Start with reachability
A direct native connection is appropriate when your device can reach the destination and network policy allows it. A relay can help when an enrolled machine can reach the destination but your device cannot. A Gateway can provide the remote protocol connection for a browser or another configured workflow.
In a Gateway web deployment, Direct network starts on the Gateway's network, whose reachability can differ from your device's. The supported installed Protected workspace requires an enrolled customer agent, an independently verified agent key and approval of the exact local device key. A Gateway address alone does not meet those prerequisites; follow the protected browser connection steps.
These choices change the network path and trusted parties. They do not remove server authentication or permission requirements.
When a session uses a Gateway, trust its operator with the protocol connection and any credentials or session data the Gateway handles. This path does not provide confidentiality against a compromised Gateway.
Configure the route deliberately
- Open the host profile and select Network & Proxy.
- Select the route approved by your administrator. Supported choices can include Direct network, HTTP CONNECT proxy, SOCKS5 proxy, and SSH jump chain · pinned hops. Each jump host needs its own authorized public key and trusted fingerprint. Relay options require their own enrollment and availability.
- Check the identities and credentials required by each hop. Never use an operator-only management credential as an ordinary client credential.
- Connect and inspect Connection Details when the result differs from your requested route.
- Test a non-sensitive session before relying on a new route for production work.
A saved preference does not prove the active route. Browser support, service availability and policy can restrict choices. Read transport selection before allowing fallback.
Local native SSH uses Direct network or an eligible enrolled device-owned route. Other route choices depend on the selected protocol and execution path; a visible label does not guarantee that the client can use it. An unavailable saved route must be reviewed before connecting. If the profile inherits its group's connection route, review the group settings as well.
Forwarding is a separate task
Choosing LeapTerm's route is different from exposing a service to other applications. Use a supported port forwarding workflow for that, and check its listener address and destination.
The managed relay is not a general-purpose open proxy. Network and destination restrictions may intentionally deny access. Ask the administrator to confirm the allowed service instead of trying different ports to bypass a denial.