Skip to content

XoT-Bridge

Overview

The XoT-Bridge is a key component within the XoT infrastructure designed to simplify secure access to assets, particularly those located behind restrictive firewalls. It acts as a central connection point, enabling communication between XoT-Clients (end-user devices) and XoT-Locks (devices protecting assets) without requiring complex firewall modifications.

At its core, the XoT-Bridge functions as a facilitator for secure WireGuard tunnels. Instead of requiring direct connections between clients and protected assets, which often involves opening inbound ports on firewalls, both the XoT-Client and the XoT-Lock establish outbound connections to the XoT-Bridge. The Bridge then securely connects these two endpoints, effectively creating an end-to-end encrypted tunnel through the firewall.

Diagram showing XoT-Client and XoT-Lock connecting to an XoT-Bridge located outside firewall

This approach offers significant advantages:

  1. Simplified Firewall Management: Since connections are initiated from the XoT-Lock and XoT-Client to the Bridge, there's typically no need to configure inbound firewall rules to allow external access directly to the protected assets or the XoT-Locks. As long as the Client, Lock, and the central XMS can reach the Bridge, connectivity can be established.
  2. Deployment Flexibility: The XoT-Bridge doesn't need to reside on the same network as the XoT-Locks. It can be deployed internally within the organization, placed in a secure network segment like a DMZ, or even hosted in a public cloud environment, depending on the specific network architecture and requirements.
  3. Centralized Access Point: The Bridge can present a single, external-facing IP address for clients to connect to. It then dynamically maps incoming connections on unique UDP ports to the appropriate internal XoT-Lock endpoints, simplifying access management for multiple protected assets.

Connection Modes

The XoT-Bridge primarily operates in a "Rendezvous mode". In this mode, both the XoT-Client seeking access and the XoT-Lock protecting the asset initiate connections to the Bridge. This is often the simplest configuration from a firewall perspective.

Alternatively, the Bridge can operate in a more traditional mode where the XoT-Client connects to the Bridge, and the Bridge then initiates the connection to the XoT-Lock. While this might require more intricate firewall rules (allowing the Bridge to connect into the network where the Lock resides), it can be suitable for specific network setups.

Diagram showing XoT-Client connecting to XoT-Lock via an XoT-Bridge located in DMZ

In essence, the XoT-Bridge acts as a secure meeting point, enabling seamless and secure remote access to firewalled assets without compromising network security policies by unnecessarily opening inbound ports.