Skip to main content

Access to an internal website

With oneclick™ Web Shield, you provide an internal website or Web App in an isolated session. For this setup, you need a Web Shield license and a destination system that is already connected to oneclick™. The article App license describes how to request the license. The oneclick™ Secure Browser does not reach internal websites.

Prerequisites
  • The destination system is connected through VPN IPsec or oneclick™ Mesh, and the connection is established.
  • The destination system contains the internal IP address of the web server and all ports the Web App uses. If it redirects from HTTP to HTTPS, this includes ports 80 and 443.
  • For VPN IPsec, you do not need to change your DNS for Web Shield. If your firewall filters the tunnel by port, it must allow the ports of the Web App.

Create an app configuration​

  1. Click Apps in the menu, and then click App configurations.
  2. Click the Plus icon. “App configurations” menu item under “Apps” with the Plus icon for creating an app configuration
  3. Select your Web Shield license and click Next. License selection with the license “App - Web Shield” highlighted and the “Next” button
  4. Select the configuration type Internal website / app. If the option does not appear, you did not select a Web Shield license in step 3. You cannot provide internal websites with an App - Standard license. Selecting the configuration type with the “Internal website / app” option selected
  5. Under Destination(s), select the already connected destination system with the port of the internal web service and click Next. Users cannot change the destination system of this app.
  6. Enter a Name for the app configuration.
  7. If required, add Tags.
  8. Under URL, oneclick™ automatically applies the hostname or IP address and the port of the selected destination system and preselects the matching protocol (port 443: HTTPS, otherwise HTTP). Check the protocol and, if required, add the path of the internal website. With VPN IPsec, Web Shield only reaches the destination system and its ports, see Internal hostname with VPN IPsec. With oneclick™ Mesh, Web Shield resolves a hostname set on the destination system via public DNS, see Troubleshooting.
  9. Under Login when starting the app, specify how users can use their login data:
    • Allow login data to be entered when starting the app: Users can enter their login data when starting the app.
    • Allow saving of login data: Users can save their login data.
      Enabled options “Allow login data to be entered when starting the app” and “Allow saving of login data” If users are to enter their credentials themselves when starting the app, leave the fields for user name and password empty during the app assignment.
  10. Under Usage settings, enable the Customize option and then configure the desired settings. Users whose user license includes the oneclick™ Desk can adjust approved usage settings themselves. This requires Edit app settings (login data, access and app-specific settings) to be enabled on the app tile. To do this, enable Changeable by the user for the desired options. For more information, see Changeable by the user.
  • Connection options:
    Enable or disable the desired connection functions:
    • Redirect audio from remote to local system: Transfers the sound of the Web Shield app to the local device.
    • Redirect audio from local to remote system: Allows the local microphone to be used in the Web Shield app.
    • Webcam redirection: Allows users to use their local webcam in the Web Shield app. The option is available if the Web Shield license includes the Webcam redirection add-on.
    • Clipboard redirection: Allows text and images to be copied and pasted between the local device and the Web Shield app in both directions. Users transfer files via file transfer. Enabled “Customize” option under “Usage settings” with the connection options for audio, webcam, and clipboard
  • oneclick™ Streaming (Browser):
    • Compatibility mode (disable WebRTC): Enable this option to disable WebRTC for the streaming connection.
    • Session-only file storage for users without oneclick™ Hybrid Drive: Provides users without oneclick™ Hybrid Drive with temporary file storage that only exists until the end of the session. Printing, uploading, and downloading only work with oneclick™ Hybrid Drive or with this option. If neither is available, there is no printer and no Upload data button, and downloads do not arrive on the local device. The option is disabled by default.
    • Website access: Specify which websites users are allowed to open:
      • No restriction: Allows access to other websites.
      • Allow only these addresses: Allows access exclusively to the entered addresses.
      • Allow all addresses except these: Blocks access to the entered addresses.
        For the last two options, enter the desired addresses in the Addresses, one per line field. example.com includes all subdomains, .example.com only the domain itself. With Allow only these addresses, the start address of the app always remains allowed. With Allow all addresses except these, Web Shield also blocks an entered start address. Web Shield blocks navigation to addresses that are not approved.
    • DPI reduction for lower latency on Retina displays with desktop zoom: Reduces the display resolution on these displays to lower the latency.
    • If required, adjust the streaming settings.
    • oneclick™ Hybrid Printer (print via PDF download): Allows websites to be printed as a PDF file. The Web Shield app automatically transfers the PDF file to the local device. If the function is disabled, printing is not available.
    • File upload: Allows users to transfer files from their local device to the Hybrid App Share. If the function is disabled, the Upload data button does not appear.
    • File download: Allows users to download files from websites to their local device. If the function is disabled, Web Shield blocks these downloads. Settings under “oneclick™ Streaming (Browser)” with “Website access”, oneclick™ Hybrid Printer, file upload and file download, and the “Changeable by the user” column
PDF printer and file download

