OCI Free Tier Data Relay Link Server

This guide takes you from an empty OCI tenancy to a working Data Relay Link v2.2.1 server and the first SSH client. It reuses the actual OCI Console screenshots from the original deployment guide while updating all commands and product behavior to the current Data Relay Link stable release.

OCI Console labels, Free Tier eligibility, capacity, and pricing can change. Treat the current Console’s Always Free Eligible indicator and cost estimate as the final source before creating resources. Oracle also documents that idle Always Free compute instances may be reclaimed after a sustained low-usage period, so do not treat a Free Tier VM as an SLA-backed production host without reviewing the current OCI policy.

What you will build

The high-resolution architecture diagram below shows the same deployment from the operator’s point of view: one OCI Reserved Public IP fronts the Data Relay Link server, while each remote client publishes one or more local or reachable LAN services through its assigned persistent public ports.

Data Relay Link SSH access architecture using an OCI Reserved Public IP

For this OCI walkthrough we use Enterprise single-443 because it gives a simple public policy:

Public ingress	Purpose
TCP 22	OCI server administration; restrict to your admin IP `/32`
TCP 443	Data Relay Link control over WSS + enrollment/management HTTPS
TCP 6000-6098	Published client services; restrict further when practical
TCP 6099	Do not expose in single-443
TCP 7000	Do not expose in single-443

Direct mode is also fully supported. In Direct mode, TCP 6099 is a separate public enrollment/management endpoint.

10-minute map

Step	OCI / Data Relay Link action	Value used in this guide
1	Create VCN	`data-relay-vcn` / `10.0.0.0/16`
2	Internet Gateway + route	`0.0.0.0/0` → Internet Gateway
3	Create public subnet	`data-relay-public-subnet` / `10.0.0.0/24`
4	Security List	admin SSH, `443`, `6000-6098`
5	Create VM	Ubuntu 24.04 x86_64 / `VM.Standard.E2.1.Micro` when eligible
6	Public address	attach a Reserved Public IPv4
7	SSH	`ubuntu@<RESERVED-IP>`
8	Install Data Relay Link	immutable `v2.2.1`
9	Verify	`drlink doctor` + listener checks
10	Add first client	current one-line Zero-Touch enrollment

Part I — Build the OCI network and VM

1. Open Virtual Cloud Networks

From the OCI Home page, enter Networking → Virtual Cloud Networks. The image below is the original Picture 1 from the field-deployment Word guide; it is used without conversion or downscaling.

Picture 1. OCI Home - enter Networking / Instances

2. Create the VCN, Internet Gateway, route, subnet, and ingress rules

Use these values:

VCN name             data-relay-vcn
VCN IPv4 CIDR         10.0.0.0/16
Internet Gateway      data-relay-internet-gateway
Default route         0.0.0.0/0 -> Internet Gateway
Public subnet         data-relay-public-subnet
Public subnet CIDR    10.0.0.0/24
Subnet type           Regional / Public

2-1. Create the VCN

Open Virtual Cloud Networks → Create VCN.

Picture 2. Select Create VCN in Virtual Cloud Networks

Set the VCN name to data-relay-vcn and the IPv4 CIDR to 10.0.0.0/16.

Picture 3. Configure the VCN name and IPv4 CIDR

2-2. Create the Internet Gateway

In the new data-relay-vcn, open the Gateways tab and create an Internet Gateway.

Picture 4. Create an Internet Gateway from the VCN Gateways tab

Use data-relay-internet-gateway as the example gateway name.

Picture 5. Internet Gateway name example: data-relay-internet-gateway

2-3. Add the Internet route to the default route table

Open the Routing tab and select Default Route Table for data-relay-vcn.

Picture 6. Select the default route table from the VCN Routing tab

Choose Route Rules → Add Route Rules.

Add the following route:

Target Type        Internet Gateway
Destination CIDR   0.0.0.0/0
Target             data-relay-internet-gateway

Picture 8. Add the 0.0.0.0/0 route through the Internet Gateway

Confirm that the route rule is present after saving.

Picture 9. Confirm the applied route rule

2-4. Start creating the public subnet

Open the Subnets tab and select Create Subnet.

Picture 10. Start creating the public subnet

2-5. Configure the public subnet

Create the public subnet with the following values:

Name           data-relay-public-subnet
Subnet Type    Regional
IPv4 CIDR      10.0.0.0/24
Route Table    Default Route Table for data-relay-vcn
Subnet Access  Public Subnet

2-6. Configure the Security List

Open the VCN’s Security Lists page.

Picture 12. Open the VCN Security Lists page

Review the ingress rules on the Default Security List.

Picture 13. Review the Default Security List ingress rules

For Data Relay Link in single-443 mode, add TCP 443 and the published-service range TCP 6000-6098. Keep SSH 22 for administration, preferably restricted to your administrator public IP /32.

Picture 14. Add ingress rules for TCP 443 and TCP 6000-6098

Confirm that the ingress rules were applied.

