up to 3 seconds |
| Direct path head start over the relay | 700 milliseconds |
| Direct path retries from a relayed session | 10, 20, 40, 80 seconds, then every 2 minutes |
| Direct path test before use | 3 seconds of answered probes |
| Relay keepalive | Every 15 seconds. A relay session with no traffic for 60 seconds is closed. |
| Resume ticket | 12 hours |
| Workstation certificate | 30 days, renewed at day 20 with a new key. See Certificates and Identity. |
Questions
Section titled “Questions”Do I need to open a port for the direct path?
Section titled “Do I need to open a port for the direct path?”No. The direct path uses the mapping your router creates when the device sends its first packet out, the same way video calls do. If your router does not allow that, the session uses the relay.
Can I force every session through the relay, or always direct?
Section titled “Can I force every session through the relay, or always direct?”Yes, on Windows and Mac, per device. Settings, Preferences, Network Path offers Auto, Prefer direct, Relay only and Relay only (TCP). See Choosing the Network Path. On Auto, which is the default, the relay is always tried, so a session connects even where the direct path fails.
Does the connection service see my screen?
Section titled “Does the connection service see my screen?”No. It carries the introduction and nothing else. Once the two ends have met, it is only used for the heartbeat and for setting up the next session.
Can Computle read a relayed session?
Section titled “Can Computle read a relayed session?”No. The session is encrypted end to end with TLS 1.3 over QUIC between the user’s device and the workstation. The relay forwards packets it cannot decrypt, and it is never given the session keys. See Security.
What does a session use when the user’s network blocks UDP?
Section titled “What does a session use when the user’s network blocks UDP?”Nothing. The session is carried over UDP on both paths, so a network that blocks all outbound UDP cannot start a session. The app’s Diagnostics shows this as Relays and STUN failing. See Network Requirements.