One URL
Nothing to install.
No VPN client, no RDP client, no plugin. A browser is the whole client, so it works from a laptop, a phone, or a machine that is not allowed to have software on it.
B4 managed remote access · DaaS
Reach the systems that run your service, from a browser.
One URL in front of the servers, cameras and sites B4 operates for you. No VPN client, no RDP client, no plugin to install. Your own credentials, multi-factor at the door, and every session recorded.
- No client to install
- Named targets only
- MFA on the gateway
- Sessions recorded
01
What the client gets.
A remote-access broker is the highest-risk thing B4 would operate: it is a deliberate, authenticated path into production. So it is sold as a narrow, attributable path — not as a doorway to a network.
Named targets
Only what you agreed.
Access to a named list of machines that B4 and the client agreed on. Not to a network, not to a subnet — to specific targets.
Your credentials
No shared logins.
Each person gets their own account on the gateway. A shared login means the recording cannot say who did what, and one leaver takes everyone else's access with them.
Recorded
Every session accounted for.
Sessions are time-stamped and recorded, and the connection logs are shipped off the gateway so a compromised gateway does not take the evidence with it.
The target still authenticates. The gateway is a path to the host, not a way around its login. If the target's own credentials are shared today, the gateway has not fixed that — it has just made it visible.
02
How it works.
A Guacamole gateway, run by B4, in front of the infrastructure that hosts the service B4 runs for you.
You
Browser
HTTPS
B4 runs
Guacamole gateway
MFA · session log · recording
on the gateway
guacd
protocol broker
yours
Your target
RDP · SSH · VNC
Property one
The target never sees your IP.
The gateway opens its own connection to the target, so your address is never exposed to the machine you are reaching — and the target does not need an inbound port opened to the internet.
Property two
Every connection is attributable.
A named user, a named target, a timestamp and a recording. When something is disputed, the answer is a recording rather than an argument.
03
The security posture.
These are not options on a later list. They are what the service is, and the stack ships with the ones that are easy to forget.
| Control | Why | Enforced by |
|---|---|---|
| MFA on the gateway itself | The gateway is a target. Without MFA it is one password away from production. | The stack |
| Per-client credentials, never shared | A shared account means the recording cannot say who did what. | B4, per client |
| An explicit target allowlist | The client reaches named machines. There is no "browse the network" feature. | B4, per client |
| The gateway lives in a management segment | Not on the targets' user VLAN, not in the DMZ, not on a plane it can route to everything. | The host chosen |
| Session recording on | Disputed "who changed that" is the normal case, not the exception. | The stack |
| Connection logs shipped off the gateway | If the gateway is compromised, the logs on it are compromised too. | B4 |
| The target still authenticates | Guacamole is not a credential store and not a bypass. | Inherent to the design |
| Patch the gateway on a schedule | Internet-facing software that brokers access to production. | B4 |
The database has no route out.
It sits on a network with no default route, and guacd — the only service that needs to reach your network — cannot see it at all.
The published port binds to loopback.
Nothing can reach the gateway until a reverse proxy with TLS and MFA is in front of it. In production that front is Cloudflare Tunnel with Cloudflare Access.
Brute-force detection is on.
The image ships it and enables it by default: five failures bans the address for five minutes.
Two honest limits.
- Recording captures the target's framebuffer. It does not capture clipboard contents or keystrokes, and it costs performance on a busy screen. It is a record of what was on screen — not a keylogger, and it is not sold as one.
- The gateway brokers access to the target's own login. It does not remove the need for per-user accounts on that target.
04
The plans.
The price list is not new. It is the one B4 already publishes for Desktop as a Service — and the gateway is how the "cloud VPN included" line gets delivered, without a client to install.
DaaS Lite
$250 a year
- 8gb memory
- 500gb storage
- Cloud VPN included — delivered as a browser session
- Limited support
DaaS Pro
$500 a year
- 24gb memory
- 6tb storage
- Cloud VPN included — plus session recording
- Unlimited support
- 7 day free trial
+ $250 training and setup
Request DaaS Pro →| Plan | Price | What it includes |
|---|---|---|
| DaaS Pro support | $500 a year | Expert guidance, seamless integration and proactive management for a DaaS Pro environment. |
| DaaS Lite support | $250 a year | Flexible, on-demand tech assistance — seamless IT assistance with expert guidance at your fingertips. |
| Website & app development IT support | $3,000 a year | 25 sessions, valid for 2 years. Issued as browser sessions instead of VPN handovers. |
| Web store front | $5,000 a year | + $250 domain registration and site mockup, personal web development. |
Remote access is delivered under these plans. Both DaaS tiers include the VPN capability; the gateway is the browser-based way it is delivered. B4 can also quote the gateway as a line of its own where a client already runs its own desktops — ask.
05
Getting one.
A remote-access gateway is not a checkout. Here is the sequence B4 runs, so you know what you are buying and when.
- 01
Agree the target list.
Which machines may be reached, over which protocol and port. Nothing else is exposed.
- 02
Stand up the front.
Cloudflare Tunnel plus Cloudflare Access, so TLS is terminated at the edge, MFA happens before a request reaches Guacamole, and the gateway host has no open port at all.
- 03
Turn on MFA for the gateway's own accounts.
Before any target is connected.
- 04
Create per-client users.
Each person gets their own gateway account, entitled only to their own targets.
- 05
Add the targets by name and test each one.
Then turn on recording and set the retention that was promised.
- 06
Ship the logs and back up the database.
The database holds the configuration and the connection history. Losing it means re-creating every user and every target.
- 07
Put it in the monitoring.
The same watchlist as the rest of the estate. An access broker nobody watches is a liability.
06
Request access.
Tell B4 what you need to reach and what it is for. The note goes to B4's desk and is answered by an engineer.