OwnRemote help

●Connected to the server

What the icon says

• Connected to the server
• Connected to the server · Direct (UDP)
• Connected to the server · Through the server (UDP)
• Connected to the server · Through the server (TCP fallback)

What it means

The PC is connected to the OwnRemote server, so your phone can open this PC's apps. While a phone is connected, the line also says how the picture travels. Direct means the phone and the PC talk straight to each other (free); through the server means the direct path is blocked and the server's relay carries it (what it carries is deducted from your prepaid balance). See direct connection and through the server below.

Nothing to do.

Back to top

▲Connecting, or connecting again

What the icon says

• Connecting to the server
• Server connection lost — reconnecting
• Lost the server — connecting again

What it means

The PC is connecting to the server, or lost its connection and is connecting again. It shows for a moment after the PC starts, when the internet drops briefly, or while the server is being updated (about ten seconds). The PC keeps trying by itself.

What to do

1. Wait a moment. It usually turns green within seconds.
2. If it stays for a minute, it turns red. See server out of reach then.

Back to top

■The server out of reach for over a minute

What the icon says

• Server connection lost — reconnecting
• Connecting to the server

What it means

The PC has not reached the server for more than a minute. Meanwhile no phone on another network can connect to it. The PC keeps trying, so it turns green again by itself once the cause is gone.

What to do

1. Check that the PC has internet: open any website in a browser.
2. Check that the OwnRemote website (this page's address) opens on this PC. If other sites open and this one does not, a company firewall or a security program may be blocking the server's address (network firewall, security software).
3. If the PC has just woken from sleep, wait a moment: it connects again once awake.
4. If it still does not connect, choose "Quit OwnRemote" in the menu and start OwnRemote again from the Start menu.

While the server is out of reach, "Send diagnostics" cannot send either (diagnostics go to the server).

Back to top

▲A server certificate problem

What the icon says

• Server certificate not trusted — see the log
• Server certificate is for another name — see the log
• Server certificate expired — check the date and time

What it means

The PC tried to set up an encrypted connection to the server, but could not trust the certificate the server showed. It does not make a connection it cannot trust, so it is not connected, and it keeps trying.

What to do

1. If it says expired, first check this PC's date and time (Settings → Time & language → Date & time → "Set time automatically" on). With the clock wrong, a good certificate looks expired or not valid yet.
2. If it says not trusted, your company network or a security program may be inspecting encrypted connections. Ask your IT staff to leave the OwnRemote server's address out of that inspection, or make OwnRemote a trusted program in the security software.
3. If you run the server yourself, check that its certificate is issued for the server address's name and has not run out.
4. If nothing helps, look again later: the server's certificate may be being fixed.

Back to top

■The server refused this PC → pair it again

What the icon says

• The server refused this PC
• The server refused this PC — use 'Pair again with a new code…' in the tray

What it means

The server no longer accepts this PC's key: the PC was removed in the web console, the account was deleted, or the PC had not connected for a long time (180 days) and its key expired. In this state the PC does not try again.

What to do

1. In the OwnRemote icon's menu in the notification area, choose "Pair again with a new code…", then "Pair again". The PC clears its old pairing and shows a new pairing code. (On an older version without that item, uninstall OwnRemote and install it again.)
2. Sign in to the web console (/dashboard) and enter the code under "Add PC".
3. If the old entry is still in your list, choose it under "In place of one of my PCs" as you enter the code: its registered apps and settings carry over.
4. When the PC asks "Connect this PC to account …?", check that it is your account, then connect.

Back to top

Account suspended

What the icon says

• Account suspended
• This account has been suspended. Please uninstall this program. (Settings → Apps → OwnRemote)

What it means

An operator suspended the OwnRemote account this PC is paired to. While it is suspended, no phone can connect to this PC.

What to do

1. If someone you do not know had you install it as "remote support", uninstall OwnRemote now (Settings → Apps → OwnRemote). OwnRemote staff never ask for a pairing code or PIN. If that happened, please report it.
2. If it is your own account and you think this is a mistake, reply to an email you received from OwnRemote.

Back to top

▲A pairing code waiting

What the icon says

• Pairing code 123 456 — enter it in the web console

What it means

This PC is not connected to an account yet and is waiting for its six-digit pairing code to be entered. A code works for 10 minutes; after that a new one appears.

What to do

1. "Show pairing code…" in the menu shows the code large in a window, with a copy button.
2. Sign in to the web console (/dashboard) and enter the code under "Add PC".
3. When the PC asks "Connect this PC to account …?", connect only if it is your account. If someone you do not know asked you for the code, press Cancel.

