The app works beautifully inside the office. Then you go home, open it, and nothing connects. The fix takes an afternoon — and done the lazy way, it quietly hands the keys to your entire fleet to the whole internet.
ManageEngine's own help documentation says the server address you enter in the app should be reachable from devices outside the enterprise. That one line is where good and bad setups separate. Reachable is necessary. Exposed is dangerous. This page walks through the two routes that give you reachability without exposure — and names the one shortcut you must never take.
Most office software, if exposed, leaks its own data. A management console is different: it is a control system. Anyone who gets into your Endpoint Central console inherits your powers — remote control of every PC, software deployment, device wipe, command prompt access. Attackers actively scan the internet for exposed management consoles precisely because one login is worth more than a hundred single PCs. So the rule is absolute: the Endpoint Central console (port 8020) is never published directly on the public internet. Not temporarily, not with a strong password as the only defence, not because it is convenient this week.
The simplest safe design uses what many offices already have. The admin's phone connects to the office network through a VPN — from the office firewall, a VPN server, or a mesh tool your office already trusts. Once the VPN is up, the phone is effectively inside the office LAN, and the Endpoint Central app connects to the server's normal internal address exactly as it does on office Wi-Fi. No console ports face the internet at all; the only internet-facing service is the VPN itself, which is built and hardened for that job. The daily habit is small: VPN on, app open, work, VPN off. For a single admin or a small team, this is usually the right answer.
When several admins need access, or the office already runs agents across the internet, ManageEngine's own answer is the Secure Gateway Server — a component designed to sit at the network edge (typically in a DMZ) and relay traffic between outside devices and the Endpoint Central server. The server itself stays on the internal network; the gateway is the only piece exposed, and it exists specifically to be that exposed piece. This is the vendor-supported design for internet-facing Endpoint Central deployments, and it is the correct upgrade path when the VPN habit stops scaling. Set it up from ManageEngine's documentation for your build, and test the app connection through it before declaring the job done.
A safe route still deserves basic discipline. Use HTTPS mode in the app rather than plain HTTP. Give every admin a named account — shared logins destroy the audit trail that tells you who did what. Enable two-factor authentication for console access if your setup offers it. Keep the Endpoint Central server patched — the gateway and VPN protect the door, but updates fix the locks. And review, once in a while, who still has an account: ex-employees and forgotten test users are the quietest holes in any fleet setup.
See the phone connected to a live fleet and controlling PCs remotely in the complete video walkthrough.
▶️ Watch Full VideoBecause the server address it uses is an internal office address. ManageEngine's documentation notes the server must be reachable from devices outside the enterprise for the app to work remotely — that reachability has to be arranged, safely, by you.
No. Passwords get phished, reused and guessed by automated tools that never sleep. A management console that can control every PC should not be reachable by the whole internet in the first place — use a VPN or the Secure Gateway.
For one or two admins, the VPN route is simpler and costs nothing extra. When many admins or internet-based agents are involved, the Secure Gateway Server is the vendor's designed answer and scales better.