Network Access & Routing
An Agent can make internal storage and services available to Files.com without a public inbound listener. Optional Direct Transfers and connection routing change how that access works. Network administrators should approve the enabled capabilities as well as the connection to Files.com.
Standard Connection
The Agent initiates an encrypted outbound connection to Files.com. It verifies the identity of the Files.com services using public-key cryptography; reaching a particular hostname is not the only identity check.
The standard connection does not require opening an inbound port on the Agent host. It carries authorized file operations and management requests, so outbound-only connectivity still delegates meaningful access inside your environment.
Permit the destinations required by the deployment requirements. Review separate access needed for software downloads, name resolution, and any destinations reached through Agent routing.
Direct Transfers
Direct Transfers are disabled by default. Enabling them adds an inbound encrypted listener so supported clients can transfer file data directly to the Agent.
Files.com still authorizes each transfer. The direct connection requires a signed, expiring transfer URL for the permitted operation and path; enabling the listener grants no additional file permissions.
Clients verify the Agent's advertised certificate identity. Network equipment that substitutes a different certificate can prevent a direct connection, causing supported clients to use the standard route instead.
When Direct Transfers are enabled, automatic router port mapping through UPnP or NAT-PMP is enabled by default. Set direct_transfer_upnp to false if your network team must manage forwarding explicitly, and review any mapping already created when changing the deployment.
Restricting Client Addresses
Direct Transfer allow and block lists control which network addresses may connect. A blocked address takes precedence over an allowed one. Files.com's own addresses are allowed automatically unless blocked.
With an empty allow list, every unblocked client address is eligible. With a configured allow list, other client addresses must be listed. These rules use the address the Agent observes; a proxy or load balancer that replaces client addresses can make several clients appear to have the same address.
A complete transfer URL is usable by its holder until expiration; it is not bound to the original requester's IP address. The address lists provide a separate connection restriction. See File Transfer Authorization for that distinction.
Routing Connections to Internal Services
Agent routing lets Files.com reach Remote Servers through the Agent host. This can reach private services that Files.com's cloud network cannot contact directly.
The Agent's integrations setting enables supported connection types. An enabled type, such as SFTP, is not a list of approved destination hosts. Files.com permissions determine who can configure and use the routed connection; host network rules and destination credentials determine what it can reach and do inside your environment.
Restrict outbound access from the Agent to the destinations the deployment needs, and use destination accounts with limited permissions. The Agent's local file root does not restrict which remote services routing can reach.
Verify the destination's identity using its applicable certificate or SFTP host-key checks. Encryption between Files.com and the Agent does not add encryption to an unencrypted protocol on the remaining connection from the Agent to the destination.
Routing capability can also be affected by supported remote configuration. If local network approval requires fixed destinations or prohibits routing, enforce that boundary with host or network controls as well as the Agent configuration.