# Test behind a firewall (/tutorials/self-hosted-worker)

# Test a product behind your firewall [#test-a-product-behind-your-firewall]

If the product you want to test is only reachable inside your network, a
cloud browser can't reach it. In this tutorial you set up a Mac on your network
as a device, point a project at your internal product, run one checklist
through that Mac and read what the actor found. Nothing on your firewall
changes: the Mac dials out to Stunt Double.

<Callout variant="note" title="Plans">
  Testing private or internal addresses needs the Startup plan or above.
  [Devices](/integrations/self-hosted-workers#before-you-start) lists what each
  plan and role can do.
</Callout>

<Steps>
<Step>

### Set up a Mac on your network [#set-up-a-mac-on-your-network]

Pick a Mac that can open your internal product in its own browser: on the
office network, or with the VPN connected. Install the
[desktop app](/integrations/desktop-app#install-it) on it, sign in, then open
**Devices** and click **Set up this Mac**. Wait for **This Mac** to show
**Connected**. The [Devices](/integrations/self-hosted-workers#set-it-up)
reference covers this step in full.

Keep the app open for the rest of the tutorial. A device is only online while
the app is running.

</Step>
<Step>

### Sign in once, if the product needs it [#sign-in-once-if-the-product-needs-it]

If your product sits behind a VPN portal or SSO, open the browser under
**Live view** on **This Mac** and sign in the way you normally would. The
sign-in persists, so actors start every later run signed in.

If the sign-in asks for a client certificate, Keychain or a smart card, first
switch **Where the browser runs** to **Its own window**, so the prompt has a
real Chrome window to appear in.

</Step>
<Step>

### Point a project at the internal address [#point-a-project-at-the-internal-address]

Create a project, or open an existing one, and enter the internal address as
its URL. As you type, the field checks where the address can be reached from.
For an internal one it reads **This project is internal, so actors open it on
a device in your network.**

You do not need to change any actor. An actor on the cloud browser borrows
whichever device is online when its project is internal.

</Step>
<Step>

### Check the device can reach it [#check-the-device-can-reach-it]

If you are an owner or admin, open the Mac from **Devices** and enter the
address under **Test a URL**. The test opens it in the device's browser, so a
pass means actors can reach it too. A failure here is cheaper to fix than a
failed run: check the Mac's VPN, and its **Network access** setting.

</Step>
<Step>

### Run a checklist [#run-a-checklist]

Open **Checklists** in the project, choose **Create checklist**, write one or
two checks as plain-language outcomes (for example "Sign in and open the
reports page"), then press **Run**.

The run goes to your Mac. Switch to **This Mac** to watch it under **Live
view**: the device reads **Running a task** while the actor works, and the
activity log beside it lists what the device did. If another run is already
using the Mac, yours waits its turn.

</Step>
<Step>

### Read the result [#read-the-result]

Open the finished run from the checklist. Each check has its result, the
screenshot the actor took and its explanation, the same as a run in the
cloud. [Review runs and act on them](/tutorials/reviewing-runs) covers what to
do with failures.

</Step>
</Steps>

## Make it routine [#make-it-routine]

Once one run works, you can rely on the Mac for more:

- **Automations** on an internal project use the device the same way, so a
  schedule or a deploy trigger can re-check the product without anyone at the
  Mac. Leave the app running on a Mac that stays awake.
- **Keep an actor on this Mac** for every run, public sites included, from the
  actor's **Browser** tab.
- **Limit what the device can open** to the domains your actors need, under
  **Network access**.

[Devices](/integrations/self-hosted-workers) explains how runs choose a device,
how to share one Mac across the team and how to restrict it.

## Next steps [#next-steps]

- **[Devices reference and troubleshooting](/integrations/self-hosted-workers)**
- **[Run a live session](/tutorials/live-sessions)** to watch and steer an actor on your Mac
- **[Automate multi-step workflows](/tutorials/building-workflows)**