Back to top

▲UDP blocked (connected by the TCP fallback)

What the icon says

• Connected to the server · UDP blocked — check security software/firewall
• Connected to the server · Through the server (TCP fallback) · UDP blocked — check security software/firewall

What it means

OwnRemote sends the picture over UDP, but the server's UDP replies to this PC did not reach OwnRemote. Usually a security program or the firewall on the PC is blocking OwnRemote's UDP. The PC then reaches the server's relay over TCP instead. It connects, but the picture always goes through the server, so what it carries is deducted from your balance, and it can be slower than a direct connection.

What to do

1. Check whether Windows Firewall has a rule blocking OwnRemote.
2. Allow OwnRemote in your security software (Kaspersky, V3, ALYac, …).
3. On a company or school network, its firewall may be blocking UDP.
4. Once fixed, connect again from the phone: the PC checks UDP again, and "UDP blocked" goes when the reply comes.

Back to top

■Phones on other networks cannot connect (UDP and the TCP fallback both blocked)

What the icon says

• Notification: OwnRemote: phones outside this network cannot connect
• Phone: A security program or the firewall on the PC is blocking OwnRemote's UDP replies, so the phone can connect only on the PC's own Wi-Fi. …

What it means

A phone tried to connect, but the PC got no UDP reply from the server and could not get the TCP fallback either, so it ended the session. Trying again gives the same result until the cause is fixed. The PC's notification names what it found: a Windows Firewall block rule, a security program running, or a network that blocks UDP for every program.

What to do

1. If the notification names a Windows Firewall rule, click it: with one administrator approval it turns that rule off and allows OwnRemote. Missed the notification? See the manual steps under Windows Firewall.
2. If it names a security program, allow OwnRemote in it (security software).
3. If it says this PC's network blocks UDP for every program, see network firewall. A phone on the PC's own Wi-Fi still connects.
4. Once fixed, connect again from the phone.

Back to top

Windows Firewall

What the icon says

• Windows Firewall's rule "…" blocks what OwnRemote sends. Click here to turn it off and allow OwnRemote (asks for administrator approval).

What it means

A Windows Firewall rule that blocks OwnRemote wins over any rule that allows it. When OwnRemote finds a rule blocking it, the notification names the rule.

What to do

1. One click: click the notification, and answer "Yes" when Windows asks for administrator approval. It turns off only the rules that block OwnRemote (inbound and outbound) and adds OwnRemote's allow rules again. Other programs' rules are left alone.
2. By hand: open "Windows Defender Firewall with Advanced Security" from the Start menu.
3. Under "Inbound Rules" and "Outbound Rules", find the rules whose program is OwnRemoteAgent.exe and whose action is "Block", and choose "Disable Rule".
4. Connect again from the phone.

Back to top

Security software (Kaspersky, V3, ALYac, …)

What the icon says

• A security program on this PC (…) is blocking OwnRemote's network traffic. Allow … in it (UDP in and out), or add it as trusted.

What it means

Antivirus and internet security programs can block a program's traffic with their own firewall, and may quarantine a program they have not seen before. Their traffic filter can stay in place even with protection paused, so allowing OwnRemote works better than turning the program off.

What to do

1. Open the security program's window (its icon in the notification area).
2. Find its settings called something like "Firewall", "Network protection", "Application rules", "Trusted applications" or "Exclusions". The names differ (Kaspersky: "Application control"; V3: "Firewall", "Exceptions"; ALYac: "Exclusion list").
3. Add OwnRemoteAgent.exe as a trusted program (an exclusion), or set its network traffic (UDP in and out) to "Allow".
4. If the security program quarantined OwnRemote, restore it, add the exclusion, and start OwnRemote again from the Start menu.
5. Connect again from the phone.

Security programs move their menus between versions. If you cannot find it, search the vendor's help for "add an exclusion".

Back to top

OwnRemote does not start at sign-in (360 and others)

What the icon says

• Starting at sign-in: not done — Windows refused access. A security program may be blocking the startup entry.

What it means

OwnRemote puts itself in Windows' list of startup programs (the registry's Run key) so that it starts when you sign in. Some security programs, such as 360 Total Security, stop programs from being added to that list. The 360 we tested blocked only this entry and nothing else OwnRemote does. OwnRemote is then installed and starts from the Start menu, but not by itself at sign-in.

