For teams that ship Linux boxes into customer networks
Manage Linux devices behind customer firewalls.
Run commands, open shells, and reach local services through temporary tunnels. The agent connects outbound over HTTPS—no inbound firewall rules or VPN required. Two permanent IPs. No future IP allowlist changes.
Linux · amd64 · arm64 · ARMv7
Device egress
the complete allowlist
- Host
- commandplane.com or your own hostname on Enterprise Plus
- IP
- 15.197.93.179
- IP
- 15.197.160.235
- Port
- 443/tcp
- Direction
- outbound only
- Inbound ports
- 0 required on the customer's side
Allowlist commandplane.com, or use the addresses above when fixed-IP rules are required.
Access options
Common access methods and trade-offs.
Site-to-site VPN
- Setup and approval
- Network-team approval and tunnel configuration
- Network access
- Routes between networks, scoped by firewall policy
- Activity records
- Connection logs; command and session recording need separate tooling
- Ongoing maintenance
- VPN endpoints, routing, and access policies
Jump host in their DMZ
- Setup and approval
- A managed host and an approved access path
- Network access
- Access through the jump host to permitted devices
- Activity records
- Authentication logs; session recording depends on configuration
- Ongoing maintenance
- Host patching, credentials, and access rules
Direct SSH
- Setup and approval
- An approved route and SSH credentials
- Network access
- Inbound device access from permitted sources
- Activity records
- Authentication logs; command recording depends on configuration
- Ongoing maintenance
- SSH service, keys, and firewall rules
Router port forwarding
- Setup and approval
- Router configuration and a reachable WAN address
- Network access
- A forwarded port, scoped by firewall policy
- Activity records
- Router and service logs, depending on configuration
- Ongoing maintenance
- Router rules, addressing, and exposed services
On-site visit
- Setup and approval
- Site access and scheduling
- Network access
- Local access to the device
- Activity records
- Visit notes and local tooling
- Ongoing maintenance
- Travel and repeat visits
CommandPlane
- Setup and approval
- Install the agent and approve outbound HTTPS
- Network access
- No inbound firewall rules required
- Activity records
- Command results, recorded shells, and tunnel history
- Ongoing maintenance
- Agent updates and organization access policies
| Access method | Setup and approval | Network access | Activity records | Ongoing maintenance |
|---|---|---|---|---|
| Site-to-site VPN | Network-team approval and tunnel configuration | Routes between networks, scoped by firewall policy | Connection logs; command and session recording need separate tooling | VPN endpoints, routing, and access policies |
| Jump host in their DMZ | A managed host and an approved access path | Access through the jump host to permitted devices | Authentication logs; session recording depends on configuration | Host patching, credentials, and access rules |
| Direct SSH | An approved route and SSH credentials | Inbound device access from permitted sources | Authentication logs; command recording depends on configuration | SSH service, keys, and firewall rules |
| Router port forwarding | Router configuration and a reachable WAN address | A forwarded port, scoped by firewall policy | Router and service logs, depending on configuration | Router rules, addressing, and exposed services |
| On-site visit | Site access and scheduling | Local access to the device | Visit notes and local tooling | Travel and repeat visits |
| CommandPlane | Install the agent and approve outbound HTTPS | No inbound firewall rules required | Command results, recorded shells, and tunnel history | Agent updates and organization access policies |
CommandPlane still needs an initial installation on each device and approval for outbound access.
Failure modes
When the network gets in the way.
- WebSocket blocked?
- Heartbeats and command polling fall back to HTTPS. The agent retries WebSockets in the background. Shells and tunnels wait for a WebSocket connection.
- DNS broken?
- The agent falls back to the fixed IP addresses. You can also configure it to skip DNS.
- Link drops mid-command?
- Command results are buffered locally and retried after reconnection.
- Device stops responding?
- Missed heartbeats mark the device offline in your fleet view.
Commands can use HTTPS polling. Shells and tunnels require WebSockets.
Start
Start with one real device.
$ curl -fsSL https://commandplane.com/i/CPinstall_… | sh