# Run Agent behind firewall

**URL:** <https://community.jenkins.io/t/run-agent-behind-firewall/3102>\
**Category:** Ask a question\
**Tags:** question\
**Created:** [July 20, 2022, 6:35am UTC](https://community.jenkins.io/t/run-agent-behind-firewall/3102 "2022-07-20T06:35:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MarkLFT](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/marklft/32/1895_2.png) [@MarkLFT](https://community.jenkins.io/u/MarkLFT)\
**Post date:** [July 20, 2022, 6:35am UTC](https://community.jenkins.io/t/run-agent-behind-firewall/3102/1 "2022-07-20T06:35:07Z")

</div>

From what I have read about Jenkins agents, the communications channel is from the controller to the agent. Is it possible to reverse this?

I have a controller that is contactable from the internet, but the agents are behind a NAT’ing firewall, so the controller cannot call to them, I need the agent to call to the controller.

Any advice on this would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![poddingue](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/poddingue/32/985_2.png) [@poddingue](https://community.jenkins.io/u/poddingue)\
**Post date:** [July 20, 2022, 7:21am UTC](https://community.jenkins.io/t/run-agent-behind-firewall/3102/2 "2022-07-20T07:21:49Z")

</div>

Hello @MarkLFT and welcome to this community 👋

As far as I know, you’re right, communication is from the controller to the agent, and not vice-versa (at least for the ssh agent).  
As for the [inbound agent](https://hub.docker.com/r/jenkins/inbound-agent/), it looks like it can be done the other way around, that is launching the agent while telling it where the server lies…

Maybe I’m wrong, maybe not, you could give it a try.

---

<div class="post-metadata">

**Author:** ![halkeye](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/halkeye/32/8_2.png) [@halkeye](https://community.jenkins.io/u/halkeye)\
**Post date:** [July 20, 2022, 5:53pm UTC](https://community.jenkins.io/t/run-agent-behind-firewall/3102/3 "2022-07-20T17:53:28Z")

</div>

You can setup a jnlp agent. Once you create one, it’ll give you a java command to run, and that reaches out to the jenkins controller and does the handshake. It can also use websockets if you don’t want to open up a dedicate port.

The other method is ssh client style, controller reaches out to the agent, and then does the handshake thingie.

For the most part controller controls the agent,t he agent can’t impact the controller, for security reasons, but its over that dedicated channel, so you can choose which instigates it