Enterprise networks often place controls between endpoints and the public Internet.
Examples include:
- explicit proxies
- transparent proxies
- secure web gateways
- TLS inspection appliances
- application-aware firewalls
These systems can affect remFREE communication differently from ordinary browser traffic.
HTTPS success does not prove WSS success
An administrator may successfully open:
https://rmm.remfree.com
while the endpoint agent still cannot maintain its persistent connection.
That is possible because the agent uses secure WebSocket communication at:
wss://rmm.remfree.com/ws
WebSocket begins through the HTTP protocol family but then upgrades into a persistent bidirectional session.
Some security products handle that upgrade differently from an ordinary page request.
WebSocket upgrade
A WebSocket connection begins with an HTTP upgrade request.
Conceptually:
Endpoint
|
| HTTPS-compatible connection
v
Security gateway
|
| WebSocket upgrade
v
remFREE WSS service
If the intermediary rejects, alters, or prematurely closes the upgraded connection, normal web access may work while the agent repeatedly disconnects.
Long-lived sessions
Web browsing often consists of relatively short requests.
A remFREE agent connection is intentionally persistent.
Security infrastructure may have policies involving:
- connection lifetime
- idle timeout
- protocol classification
- authenticated proxy sessions
- background service traffic
These policies can affect the agent even when interactive browser traffic appears normal.
TLS inspection
TLS inspection decrypts and re-encrypts traffic through an organizational security device.
The endpoint therefore sees a certificate issued by the organization's inspection infrastructure rather than the original public certificate.
The endpoint must trust that inspection chain.
If it does not, TLS validation can fail.
WebSocket support during inspection
A TLS inspection appliance must do more than successfully decrypt HTTPS.
It must also correctly preserve the WebSocket upgrade and long-running bidirectional session.
An inspection product that treats the connection as ordinary short-lived web traffic can cause repeated disconnects.
Browser context versus service context
A web browser may have access to proxy configuration that a system service does not.
This distinction is important.
For example:
Browser
uses interactive-user proxy configuration
Background agent
runs as a service
Those processes may not inherit identical network settings.
A successful browser test therefore proves only that the browser can reach the service.
What to investigate
When the remFREE website works but the agent does not remain connected, investigate:
- whether WebSocket upgrades are permitted
- whether long-lived TLS sessions are permitted
- whether the agent execution context can use the organization's proxy
- whether TLS inspection certificates are trusted
- whether the gateway resets idle connections
- whether the remFREE hostname is categorized or filtered differently for service traffic
Do not disable security controls blindly
Troubleshooting should not begin by permanently disabling organizational security.
Instead, determine which control is affecting the communication and create the narrowest appropriate policy.
This preserves the reason the security control exists while allowing the required management traffic.
Capture evidence
Useful evidence can include:
- endpoint agent logs
- proxy logs
- firewall logs
- TLS inspection logs
- timestamps
- connection-reset messages
- certificate validation errors
Comparing timestamps between the endpoint and security infrastructure can quickly reveal where the connection was interrupted.