Inside-outside

[sbeaver28]

In an ideal world I would like the Meshcentral GUI to be available only to users within my LAN, agents to be able to connect from the LAN or the WAN (Internet) AND devices to be able to be provisioned (install the agent via the install script) from the Internet.

I can use the "agentport" setting and a firewall rule to allow only agents to connect from the internet and prevent access to the GUI but now of course Internet users cannot access the files required to setup the agent on a new device.

Is there any solution to this? A third port setting to access the installers for example?

[JSuenram]

Not inside MeshCentral I guess, but if you place the Agents on a separate Webserver for Download that might help in your scenario.

[folosleg]

There is some config options for you. These are both valid as a global option or per domain.
Check the documentation for details.

"userAllowedIP": { "type": [ "string", "array" ], "default": null, "description": "When set, only users from allowed IP address ranges can connect to the server. Example: \"192.168.2.100,192.168.1.0/24\"" },
"userBlockedIP": { "type": [ "string", "array" ], "default": null, "description": "When set, users from these denied IP address ranges will not be able to connect to the server. Example: \"192.168.2.100,192.168.1.0/24\"" },
"agentAllowedIP": { "type": [ "string", "array" ], "default": null, "description": "When set, only agents from allowed IP address ranges can connect to the server. Example: \"192.168.2.100,192.168.1.0/24\"" },
"agentBlockedIP": { "type": [ "string", "array" ], "default": null, "description": "When set, agents from these denied IP address ranges will not be able to connect to the server. Example: \"192.168.2.100,192.168.1.0/24\"" }