Skip to main content

Remote Access

Remote access lets members of your organization visualize and teleoperate devices through the Foxglove platform. A gateway running on the device authenticates with a device token and connects out to Foxglove, so the device is reachable even when it's behind a firewall or on cellular.

Built on WebRTC, remote access is designed for real-world networks:

  • NAT traversal. The Foxglove platform provides STUN and TURN relays, so the device doesn't need inbound ports or a public IP.
  • Efficient fan-out. The gateway uploads each stream at most once to a Foxglove-managed SFU (Selective Forwarding Unit), which multicasts to every connected client.
  • Low-latency delivery. Messages flow over lossy data channels by default to minimize latency on unreliable networks. Topics that need guaranteed delivery (like static transforms) can opt into reliable delivery.
  • Adaptive-bitrate video. Image data is transcoded into a video track whose quality adapts to available bandwidth on both legs of the connection (device to SFU, SFU to client).

Setting up a gateway​

There are two ways to run a remote access gateway on a device.

Use the Foxglove SDK when you want full control over which data is published, or when working with a custom (non-ROS) robotics stack.

Use the Foxglove Bridge for a quick setup with an existing ROS 2 stack. See the bridge's remote access configuration for setup instructions.

Connecting to a device​

On the Devices page, open the detail page for a device with an active gateway and click Connect to open it for live visualization and teleoperation.

Authentication​

Foxglove brokers every connection, so the device and client never connect directly. The gateway authenticates with a device token, and clients connect through their Foxglove session. Only organization members with access to the device's Project can connect.

Encryption​

All traffic is encrypted in transit: signaling uses TLS over WebSocket, media uses SRTP over WebRTC, and data channels use SCTP over DTLS. Streams are not end-to-end encrypted, which means the Foxglove-managed SFU that fans out each stream can see the data it forwards.