Access from outside your network
Applies to: the IT Admin User (network) and Workspace Admins (decision) · Time: a decision first, then about an hour of network work
Decision for your company
Your server sits inside your company network. Decide who outside that network must be able to reach it before you send the first e-signature request, publish a web form or invite people who work from home.
Who needs to reach the server
| Who | What they open | Link |
|---|---|---|
| Colleagues in the office | The whole workspace | Your web address |
| Colleagues at home, travelling or on their phones | The whole workspace, invitation and password links in emails, Huddles | Your web address |
| External signers (customers, partners) | E-signature requests | /sign/… |
| Website visitors | Lead capture forms and web inquiry (incident) forms | /f/… |
| Survey respondents with a public link | Published surveys | /s/… |
| Email recipients | The unsubscribe link in campaign emails | /unsubscribe/… |
Warning
If the server can only be reached inside the office network, these links don't open for people outside it: signers can't sign, form submissions are lost, and remote colleagues can't sign in.
Choose an option
| Option | Best for | What IT does |
|---|---|---|
| A. Office only | Everyone works on site; no outside signers or public forms | Nothing. Don't use public forms, public surveys or external e-signatures. |
| B. VPN for staff | Remote colleagues, no outside visitors | Colleagues connect to the company VPN first. Allow the VPN network to the server's ports 80/443, and TCP 7881 / UDP 7882 for Huddles. |
| C. Publish only the public pages | External signers, website forms and surveys | Your company's reverse proxy or DMZ publishes only the public paths below on a public name with HTTPS. The rest of the workspace stays inside. |
| D. Publish the whole workspace | Everyone, anywhere, without a VPN | Publish the server on a public name with HTTPS. Turn on single sign-on or strict session rules, and keep the server updated. |
B and C are often combined: staff use the VPN, and only the public pages are published.
Option C: the paths to publish
| Path | Used by |
|---|---|
/sign/ | E-signature pages and signed-document downloads |
/f/ | Lead capture and web inquiry forms |
/s/ | Public surveys |
/unsubscribe/ and /api/unsubscribe | Unsubscribe links in campaign emails, and the one-click unsubscribe button in mail apps |
/api/storage/file | The document a signer opens (each link is signed and expires) |
/_next/ and /pdf.worker.min.js | The page code, styles, fonts and the PDF viewer these pages need |
Forward these paths to the server's normal web address (port 443), keeping the original host name. Test each page from a phone outside the company Wi-Fi.
Must do
Links in emails use the Web address in Workspace settings › Mail server. With option C or D, set it to the public HTTPS name, so e-signature and survey links work for everyone.
Tip
The link for a web form is built from the address in your browser. Open Digital Workspace by its public name before you click Copy on a form, then paste that link on your website.
Never publish
- Port 3000. It is plain http and skips HTTPS. See "Security and operations checklist".
- The database or the server's own ports. Only the web ports (and the Huddles ports for VPN users) are needed.
These articles are also in the Knowledge Base on your own server, after it is updated.