> ## Documentation Index
> Fetch the complete documentation index at: https://link.datarelay.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment Modes

> Choose between Direct and Enterprise single-443 deployments.

# Deployment Modes

Data Relay Link has **two** server deployment modes: **Direct** and **Enterprise single-443**.

NAT is not a third mode; it is a network topology around either deployment.

<img src="https://mintcdn.com/data-relay/RziF2R9Wr8UU8L7K/images/guides/51.png?fit=max&auto=format&n=RziF2R9Wr8UU8L7K&q=85&s=4a930511afe950f35b5fae08e1c562ca" alt="Data Relay Link deployment layouts from the original field guide" width="1448" height="1086" data-path="images/guides/51.png" />

The image is the original field-guide overview: a direct public server, a private server behind DNAT, and the Enterprise single-443 layout. The tables below use the current v2.2.1 terminology and port rules.

## Which mode should I choose?

```mermaid theme={null}
flowchart TD
    A[Start] --> B{Does the client network allow\nverified HTTPS / Data Relay Link traffic\non the normal public endpoints?}
    B -->|Yes| D[Use Direct\nrecommended default]
    B -->|No / TLS on non-443 is reset| C{Can public TCP 443\nbe used for both enrollment\nand Data Relay Link control?}
    C -->|Yes| S[Use Enterprise single-443]
    C -->|No| N[Fix upstream network policy\nData Relay Link does not support insecure fallback]
```

## Direct mode

```mermaid theme={null}
flowchart LR
    C[Remote client]
    I[Internet]
    S[Data Relay Link server]
    U[Internet user]

    C -->|Data Relay Link control TCP 443| S
    C -->|Enrollment/management HTTPS TCP 6099| S
    U -->|Published service TCP 6000-6098| S
```

Direct is the default and easiest mode to reason about.

| Purpose                       | Public TCP | Typical local listen |
| ----------------------------- | ---------: | -------------------: |
| Data Relay Link control       |        443 |                  443 |
| Enrollment / management HTTPS |       6099 |                 6099 |
| Published services            |  6000-6098 |            6000-6098 |

## Enterprise single-443

Use this when an enterprise client network strongly prefers TLS on TCP/443 or allows the TCP connection to a non-standard port but resets TLS there.

```mermaid theme={null}
flowchart LR
    C[Remote client]
    U[Internet user]
    FE[Public frontend\nTCP 443]
    A[Allocator backend\n127.0.0.1:6099]
    F[Data Relay Link backend\n127.0.0.1:7000]
    P[Published ports\n6000-6098]

    C -->|HTTPS enrollment| FE
    C -->|Data Relay Link control over WSS| FE
    FE --> A
    FE --> F
    U --> P
```

<Warning>
  In single-443 mode, backend ports `6099` and `7000` are not intended to be Internet-exposed.
</Warning>

## Side-by-side summary

| Question                       | Direct                   | single-443                                  |
| ------------------------------ | ------------------------ | ------------------------------------------- |
| Normal default?                | **Yes**                  | No, use for constrained enterprise networks |
| Public Data Relay Link control | TCP 443                  | TCP 443 via WSS frontend                    |
| Public enrollment HTTPS        | TCP 6099                 | TCP 443                                     |
| Published services             | 6000-6098                | 6000-6098                                   |
| Backend 6099                   | public/listen by default | loopback backend                            |
| Backend 7000                   | not normal Direct path   | loopback Data Relay Link backend            |

## Server behind firewall/NAT

Either mode can be placed behind a firewall/NAT device if the public endpoints are forwarded correctly.

```mermaid theme={null}
flowchart LR
    C[Remote client] -->|public endpoint| F[Firewall / NAT]
    F -->|DNAT| S[Private Data Relay Link server]
```

For a Direct example with public-to-private port translation, see [Firewall & NAT](/deployment/firewall-nat).

## Switching modes

Direct ↔ single-443 is a maintenance-window cutover, not a zero-downtime change. Persistent identity, CA, token, registry, and port reservations are designed to remain, but the client transport must match the new topology.

After any mode change:

```bash theme={null}
sudo drlink show status
sudo drlink doctor
```

<Note>
  Do not solve TLS interception/reset by disabling certificate verification or by switching enrollment to plain HTTP. The supported management plane remains verified HTTPS.
</Note>