The PDF printer works independently of the File download setting.
If you enable the PDF printer, users can download generated PDF files to their local device even if you have disabled regular file downloads.
Also disable the PDF printer if users must not transfer PDF files via this function either.

  1. If required, add policies for app access.
  2. Customize the app tile.
  3. Click Save. Policies, app tile preview, and the “Save” button

Internal hostname with VPN IPsec​

For most Web Apps, the internal IP address with the ports is sufficient. Only enter a name in the Internal hostname field on the destination system if the Web App expects a specific name. The name only applies within the Web Shield session and does not change your DNS.

SituationHow to recognize itInternal hostname
The Web App works with the address that was called, e.g., Outlook on the webThe sign-in page and the Web App load normallyNot required
The Web App redirects to a fixed nameAfter signing in or clicking, the page stays white. Web Shield has no address bar: open the Web App in a regular browser in your internal network. After the redirect, the address bar shows a different name, e.g., intranet.company.localEnter exactly this name
The server hosts several websites and distinguishes them by nameA wrong website, the default page of the web server, or "Bad Request – Invalid Hostname" appearsEnter the name of the desired website
The pages link images, scripts, or subpages with the full internal nameThe page loads, but images or the layout are missing, or individual links lead nowhereEnter the name used in the links

Enter the name the way the Web App uses it, usually as a full name such as mail.company.local. Lowercase letters, digits, hyphens, and periods are allowed. Names ending in oneclick.services, cluster.local, or vispa.local are not permitted.

Example: Outlook on the web runs behind VPN IPsec on the destination system 10.10.0.25 with port 443. The session opens the sign-in page. Outlook redirects to the sign-in without a port; oneclick™ accepts this on port 443 and passes it on to the VPN. An internal hostname is not required.

Troubleshooting​

ProblemCauseSolution
Configuration type Internal website / app is missingNo Web Shield license selectedIn step 3, select a Web Shield license or request one, see App license.
Even the first page stays white (VPN IPsec)The connection is disconnected, the IP address or ports on the destination system are wrong, or your firewall does not allow the ports of the Web App in the tunnelCheck the status of the connection, the IP address and ports on the destination system, and whether your firewall allows these ports in the tunnel. See Connection Issues VPN IPsec.
After signing in, the page stays white, or a wrong website or "Invalid Hostname" appears (VPN IPsec)The Web App expects a specific nameEnter an internal hostname on the destination system. The table under Internal hostname with VPN IPsec shows which name to use.
The Web App redirects to another internal server, e.g., a sign-in server (VPN IPsec)Web Shield only reaches the destination system of the app configurationWeb Shield does not support this redirect. The Web App must run entirely on the destination system.
The loading bar runs through, then the page stays white (oneclick™ Mesh)The hostname of the destination system only exists internally or publicly points to a different addressLeave the hostname empty on the destination system and enter only the IP address.

Assign an app instance​

Assign the app to the intended users or groups using Create app instances for users.

Changes to the app configuration

Changes to the app configuration settings apply from the next session. If you change the URL or the destination system, oneclick™ immediately ends all running sessions of this app. Changes to the destination system, such as the internal hostname or the ports, apply from the next app start.