> For the complete documentation index, see [llms.txt](https://docs.qyrus.com/desktop-testing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.qyrus.com/desktop-testing/getting-started/qb-installation-and-node-registration/qyrus-connect-hld.md).

# Qyrus Connect HLD

#### Qyrus Connect — High Level Overview

Qyrus Connect enables cloud-hosted test sessions to access applications that are only reachable from a customer's local or on-premises network, **without opening any inbound firewall ports**.

![Qyrus Connect Architecture](/files/nUpd74jETL2EDY48ozvP)

#### How It Works

A lightweight **Qyrus Agent** runs on the customer's machine. The agent creates an **outbound secure connection** to the Qyrus Gateway. When a test session in Qyrus Cloud needs to reach a local or internal application, the traffic is routed through this tunnel — from the Qyrus Gateway, through the agent, and on to the target application — all without exposing any ports on the customer's side.

Key behaviors:

* **No inbound network exposure** — the agent connects outbound to Qyrus; nothing needs to be opened in your firewall for inbound traffic.
* **No administrator privileges required** — the agent runs as a regular user process.
* **Supports HTTP and HTTPS traffic** — including connections to internal applications, intranets, and localhost services.
* **Multiple users on the same machine are fully isolated** — each user session maintains its own independent tunnel.

#### Components

**Qyrus Agent (runs on your machine)**

The Qyrus Agent is bundled inside the QloudBridge application. When you click "Connect" on the Qyrus Connect page, QloudBridge automatically starts the agent in the background. The agent establishes the outbound tunnel to the Qyrus Gateway and handles all traffic routing. It runs only while QloudBridge is connected — no background service or system-level process is installed.

**Qyrus Gateway (Qyrus Cloud)**

The Qyrus Gateway is a cloud-hosted service that accepts tunnel connections from agents and routes test traffic through the appropriate tunnel to the right customer environment. It is designed for high availability and supports multiple active connections simultaneously.

#### System Requirements

**Customer machine (Agent host)**

| Requirement        | Details                                                                            |
| ------------------ | ---------------------------------------------------------------------------------- |
| Operating System   | Windows 10/11, macOS, Linux                                                        |
| Network            | Outbound internet access on port **443** to the Qyrus Gateway                      |
| Application access | The machine must already be able to reach the target local or internal application |
| Resources          | Lightweight — minimal CPU and memory impact during normal operation                |

#### Network Requirements

* Only **outbound port 443** (HTTPS/WSS) needs to be reachable from the agent host to the Qyrus Gateway.
* No inbound ports are required.
* If your organization uses a corporate proxy or TLS inspection, ensure the Qyrus Gateway hostname is trusted or bypassed. Check with your network administrator if you are unsure.
* If `HTTP_PROXY` or `HTTPS_PROXY` environment variables are set on the machine, the agent will respect them automatically.

#### Customer Responsibilities

**Network and access**

* Ensure outbound port 443 to the Qyrus Gateway is not blocked by your firewall or security software (e.g., Netskope).
* Ensure the agent host can reach the internal application or service you intend to test.

**During test execution**

* Keep QloudBridge connected for the duration of your test run. If QloudBridge is disconnected or closed, the tunnel is terminated and in-progress tests will fail.
* If you change your network, VPN, or proxy settings, reconnect QloudBridge to re-establish the tunnel.

**Security**

* The agent runs with the least privileges needed — no elevated or admin access is required.