# Usability of device agent with no direct internet connection to flowfuse cloud

**URL:** <https://discourse.nodered.org/t/usability-of-device-agent-with-no-direct-internet-connection-to-flowfuse-cloud/93708>\
**Category:** FlowFuse\
**Created:** [5 December 2024 13:30 UTC](https://discourse.nodered.org/t/usability-of-device-agent-with-no-direct-internet-connection-to-flowfuse-cloud/93708 "2024-12-05T13:30:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![BasSw](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bassw/32/96923_2.png) [@BasSw](https://discourse.nodered.org/u/BasSw)\
**Post date:** [5 December 2024 13:30 UTC](https://discourse.nodered.org/t/usability-of-device-agent-with-no-direct-internet-connection-to-flowfuse-cloud/93708/1 "2024-12-05T13:30:56Z")

</div>

When my device has no direct internet connection available but we do have an internal mqtt broker in bridge-mode with an hivemq-cloud broker as a kind of forward proxy, could this work with flowfuse cloud? Using only mqtt as connection to flowfuse cloud?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [5 December 2024 14:15 UTC](https://discourse.nodered.org/t/usability-of-device-agent-with-no-direct-internet-connection-to-flowfuse-cloud/93708/2 "2024-12-05T14:15:19Z")

</div>

Hi @BasSw

As it stands, we don't provide a way to tunnel connections via other brokers. The Device Agent needs to be able to make a connection directly back to the FlowFuse platform as described here:

> **[Installation • FlowFuse](https://flowfuse.com/docs/device-agent/install/#prerequisites)**
>
> Explore step-by-step instructions to install and configure the FlowFuse Device Agent on various platforms, ensuring seamless connectivity with FlowFuse Cloud and MQTT services.

The Device Agent needs to be able to make both an MQTT connection back to the platform as well as a WebSocket connection when the remote Device Editor is enabled.

---

<div class="post-metadata">

**Author:** ![BasSw](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bassw/32/96923_2.png) [@BasSw](https://discourse.nodered.org/u/BasSw)\
**Post date:** [5 December 2024 14:33 UTC](https://discourse.nodered.org/t/usability-of-device-agent-with-no-direct-internet-connection-to-flowfuse-cloud/93708/3 "2024-12-05T14:33:00Z")

</div>

Ok thanks for your reply, we have no need for a remote device editor so I was wondering if this websocket was an optional connection only needed for remote editor.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [5 December 2024 14:37 UTC](https://discourse.nodered.org/t/usability-of-device-agent-with-no-direct-internet-connection-to-flowfuse-cloud/93708/4 "2024-12-05T14:37:55Z")

</div>

The WebSocket connection to `app.flowfuse.com:443` is only used for the Device Editor.

The connection back to the platform for pushing updates and status info is done via MQTT over WebSockets to `mqtt.flowfuse.cloud:443`.

As mentioned in the docs, the device agent also expects to be able to run `npm install` to manage dependencies; so access to the npm registry is needed by default. It is possible to work around that part as described here: [Running the Agent • FlowFuse Docs](https://flowfuse.com/docs/device-agent/running/#running-with-no-access-to-npmjs.org)

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [5 December 2024 19:58 UTC](https://discourse.nodered.org/t/usability-of-device-agent-with-no-direct-internet-connection-to-flowfuse-cloud/93708/5 "2024-12-05T19:58:52Z")

</div>

Also each device needs to authenticate to the mqtt.flowfuse.cloud broker on it's own, so the right set of topic ACLs can be applied, this is to prevent different devices being able to interfere with each other.

The other option would be to run a FlowFuse instance on the internal network.