Firewall & NAT
DataRelay Link does not automatically change cloud security groups, customer firewalls, NAT/DNAT, UFW/firewalld, or external routers.
Direct mode
Typical inbound requirements are:
Only expose endpoint pools actually configured by the deployment. Fixed TCP uses a separately configured endpoint pool when enabled.
Enterprise single-443
Typical inbound requirements are:
Internal allocator/Relay Engine backend listeners must remain private/loopback-only.
Agent Hosts
Managed Hosts normally initiate their control/management connections outbound to the Server. They do not require a public IP or inbound NAT solely to operate the Agent.Last modified on September 22, 2026
