On-Premises Tunnel Agent: System Requirements

Published Date: October 19, 2026 | Last Updated: October 19, 2026

Overview

The on-premises tunnel agent connects Seasoft Identity to systems inside the organization’s private network. The agent runs on a server in that network and makes outbound connections only, so no inbound firewall ports are opened. This article lists the host, network, and firewall requirements the Administrator confirms before creating a tunnel agent.

Note: These requirements cover the tunnel agent only. Each integration that connects through the tunnel lists its own requirements in its integration article.

Host requirements

The tunnel agent requires 1 server. A second host can be added later for failover.

Windows Server

Operating system — Windows Server 2019, 2022, or 2025, 64-bit
Server role — a domain member server. The installer does not run on a domain controller.
OpenSSH Server — version 9.5 or later. OpenSSH Server is built in on Server 2025. On Server 2019 and 2022, the install step adds it as a Feature on Demand, which requires access to Windows Update or a Feature on Demand source such as an ISO or network share. A host managed by WSUS cannot get it through WSUS before Server 2025.
Patching — fully patched. An unpatched Server 2022 image ships an older OpenSSH, and the install fails until the latest cumulative update is applied.
Permissions — administrator rights, in an elevated PowerShell

Linux

Operating system — Linux x86-64 server running systemd: Debian or Ubuntu (apt), or Fedora or Red Hat (dnf)
OpenSSH server — the openssh-server package. It is installed automatically as a package dependency.
Permissions — root access (sudo) to add the repository and install the package

Network requirements

Direction	Requirement
Outbound from the agent host	TCP 443 to the Seasoft relay and package hosts listed below.
Inbound to the agent host	None. Every connection is outbound from the agent. Seasoft Solutions recommends no publicly reachable ports on the agent host.
Agent host to internal systems	The agent host must reach each internal system connected through the tunnel. The integration article for each system lists its ports and naming requirements.

Seasoft hosts

Hostname	Purpose
`tunnel-relay-1.seasoftsolutions.net`	Tunnel relay
`tunnel-relay-2.seasoftsolutions.net`	Tunnel relay
`api.seasoftsolutions.net`	Platform API
`packages.seasoftsolutions.net`	Agent packages

To allow all current and future Seasoft hosts, use *.seasoftsolutions.net. To restrict by IP address instead, request the Seasoft Solutions static IP addresses from Support@SeasoftSolutions.com.

Proxies

The agent connects directly to the Seasoft relays and does not support explicit forward proxies. It ignores proxy settings, including HTTPS_PROXY and the Windows system proxy. If outbound traffic normally passes through a proxy, the Administrator adds a firewall rule that allows the agent host to reach the Seasoft hosts directly. Transparent proxies are supported if they do not inspect the agent’s traffic.

TLS inspection

TLS deep inspection is not supported. The tunnel uses mutual TLS, so if a device decrypts and re-signs the traffic, the agent rejects it and the connection fails. The agent’s traffic must be exempt from deep inspection.

To keep the exemption narrow, scope it to:

Source — the agent host only
Destination — the Seasoft hosts above, or the Seasoft Solutions static IP addresses
Port — TCP 443, outbound only

Certificate inspection can remain enabled, so the firewall still logs and verifies the destination. Hybrid identity agents such as Microsoft Entra Connect have the same requirement.

Active Directory — connect an on-premises Active Directory domain controller
Configuring Integrations — manage sync schedules, drift detection, and integration settings