Picture 15. Confirm the applied ingress rules

Recommended single-443 ingress

Protocol	Destination port	Source	Purpose
TCP	22	your admin public IP/32	SSH administration
TCP	443	client networks or `0.0.0.0/0` if required	WSS control + enrollment/management
TCP	6000-6098	only networks/users that need the services	published services

In single-443 mode, do not create public OCI ingress or DNAT for 6099 or 7000. They are internal loopback backends. Also do not blindly copy a broad All Protocols rule from a generic OCI tutorial.

If you do not want the whole 6000-6098 range exposed, allow only the service ports that are actually assigned, and constrain source CIDRs where possible.

3. Create the Ubuntu compute instance

Recommended values for this walkthrough:

Name           data-relay-link-server
Image          Canonical Ubuntu 24.04 LTS x86_64
Shape          VM.Standard.E2.1.Micro (when Console marks it eligible/free)
VCN            data-relay-vcn
Subnet         data-relay-public-subnet
Boot volume    default

Before creating the Compute Instance, confirm that the VCN, Internet Gateway, route, public subnet, and Security List created above are ready, then open Compute → Instances.

Picture 16. Confirm the network resources and open Compute

3-1. Enter the basic Compute Instance settings

Start on Create compute instance and confirm the instance name and placement.

Picture 17. Compute Instance basic settings

3-2. Select Canonical Ubuntu 24.04

Choose Change image and select Canonical Ubuntu 24.04. Treat the image/version currently shown in OCI Console as authoritative.

Unless your environment requires something different, keep the Security settings at their defaults.

Picture 19. Security settings - use the defaults unless required otherwise

3-3. Select the VCN and public subnet

Under Primary VNIC, select the data-relay-vcn and data-relay-public-subnet created earlier.

Picture 20. Select the existing data-relay-vcn and data-relay-public-subnet

3-4. Disable automatic public IPv4 and configure the SSH key

Because this guide attaches a Reserved Public IP later, turn off Automatically assign public IPv4 address. Then upload an existing SSH public key or let OCI generate a new key pair, and store the private key securely.

Picture 21. Disable automatic public IPv4 and create/download the SSH key

3-5. Review the boot volume

Unless you have a separate storage requirement, keep the boot-volume settings at their defaults.

Picture 22. Boot Volume settings - keep the defaults unless required otherwise

3-6. Review before creating the instance

Confirm that the image is Ubuntu 24.04 and that the shape, VCN/subnet, and SSH key match the intended configuration before creating the instance.

Picture 23. Review the Ubuntu 24.04 and VM.Standard.E2.1.Micro configuration

3-7. Confirm the created instance and Free/Eligible indicator

Confirm the instance state in the Compute Instances list.

Picture 24. Confirm the created instance in the instance list

The Always Free indicator shown in the original screenshot reflects the OCI Console at the time of the field deployment. Current Free Tier/Eligible status can vary by region and tenancy, so use the current Console’s eligibility and cost display as the final authority.

Picture 25. Confirm the Always Free indicator and select the created instance

Important points from the original deployment:

choose the existing data-relay-vcn
choose data-relay-public-subnet
allow OCI to assign the private IPv4 automatically
turn off Automatically assign public IPv4 address for the final persistent-IP design
generate/download or upload an SSH public key
if OCI generated the key pair, store the private key securely; do not assume it can be downloaded again later
keep the boot volume simple unless you have another storage requirement

VM.Standard.E2.1.Micro availability and Free Tier treatment are tenancy/region dependent. If the Console does not show it as eligible at creation time, do not assume this guide makes it free.

4. Attach a Reserved Public IPv4

From the instance details page, open Networking → Primary VNIC.

Picture 26. Open the instance Networking page and Primary VNIC

In the VNIC, open IP administration → Primary Private IP.

Picture 27. Open VNIC IP administration and the Primary Private IP

If an ephemeral public IP is currently attached, edit the private IP and select No public IP first.

Picture 28. Select No public IP in Edit Private IP Address

Confirm that no public IP is currently assigned.

Picture 29. Confirm that the public IP is unassigned

Edit the private IP again and choose:

Public IP type        Reserved public IP
Option                Create new Reserved IP Address
Name                  data-relay-reserved-public-ip

Picture 30. Create and attach a new Reserved Public IP

A Reserved Public IP is the address you should treat as the persistent public entry point for Data Relay Link. OCI performs the public/private mapping outside the Ubuntu guest, so ip addr on the VM normally shows the private 10.x.x.x address rather than the public address. Confirm that the Reserved Public IP is attached to the Primary Private IP. The public IP value in this screenshot has been masked before publication.

Picture 31. Confirm the Reserved Public IP is attached

Picture 32 (successful SSH session) from the original Word guide is still not published because it contains field connection details. The SSH procedure below uses the <RESERVED-PUBLIC-IP> placeholder instead.

