Different Agent Port for different Device Groups

[geg-ck]

Greetings,
Is it possible now or could it be a feature request for future to allow creating installer Agents that use different ports for different Device Groups? We have a server in one subnet that is separated from a different subnet by a firewall. For machines inside the same subnet the default agent port connection works fine. For machines in the subnet on the other side of the firewall we use a the agent alias port and the firewall forwards the traffic appropriately. However, when downloading the installer the agent is configured to use the alias port regardless of the device group. For now we have to install, stop the agent, edit the .msh to change the port and then restart. Would be handy if we could, maybe in the Device Group setup, enter the port number or alias port to use for Agent connections. Then when the Agent is downloaded it's already configured to use that port.

[si458]

No we have no interest in creating different port numbers for different groups as that would confuse everything.
However the install port being wrong sounds to me like a bug!?
Can u share ur config.json? Hide secret stuff and ill try replicate.
Is it the windows agent that gets the wrong port? Or the Linux setup? Or both?
Also are u running the latest meshcentral? 1.1.20?

[geg-ck]

The agent isn't getting the wrong port. We just want to have two different ports for "in subnet" coimputers and "out of subnet" laptops. In the config.json we have the agent port and alias port set. Agent port for the in subnet and alias port for the out of subnet machines. When the agent is downloaded it is always configured to use the alias port. Which is fine for the out of subnet laptops as their traffic is passed through our firewall and the firewall changes the port to the agent port on the server. This all works well. But, computers in the same subnet as the server need to be set to the real agent port not the alias port as their traffic isn't passing through the firewall. For now, when we install the agent on an "in subnet" computer, we stop the agent, manually edit the .msh file, change the port number, then restart the agent. Just extra steps.

If there were a way to override the alias/agent port during the agent install, that would be fine too. ala:

meshagent -fullinstall --agentport:####

Unless this is what the --WebProxy="" is for?

I know our setup is a little unconventional.

[si458]

Ah right yeh that makes sense! Yeh sadly at the moment that won't be possible as it would require a database change.
Just wondering why the agents inside ur network can't access the alias port, but the ones outside can? Can you not just open the alias port up inside ur network?

[geg-ck]

The agent and the server don't see each other when on the same subnet.

My understanding from the documentation is that when using the Alias port setting, a the firewall in between needs to do port mapping. But, when traffic is local, not passing through the firewall, there is no port mapping thus the agent and server cannot communicate.

15. Server port aliasing
    In some cases, you may be setting up a server on a private network that uses non-standard
    ports, but use a router or firewall in front to perform port mapping. So, even if the server privately
    uses non-standard ports, the public ports are the standard ports 80 and 443. You have to tell
    MeshCentral to bind to private ports but pretend it’s using the other standard ports when
    communicating publically.

Like I said, everything is working. Agents local to the server use the agentPort # and agents on the other side of the firewall use agentAliasPort #. The firewall rule changes the agentAliasPort # to the agentPort #.