Private Access to an Internal Web Dashboard

Summary

Run the Localport agent on the server that hosts the dashboard, allow its port as an HTTP port on a fleet device, and open it on your own computer through localport access. The dashboard never gets a public address. Each person who opens it is identified by a certificate and a grant, and each session is recorded. Available on the Pro, Business and Enterprise plans, see pricing.

What you will have at the end#

An engineering team runs two internal web tools on servers in a private network:

Grafana on metrics-01, port 3000.
An admin panel on admin-01, port 8080.

A member of the team runs one command:

localport access metrics-01-acme-internal.eu.localport.dev -L 3000:3000

Grafana then opens at http://localhost:3000 in their browser. Nobody outside the team can reach either tool, because neither has a public address, and the servers accept no inbound connection from the internet.

Before you start#

You need:

A team on the Pro, Business or Enterprise plan. Remote Access is not available on other plans.
The owner or admin role to create the fleet and write grants.
Shell access to each server that hosts a dashboard, or to another machine on its network.
The Localport agent on each server and on each person's computer, from Installation.

Why not a public URL with a password#

A Localport tunnel gives an app a public HTTPS address, and Basic Authentication or an IP allowlist can guard it. That suits a preview you send to a client. For a tool your team uses every day, it leaves two weaknesses:

The address is public. Anyone who finds it can try the password.
A shared password does not say who used it, and changing it locks out everyone at once.

Remote Access works differently. The dashboard's device has no public address. Each person holds their own client certificate, a grant decides which dashboards they reach, and removing their access closes their sessions without touching anyone else's. Detailed explanation: Remote Access.

Make the dashboard reachable#

Step 1: Create the device with an HTTP port#

In the dashboard, go to Fleets and click Create fleet. Name it Internal, choose a Region, and click Create Fleet. Open the fleet's Settings, enter acme-internal in Subdomain and save.

The sheet moves to Create device & Connect. Enter metrics-01, add port 3000 with protocol HTTP, and click Create device. Create admin-01 the same way with port 8080 as HTTP.

Grafana's port, allowed as HTTP so the access log also counts its requests.

HTTP suits a web tool that speaks plain HTTP. Localport then reads each request inside the session, and the access log counts requests and response classes for it. A tool that serves its own HTTPS belongs on a TCP port, which carries the encrypted stream unchanged. Detailed guide: Fleets.

Step 2: Run the agent on the server#

On metrics-01, run the command from the Create device & Connect sheet, with 3000 in Allowed ports:

localport connect --token tok_YOUR_FLEET_TOKEN --region eu --name metrics-01 --allow-ports 3000

The device turns online on the Devices tab within seconds. --allow-ports 3000 keeps this server to Grafana's port, whatever the dashboard allows later.

For a server, run the agent as a systemd service so it starts at boot and reads the token from a file only the service can read. Follow Run the agent as a background service and use the command above, without --token, as the unit's ExecStart=.

When the tool runs where the agent cannot, such as a managed appliance or a container you do not control, run the agent on another machine on the same network and add --host with the tool's address, for example --host 10.0.4.12. Connections are then delivered to that address.

Step 3: Grant your team access#

Open the fleet's Access tab and click Give access:

Type: Role for everyone in a role, or Member for one person.
Who: the role or the person.
Access: choose the devices, such as metrics-01, or leave All devices on for every dashboard in the fleet.

Then click the Give access to button, which names who you chose.

The Give access sheet: type, then who, then access. Grant each tool to the people who use it.

Keep tools with different audiences on different devices. A grant reaches every port allowed on a device, so the admin panel stays on its own device with its own grants. A role grant covers that role only, so owners and admins who also connect need a grant of their own. Detailed guide: Grants and Access.

Open the dashboard#

localport login

Open the link it prints, sign in, choose the team if asked, check that the code matches and click Sign in. The certificate is created on your computer, lasts 8 hours and does not renew. Detailed guide: Member Access.

Step 5: Forward the port and open it in a browser#

On the Devices tab, click Access on the metrics-01 row. The Connect over mTLS sheet builds the command from the device's ports. Click Copy command and run it:

localport access metrics-01-acme-internal.eu.localport.dev -L 3000:3000

Leave it running, then open http://localhost:3000. The forward listens on your computer only. Requests reach Grafana through the agent on metrics-01, and the browser treats localhost as a secure origin.

If port 3000 is busy on your computer, choose another local port, such as -L 13000:3000, and open http://localhost:13000.

Step 6: Open several dashboards at once#

List every tool you use in an access config file:

version: 1

access:
  - device: metrics-01-acme-internal.eu.localport.dev
    forward: ["3000:3000"]
  - device: admin-01-acme-internal.eu.localport.dev
    forward: ["8080:8080"]

localport access --config access.yaml

Each local port must be unique in the file. Grafana opens at localhost:3000 and the admin panel at localhost:8080. Detailed guide: CLI.