5. Test SSH access

For OCI Ubuntu images the default account is normally ubuntu:

chmod 600 ~/Downloads/<private-key-file>
ssh -i ~/Downloads/<private-key-file> ubuntu@<RESERVED-PUBLIC-IP>

Then verify the host:

uname -m
cat /etc/os-release
systemctl --version

Expected for this guide:

Architecture   x86_64
OS             Ubuntu 24.04 LTS
PID 1          systemd

Part II — Install Data Relay Link v2.2.1

6. Prepare only the packages you need

sudo apt update
sudo apt -y install curl ca-certificates

Check time and the host firewall before installation:

timedatectl status
sudo ufw status
sudo iptables -S INPUT

The older field notes contained an environment-specific procedure that flushed the Ubuntu INPUT chain. Do not blindly run iptables -F or change the default INPUT policy just for Data Relay Link. OCI Security Lists/NSGs and the Ubuntu host firewall are separate security boundaries; configure each deliberately for your environment.

7. Install the immutable stable release

curl -fsSL \
  https://raw.githubusercontent.com/xdr-labs/frp-auto-deploy/v2.2.1/dist/bootstrap-server.sh \
  | sudo bash

For this OCI walkthrough, choose Enterprise single-443 when the installer asks for topology. Conceptually the result is:

Public host                  <RESERVED-PUBLIC-IP or DNS>
Deployment mode              Enterprise single-443
Public control               TCP 443
Data Relay Link backend                  127.0.0.1:7000
Public enrollment/management HTTPS 443
Allocator backend            127.0.0.1:6099
Published service range      TCP 6000-6098
Bundled/tested relay engine             0.71.0
Project                       2.2.1

Do not copy the v2.1.0 environment-variable installation command from the old guide. The current field path is the immutable v2.2.1 installer above and its current interactive questions.

8. Verify the server

sudo drlink show version
sudo drlink show status
sudo drlink doctor

For single-443, also inspect the listeners:

sudo ss -lntp | grep -E ':(443|6099|7000)\b'

The important exposure model is:

0.0.0:443       public frontend
0.0.1:7000    frps backend
0.0.1:6099    allocator backend

From another machine on the Internet:

nc -vz -w 3 <RESERVED-PUBLIC-IP> 443

drlink doctor should have no blocking failure before onboarding clients.

9. Verify reboot persistence

sudo reboot

After reconnecting:

sudo drlink show status
sudo drlink doctor
sudo ss -lntp | grep -E ':(443|6099|7000)\b'

The services and listener topology should return without re-enrollment or manual reconstruction.

Part III — Connect the first client

10. Generate a Zero-Touch SSH enrollment

On the Data Relay Link server:

sudo drlink create enrollment \
  --one-line \
  --ssh \
  --ssh-user <EXISTING-CLIENT-USER> \
  --label <CLIENT-LABEL>

The command printed by the server contains a short-lived, one-time bootstrap credential. Copy the exact generated command to the remote client instead of reconstructing it manually.

Treat a generated Zero-Touch command as sensitive until it expires or is used. Do not paste a live ticket into public chat, documentation, or issue trackers.

On the client, run the generated line. Data Relay Link does not create the SSH user or sshd; they must already exist.

11. Verify the client and connect

On the client:

sudo drlink show version
sudo drlink show status
sudo drlink show services
sudo drlink doctor

On the server:

sudo drlink show clients
sudo drlink show client <CLIENT-ID>
sudo drlink show client <CLIENT-ID> services

Then use the assigned persistent public service port:

ssh -p <PUBLIC-SERVICE-PORT> <CLIENT-USER>@<RESERVED-PUBLIC-IP>

The client does not manually choose the public port. The Data Relay Link server allocates and persists the service reservation.

Final checklist

Troubleshooting split

When a published service cannot be reached, test both halves independently:

# From an external workstation: Internet -> Data Relay Link server
nc -vz -w 3 <RESERVED-PUBLIC-IP> <PUBLIC-SERVICE-PORT>

# From the Data Relay Link client: client -> local/LAN target
nc -vz -w 3 <TARGET-IP> <TARGET-PORT>

This quickly separates an OCI/public-ingress problem from a client-to-target problem.

​OCI Free Tier Data Relay Link Server

​What you will build

​10-minute map

​Part I — Build the OCI network and VM

​1. Open Virtual Cloud Networks

​2. Create the VCN, Internet Gateway, route, subnet, and ingress rules

​2-1. Create the VCN

​2-2. Create the Internet Gateway

​2-3. Add the Internet route to the default route table

​2-4. Start creating the public subnet

​2-5. Configure the public subnet

​2-6. Configure the Security List

​Recommended single-443 ingress

​3. Create the Ubuntu compute instance

​3-1. Enter the basic Compute Instance settings

​3-2. Select Canonical Ubuntu 24.04

​3-3. Select the VCN and public subnet

​3-4. Disable automatic public IPv4 and configure the SSH key

​3-5. Review the boot volume

​3-6. Review before creating the instance

​3-7. Confirm the created instance and Free/Eligible indicator

​4. Attach a Reserved Public IPv4

​5. