Qyrus Connect HLD

Qyrus Connect — High Level Overview

Qyrus Connect enables cloud-hosted test sessions to access applications that are only reachable from a customer's local or on-premises network, without opening any inbound firewall ports.

Qyrus Connect Architecture

How It Works

A lightweight Qyrus Agent runs on the customer's machine. The agent creates an outbound secure connection to the Qyrus Gateway. When a test session in Qyrus Cloud needs to reach a local or internal application, the traffic is routed through this tunnel — from the Qyrus Gateway, through the agent, and on to the target application — all without exposing any ports on the customer's side.

Key behaviors:

• No inbound network exposure — the agent connects outbound to Qyrus; nothing needs to be opened in your firewall for inbound traffic.

• No administrator privileges required — the agent runs as a regular user process.

• Supports HTTP and HTTPS traffic — including connections to internal applications, intranets, and localhost services.

• Multiple users on the same machine are fully isolated — each user session maintains its own independent tunnel.

Components

Qyrus Agent (runs on your machine)

The Qyrus Agent is bundled inside the QloudBridge application. When you click "Connect" on the Qyrus Connect page, QloudBridge automatically starts the agent in the background. The agent establishes the outbound tunnel to the Qyrus Gateway and handles all traffic routing. It runs only while QloudBridge is connected — no background service or system-level process is installed.

Qyrus Gateway (Qyrus Cloud)

The Qyrus Gateway is a cloud-hosted service that accepts tunnel connections from agents and routes test traffic through the appropriate tunnel to the right customer environment. It is designed for high availability and supports multiple active connections simultaneously.

System Requirements

Customer machine (Agent host)

Requirement	Details
Operating System	Windows 10/11, macOS, Linux
Network	Outbound internet access on port 443 to the Qyrus Gateway
Application access	The machine must already be able to reach the target local or internal application
Resources	Lightweight — minimal CPU and memory impact during normal operation

Network Requirements

• Only outbound port 443 (HTTPS/WSS) needs to be reachable from the agent host to the Qyrus Gateway.

• No inbound ports are required.

• If your organization uses a corporate proxy or TLS inspection, ensure the Qyrus Gateway hostname is trusted or bypassed. Check with your network administrator if you are unsure.

• If HTTP_PROXY or HTTPS_PROXY environment variables are set on the machine, the agent will respect them automatically.

Customer Responsibilities

Network and access

• Ensure outbound port 443 to the Qyrus Gateway is not blocked by your firewall or security software (e.g., Netskope).

• Ensure the agent host can reach the internal application or service you intend to test.

During test execution

• Keep QloudBridge connected for the duration of your test run. If QloudBridge is disconnected or closed, the tunnel is terminated and in-progress tests will fail.

• If you change your network, VPN, or proxy settings, reconnect QloudBridge to re-establish the tunnel.

Security

• The agent runs with the least privileges needed — no elevated or admin access is required.