Functionize Quickconnect (ACS Quickconnect)

• QuickConnect uses Tailscale to join the user's machine to a private, Functionize-managed network (a "tailnet").
• Tailscale builds its tunnels with WireGuard, a modern, widely audited, open-source VPN protocol. Traffic is encrypted end to end with ChaCha20-Poly1305, and the keys live only on the user's computer and the Functionize test engine. Any relay in between forwards encrypted packets; it cannot read, modify, or decrypt them.
• Handles corporate proxies — auto-detects HTTP/HTTPS/SOCKS5/PAC proxies and prompts for credentials (Basic or NTLM) if the proxy requires authentication.
• The connection is outbound-only and started by the agent. QuickConnect opens no inbound ports on the machine or the network, and Functionize never dials in, so no inbound firewall rules are required.

• There is no installer. QuickConnect is a single portable executable; the user downloads it and runs it.
• It needs no administrator or root credentials and runs entirely in user space: no kernel driver, no system-wide VPN, and no changes to the machine's network settings. It does not route all of the machine's traffic, only the test traffic for in-scope resources.

Logging

Works with your existing proxy

QuickConnect detects and uses the machine's existing proxy configuration automatically, whether that comes from system settings, a PAC file, or environment variables, and it speaks HTTP CONNECT, HTTPS, and SOCKS5. If the proxy needs credentials (Basic, NTLM, or Kerberos), QuickConnect prompts the user for them; otherwise there is nothing to set up.

Works through TLS-inspecting proxies, no bypass required. If a proxy does full TLS inspection or SSL decryption (Zscaler, Netskope, Forcepoint, and the like), QuickConnect detects it and switches to its WSS-Relay fallback. That fallback is ordinary outbound HTTPS on TCP/443, which the proxy can inspect but cannot break, and it rebuilds the same end-to-end-encrypted tunnel from a clean vantage point. The connection still succeeds without anyone disabling or exempting inspection; IT only has to allow outbound access to *.functionize.com and *.tailscale.com.

Networking Requirement:

Minimum

TCP/443 to *.functionize.com and *.tailscale.com. But please NOTE that this give the worst performance.

Best of both worlds (security and speed): one outbound UDP rule for speed

The connection already works with TLS inspection fully enabled, as described above. For the best performance, IT can add one outbound firewall rule that changes no inspection settings and adds no inbound rules:

Allow outbound UDP/50000 to Functionize's regional peer-relays. The relay IP addresses are published, and kept current, at https://packages.functionize.com/acs-quickconnect/bootstrap/relays.json. Allow-list those.

• QuickConnect's bulk traffic is WireGuard over UDP, and Functionize runs regional peer-relays on UDP/50000. With this rule, the engineer's computer and the test engine carry their data over that fast UDP relay, while only lightweight coordination crosses the inspected TCP/443 path.
• This rule is scoped by IP, not by domain. WireGuard packets go straight to the relay's IP and carry no hostname or TLS SNI for a proxy or firewall to match on, so a *.functionize.com-style rule will not cover this path. Allow-list the published relay IPs above, or load them as FQDN address objects that your firewall resolves itself.
• This is a firewall allow, not an inspection exemption: your full TLS inspection on 443 stays exactly as it is. Proxies only carry TCP, so the UDP path is a direct outbound rule that never touches the proxy.
• It is a performance optimization, not a requirement. Without it the connection still works; the data just falls back to the relay over the inspected TCP/443 path, at much higher latency.

Maximum performance