Firewalls, ports and proxies
Filemote makes outbound connections only. Nothing dials in to your machine, so there is nothing to forward on a router and nothing to open on a home firewall. If a network is blocking Filemote, it is blocking the way out, not the way in.
The connections that exist
| From | To | Port | What for |
|---|---|---|---|
| The agent | api.filemote.com | 443 (HTTPS) | Everything: listings, transfers, AI relay |
| Your browser | filemote.com, api.filemote.com | 443 (HTTPS) | The web app |
| The AI service | Nothing outside | — | It listens locally only |
The AI service uses port 8765 on the machine itself. That is a loopback port, not a network one: nothing outside the machine can reach it, and it does not need a firewall rule. It matters only when something else on the same machine has already taken the port, which is covered in the AI does not load.
One address, one port
Filemote is a hosted service. The agent comes set up to reach api.filemote.com on port
443 — the port every HTTPS website uses — so there is no port to choose and nothing to
look up.
If you changed the server address in the agent settings while experimenting, put it back. An address that is not Filemote's looks exactly like an offline device, because that is what it is.
Testing from the machine that runs the agent
Test from the machine itself — not from your laptop, and not from a phone on a different network:
curl -sS -o /dev/null -w '%{http_code}\n' https://api.filemote.com/health
A status code means the way out is open. A timeout or a connection error means it is not, and the agent will not do any better.
On Windows, Test-NetConnection api.filemote.com -Port 443 answers the same question.
Corporate networks
This is where blocks actually happen. In order of likelihood:
- An outbound filter by hostname. Port 443 is open almost everywhere, but some networks
allow only an approved list of sites.
api.filemote.comthen has to be on it. - A proxy that requires authentication. The agent connects directly and does not read a system proxy configuration, so a network that only allows proxied traffic will block it.
- TLS inspection. Some networks terminate and re-sign TLS with their own certificate. Whether that works depends on the machine trusting that certificate.
What to ask your network administrator for is small and specific: allow outbound HTTPS
(TCP 443) to api.filemote.com for this machine. No inbound rules, no port forwarding, no
DMZ.
Home networks
Almost nothing to do. The agent works behind an ordinary router untouched, because it initiates the connection.
Two exceptions worth knowing:
- Some security suites intercept outbound connections and may prompt the first time. Allow
FilemoteAgent. - A guest network that isolates clients still allows outbound internet, so it is usually fine.
What is not needed, ever
- Port forwarding.
- A static IP or dynamic-DNS name for the machine running the agent.
- An inbound firewall rule.
- A VPN between you and your own machine.
If a guide tells you to do any of these for Filemote, it is not describing Filemote.
When it still will not connect
Work down the device shows as offline — network problems are its third item, and the two above it are more common.
Updated 2026-10-16