Make the app work behind a forward#

The app receives each request as if it came from a browser on its own machine:

The Host header is the one your browser sends, such as localhost:3000. Localport passes it through unchanged. An app that refuses unknown host names needs localhost on its list.
Requests arrive as plain HTTP. On an HTTP port, Localport delivers each request to the app over HTTP. The hop across the internet is encrypted by the connection between your computer, Localport and the agent.
Links the app builds use its configured address. Grafana writes links from root_url. With the default, http://localhost:3000/, its links work through a forward on the same local port. Set it to match if you forward to a different one.
Cookies stay on localhost. Sign-in sessions for the app work as they do on a developer's machine. Two apps forwarded to different local ports share the localhost cookie jar, so give them different session cookie names if both set one.

Tips#

A shared jump box for a team without the agent

On a machine that several people already reach, such as a bastion host, the Reachable from the whole network switch in the Access sheet makes the forward listen on every interface. Anyone who can reach that machine can then open the dashboard without a certificate of their own, and the access log records every session under the jump box's identity. Use it only on a host you control, and keep it off on a laptop.

A wall display or a kiosk browser

A monitor showing a Grafana board all day needs access that does not end every 8 hours. Give the display's computer a machine identity: in Identities, open Setup keys, click Create setup key, choose Server or machine, and grant that identity the dashboard. Run localport setup lps_YOUR_SETUP_KEY once on the display's computer, then run the forward as a service. Its certificate renews in the background. Detailed guide: Setup Keys.

Read a dashboard's API from CI/CD

A pipeline that queries an internal API, for example to annotate Grafana after a deploy, can prove its identity with OIDC and hold no stored secret. Create a binding, grant it the device, and run localport access <device-address> --audience lpa_YOUR_AUDIENCE -L 3000:3000 in the job. Detailed guide: CI/CD with OIDC.

A contractor who needs one tool

Give them a Member grant naming that device only. Grants have no end date, so remove it when the work is done. Removing it closes their open sessions at once.

How long a session lasts#

A browser session through the forward stays open while your 8-hour sign-in is valid, the server's agent stays connected and your grant stands. Removing your grant closes it at once. The forward reconnects by itself when you open a page after a pause. The full list: How long a session lasts.

Troubleshooting#

Message or symptom	Cause	Fix
`refused this certificate: check that the identity has access to the device`	No grant covers you and this device, your certificate was revoked, or it belongs to another team.	Check the fleet's Access tab, then run `localport identity list`.
`not allowed: check this identity's access to the device, and that port 3000 is open on it`	Port 3000 is not allowed on the device, or `--allow-ports` on the server leaves it out.	Check the device's ports and the agent's `--allow-ports`.
`nothing is listening on port 3000 on the device`	The tool is not running, or it listens on another port or address.	Start the tool, or check its port and that it listens where the agent delivers.
`rejected the certificate as expired`	Your 8-hour sign-in ended.	Run `localport login`, then start `localport access` again.
The page loads but links point at another address	The app builds links from a configured public address.	Set the app's base URL to the local address you forward to.
The app refuses the request with a host error	The app accepts only listed host names.	Add `localhost` to its allowed hosts.

Limitations#

Every person runs the agent. A browser alone cannot open a fleet device. Each person runs localport access on their own computer, or uses a shared jump box.
A grant covers every port allowed on a device. Tools for different audiences belong on different devices.
Sign-in sessions end at 8 hours. Use a setup key for a machine that keeps a dashboard open.
TCP and HTTP only. UDP is not carried.

Frequently asked questions#

How do I access an internal dashboard without a VPN?

Run the Localport agent on the server that hosts it, allow the dashboard's port on a fleet device, and grant your team access. Each person then runs localport access <device-address> -L 3000:3000 and opens http://localhost:3000. The server connects outward on port 443, so it needs no inbound firewall rule and no public address.

Should I use an HTTP or a TCP port for a web dashboard?

HTTP for a tool that speaks plain HTTP, which also adds request counts and response classes to the access log. TCP for a tool that serves its own HTTPS, which Localport then carries unchanged.

Can someone open the dashboard if they find its address?

No. A fleet device has no public address that answers a browser. Every connection needs a client certificate from your team and a grant for that device, and a connection without them is refused before it reaches the server.

Does Localport see what is on the dashboard?

Localport carries the requests between your computer and the server and does not record their content. On an HTTP port it reads each request to count it, and the access log keeps the count and the response class only, never paths, headers or bodies.

Can a TV or kiosk display a dashboard all day?

Yes. Give the display's computer a machine identity with a setup key, grant it the device, and run the forward as a service. Its certificate renews in the background.

What happens when someone leaves the team?

Removing them from the team revokes their sign-in certificates and deletes their individual grants. Their open sessions close at once, and nobody else's access changes.