Skip to main content

​
Data Relay Link

Relay only the connections you actually need — into private systems for remote access, or out from restricted networks to approved Internet destinations. Data Relay Link is a lightweight secure-connectivity gateway for small environments. It combines two complementary connection models:
  • Secure Remote Access — publish selected SSH, HTTP, HTTPS, or custom TCP services from systems behind NAT/firewalls without requiring inbound access on every remote client.
  • Controlled Egress — allow systems in isolated or restricted networks to reach only approved external destinations through an agentless HTTP/HTTPS proxy policy.
The target scale is a few systems to a few dozen clients. Data Relay Link is intentionally not a large-fleet orchestration, VPN mesh, SWG, or SASE platform.

​
Understand it in 30 seconds

The core principle is simple:
Do not connect entire networks. Relay only the connections that are actually needed.

​
Choose your path

I want remote access

Install a server, enroll a client, and publish your first SSH service.

I need controlled outbound access

Understand the Controlled Egress model, policy boundaries, and current qualification status.

I am completely new

Learn Server, Client, CLIENT ID, Service, public ports, and relay traffic flow visually.

I need a public server

Prepare an OCI Always Free-eligible Ubuntu VM with a persistent Reserved Public IPv4 address.

I need to publish applications

Publish SSH, HTTP, HTTPS passthrough, custom TCP, or another reachable LAN target.

I want operator commands

Use the drlink CLI for enrollment, services, lifecycle, diagnostics, backup, and updates.

​
Secure Remote Access

A remote client normally needs outbound connectivity to the Data Relay Link Server, not a public IP or inbound NAT rule of its own.

​
Controlled Egress

Controlled Egress is designed for hosts that cannot access the Internet directly but need tightly limited outbound connectivity.
The server-side policy can restrict:
  • source CIDR/network
  • destination FQDN
  • destination port
  • controlled wildcard subdomains
  • IP-literal use
The design is default deny / fail closed, with server-side DNS resolution, SSRF protection, DNS-rebinding resistance, audit logging, diagnostics, and backup/restore integration.
Controlled Egress is currently under release qualification. Secure Remote Access v2.2.1 is the published stable baseline; do not assume Controlled Egress is part of the immutable v2.2.1 release until its Real E2E qualification is complete.

​
Current stable baseline

Real E2E client coverage for v2.2.1 includes Ubuntu 24, Rocky Linux 8.10/9.4, Amazon Linux 2023, macOS Apple Silicon, and Windows 10 / PowerShell 5.1. Amazon Linux 2 and PowerShell 7 have narrower validation levels. See Supported Platforms for the validation matrix and Release Status for release details.

​
Boundaries that matter

The target application, not Data Relay Link, presents the application TLS certificate.
The v1 egress design allows HTTP forwarding and HTTPS CONNECT. It does not decrypt TLS, perform DLP, malware inspection, CASB, browser isolation, or full SWG/SASE functions.
Disable stops publication but keeps the port. Revoke blocks management identity. Release returns a public-port reservation.
New user: start with Concepts & Mental Model and Quick Start. Operators can jump to the drlink Guide, Architecture, or Troubleshooting.
Last modified on September 10, 2026