What to do

1. Open the security program's window (its icon in the notification area).
2. Find a setting called something like "Startup protection", "Startup items" or "Autorun protection". The names differ between programs.
3. Turn that protection off, or set OwnRemote's startup entry to "Allow" (if it asks about OwnRemote, choose "Allow").
4. Run the OwnRemote setup file again. It registers the start at sign-in again.
5. If you would rather not, click OwnRemote in the Start menu each time you turn the PC on. While it runs, connections work normally.

Installed for the whole PC with administrator rights, OwnRemote registers a logon task in Task Scheduler instead of a startup entry. The 360 we tested did not block that.

Back to top

Network or company firewall

What the icon says

• This PC's network blocks UDP to the OwnRemote server, for every program. A phone on the same Wi-Fi still connects.

What it means

Company, school and public Wi-Fi firewalls sometimes block UDP. Then no program on the PC reaches the server over UDP.

What to do

1. With UDP blocked, OwnRemote first tries the server's relay over TCP 3478 (the TCP fallback, through the server). If that works, it connects with the yellow "UDP blocked".
2. If the TCP fallback is blocked too, ask your network administrator to allow outgoing traffic to the OwnRemote server's address on: UDP 3478 (connection checks and the relay), UDP 49152–65535 (relay ports), and TCP 3478 for the fallback.
3. Home routers usually do not block it. If you turned on a "block UDP" or similar security option on yours, try it off.
4. A phone on the PC's own Wi-Fi does not pass this firewall and still connects.

Back to top

Sending diagnostics

What the icon says

• Send diagnostics…

What it means

If this page does not fix it, or support asks for it, you can send the PC's recent records to support, without finding any log file yourself. It shows you what it will send first and sends only when you click "Yes". Passwords, tokens and the folder names in file paths are masked.

What to do

1. Click the OwnRemote icon in the notification area to open its menu.
2. Choose "Send diagnostics…" (only on a PC paired to an account).
3. Read what it will send and click "Yes". "No" collects and sends nothing.
4. When it says "Diagnostics sent. Their number is D-…", give that number to support.

It cannot send while the server is out of reach or has refused this PC (diagnostics go to the server). See server out of reach or pair it again first.

Back to top

What does "Direct" mean?

What the icon says

• Direct (UDP)

What it means

The phone and the PC exchange the picture and input straight with each other, with no relay in between. The server only passes the first signals so that they can find each other; the picture never goes through it. That works on the same Wi-Fi, and usually away from home too (on mobile data, for example): OwnRemote opens a way through the routers' NAT by itself (hole punching). Direct connections are always free, and usually the fastest.

If it still cannot connect directly, a router port forward is an advanced option. It carries security risk, so if you are not sure, we recommend the relay.

Back to top

Why "Through the server"? Does it cost anything?

What the icon says

• Through the server (UDP)
• Through the server (TCP fallback)

What it means

When a company firewall, a mobile network or a security program keeps the phone and the PC from reaching each other directly, the server's relay carries the picture. Only the relay costs money: what it carries is deducted from your prepaid balance (0.50 credits per GB; a credit is $1 of service), with no subscription. Direct connections are never charged. "TCP fallback" means the PC reached the relay over TCP instead of UDP; that is through the server too.

What to do

1. Your balance and this month's relay use are under "Balance & usage" in the web console.
2. If it always says "Through the server" and the PC also shows "UDP blocked", unblocking OwnRemote in the PC's security software or firewall may make it direct (UDP blocked).
3. With no balance, a relayed connection does not start. Direct connections work whatever the balance.

If it still cannot connect directly, a router port forward is an advanced option. It carries security risk, so if you are not sure, we recommend the relay.

Back to top

How do I put this PC on another account?

What the icon says

• Sign out of this account…

What it means

Sign the PC out of the account it is on, at the PC: it leaves that account's list of PCs, and that account's phones can no longer connect to it. A phone connected at the time is disconnected, and the phones the PC remembers are forgotten; the PC's own PIN stays. The PC then shows a new pairing code, which any account can enter.

What to do

1. Click the OwnRemote icon in the notification area to open its menu.
2. Choose "Sign out of this account…" (only on a PC paired to an account), check the account it names, and click "Sign out".
3. A new six-digit pairing code appears. Sign in to the web console with the other account and enter it under "Add PC".
4. If the server cannot be reached, the PC asks whether to sign out on the PC only: the PC then stays on the old account's list (offline) until it is deleted there.

If the PC was already deleted on the web, its menu has "Pair again with a new code…" instead (pair it again).

