Oplon Secure Access Minimum Requirements
This page describes everything needed to install and publish the Oplon Secure Access Virtual Appliance: machine sizing, the public name the service is delivered on, the firewall ports to open, and the disk space to plan for session recordings.
Hardware requirements
Minimum specifications of the virtual machine:
| Component | Specification |
|---|---|
| Operating System | Debian 12 (recommended) or Debian-based distribution |
| CPU | 4 cores |
| RAM | 8 GB |
| Disk space | 70 GB |
| Network cards | 1 |
The 70 GB cover the operating system and the platform. Space for session recordings must be added on top: sizing is covered in Storage estimation.
Network flows at a glance
The appliance acts as a gateway: it receives user connections from the Internet and turns them — after authentication and authorization — into connections towards the protected resources on the internal network. No backend resource is ever exposed directly.
Arrows show who opens the connection: on the left the inbound traffic towards the appliance, on the right what the appliance generates towards the outside and towards the systems it administers.
Publishing the service: FQDN and certificate
Oplon Secure Access is delivered to end users through the browser and through the Oplon Client. This requires a dedicated
public FQDN for the service (for example osa.company.com) meeting three conditions:
- Public DNS resolution: the name must be resolvable by Internet DNS and point to the public IP address the appliance is reachable on, either directly or through NAT/perimeter firewall.
- Inbound port 443: this is the port users reach the portal on, and the one the Oplon Client establishes its channels on.
- A valid SSL/TLS certificate for that name, issued by a CA trusted by browsers.
The certificate can be obtained in two ways:
- uploading it manually (a purchased certificate, or one issued by an internal CA) — see Certificates management;
- issuing and renewing it automatically with ACME/Let’s Encrypt — see ACME SSL certificates. In this case inbound port 80 is required as well, used by Let’s Encrypt for domain validation.
Without a resolvable public FQDN user access does not work: MFA authentication redirects the browser to super.oplon.cloud and then back to the appliance, so the name must stay reachable from the user’s workstation for the whole login flow.
If access is expected from the corporate network only, the FQDN can be resolved by an internal DNS, as long as the certificate for that name stays valid. Publishing on the Internet remains necessary for remote access scenarios, which are the typical use case of Secure Access.
Ports and firewall rules
Inbound, towards the appliance
| Source | Protocol / Port | What it is for |
|---|---|---|
| End users (Internet) | HTTPS 443 | Secure Access portal, RDP/SSH/VNC sessions in the browser, Shared Folders and Trusted Connections of the client |
| Let’s Encrypt | HTTP 80 | Only when certificates are issued through ACME |
| Administrators (internal network) | HTTPS 4444 | Administration console, https://<ip-address>:4444 |
Port 4444 is the administration console: expose it only to the internal network or to a management network, never to the Internet.
When using Trusted Connections, the port of the dedicated Layer 4 tunneling listener (the value set in tc listener PORT) must be open as well, and reachable from the workstations running the Oplon Client. Listener configuration is described in Trusted Connections on Oplon ADC.
Outbound, towards backend systems
The appliance must be able to reach the protected resources on their respective administration services:
| Destination | Port | Notes |
|---|---|---|
| SSH (Linux/Windows) | 22 | Terminal access |
| RDP / XRDP | 3389 | Remote desktop and Remote Apps |
| VNC | 5900 | VNC remote desktop |
| SFTP / File Manager on RDP or VNC resources | 22 | Requires OpenSSH Server installed on the resource |
| Oplon Analytics | 5993 | Only when reporting data is sent to Analytics |
Outbound, towards the Internet
| Destination | Port | What it is for |
|---|---|---|
super.oplon.cloud | 2443 | MFA authentication |
| HTTPS (generic) | 443 | Updates, licensing, revocation checks (CRL/OCSP) |
| HTTP (generic) | 80 | ACME certificate issuance and renewal |
To restrict the opening on port 2443 to super.oplon.cloud only, the firewall must support FQDN-based rules. If it only supports rules by IP address, outbound traffic on 2443 must be allowed towards any destination — see the MFA Setup prerequisites.
On the user workstations
Workstations need no particular configuration for browser access. Users of the Oplon Client
(Shared Folders and Trusted Connections) must be able to reach, over HTTPS, the appliance FQDN and download.oplon.net,
used for the version compatibility check. Details are in
Oplon Client › Network.
Default access credentials
Initial access to the web console:
- Username:
root - Password:
!1AdminAdmin
Change the default credentials at first login, using the oplonsetup command.
Minimum password complexity requirements:
- at least 1 digit
- at least 1 uppercase letter
- at least 1 lowercase letter
- at least 1 special character
- minimum length of 8 characters
Storage estimation — session logs
Video sessions (RDP, VNC, Browser Isolation) are recorded as a continuous graphical stream. The figures below are based on standard office activity (web browsing, documents, graphical terminals); sessions with heavy graphical activity (video playback, live dashboards, rendering) may exceed these values. SSH sessions, recorded as pure text streams, have a negligible footprint.
All other logs (machine access, file transfers, trusted connections, shared folders) are simple database entries and do not significantly impact storage.
| Session type | Resolution | Activity | Estimated per hour |
|---|---|---|---|
| RDP / VNC / Browser Isolation | 3840×2160 (4K) | Standard office | ~500 MB/hr |
| RDP / VNC / Browser Isolation | 3840×2160 (4K) | Heavy graphics | ~1–2 GB/hr |
| RDP / VNC / Browser Isolation | 1920×1080 (FHD) | Standard office | ~125 MB/hr |
| RDP / VNC / Browser Isolation | 1920×1080 (FHD) | Heavy graphics | ~250–500 MB/hr |
| SSH (text stream) | — | Any | ~11 MB/hr |
| Access logs, file transfer, shared folder | — | — | DB entries (negligible) |
Recording paths, free space thresholds and retention days are configured in Secure Access > Settings > General Settings — see SSH and RDP session recording.