Back to top

Does a phone on mobile data (LTE, 5G) connect directly too?

What it means

Usually, yes. For a direct connection, the phone and the PC must be able to send packets straight to each other's address (an IP and a port), but the phone sits behind the carrier's NAT and the PC behind your home router's. OwnRemote gets through by opening a path from both sides at once (hole punching), and a phone on mobile data usually reaches a PC at home directly this way. Sometimes, though, no path opens: when the mobile network gives the phone a different port for each destination and, at the same time, the home router drops packets from anyone nothing inside sent to first. Only then does the server's relay carry the picture. On the same Wi-Fi none of this applies: the connection is direct and free.

Back to top

Is a port forward safe?

What it means

A port forward opens a door: anyone on the internet can then reach your PC on that UDP port. OwnRemote's port only answers sessions with the right keys, the picture and input are end-to-end encrypted between phone and PC, and a connection still needs your account sign-in and the PC PIN. Even so, an open port is one more thing to attack: a bug nobody knows about yet could be exploited, or a flood of packets could be sent at it. And a mistake on the router can expose the whole PC. So do it only if you fully understand what you are doing and accept that risk yourself, and if you do, keep to the following.

What to do

1. Never use DMZ. DMZ (DMZ host, super DMZ and the like) opens every port of the PC to the internet, those of every other program included.
2. Forward only UDP 45721 (or the port set for the PC) to the PC. No other ports, no port ranges, no TCP.
3. Check that the rule's internal IP is this PC, and that the PC has a fixed internal IP. If the IP changes, the port is opened toward another device.
4. When you no longer need it, delete the forwarding rule on the router and turn the fixed port off in the web dashboard.
5. Do not set up port forwards on networks you do not manage, such as at work, at school or in a café.

Back to top

Connect directly with a router port forward (advanced)

What it means

Before you start: this opens a port on your router to the internet, and that carries security risk. Do it only if you fully understand what you are doing and accept that risk yourself. If you are not sure, use the relay, for security. When the PC always uses the same UDP port and your router passes the packets that arrive for that port on to the PC, the phone reaches the PC straight away even on networks where hole punching does not get through: a direct connection, which is free. The port is UDP 45721 by default.

What to do

1. In the web dashboard, open the PC's page and, under Policy, turn on Fixed port for direct connections. Unless you have a reason to change it, leave the port at 45721. When it is on, the PC's icon menu shows the port too.
2. Give the PC a fixed internal IP. Routers usually hand out internal IPs (such as 192.168.0.10) as devices come and go (DHCP); if the PC's changes, the forward goes to another device. Add the PC to the router's DHCP reservations (sometimes called static or manual IP assignment). To see the PC's internal IP, open Command Prompt on the PC and type ipconfig: it is the "IPv4 Address".
3. In the router's settings, add one port forwarding rule: protocol UDP, external port 45721, internal port 45721, to the PC's internal IP. If you changed the port on the PC, use that number.
4. Connect again from the network where a direct connection failed, and check that the top line of the PC's icon menu shows Direct (UDP).

On an ipTIME router, for example: open http://192.168.0.1 in a browser and sign in; under Admin tools → Advanced setup → Network → Internal network settings → Manual IP assignment, register the PC; then under Advanced setup → NAT/Router → Port forwarding, "Add rule" with internal IP address = the PC, protocol UDP, external port 45721 and internal port 45721, and save. The menu names vary a little with the firmware, and ipTIME's own pages are in Korean. Other routers do the same under other names (port forwarding, virtual server, NAT). With two routers in a row (such as your own router behind the internet provider's), forward on both: from the outer router to the inner one, and from the inner one to the PC. If the router's internet (WAN) address is a private one (192.168.x.x, 10.x.x.x, 100.64.x.x–100.127.x.x and the like), a port forward cannot be reached from outside. Direct connections over IPv6 are coming later.

Back to top

The relay or a port forward: which should I use?

What it means

Usually there is nothing to choose. OwnRemote tries a direct connection first and uses the relay only when that fails. A port forward is an advanced way for when a direct connection still fails, and suits those who fully understand what they are doing and accept the risk themselves. Otherwise, for security, we recommend the relay, all the more on work or other shared networks. The relay needs no change to your router, so nothing new is opened toward your PC. The picture and input are end-to-end encrypted between phone and PC just as on a direct connection; the relay only carries them, still encrypted. You pay only for what it carries, from your prepaid balance (0.50 credits per GB).

Back to top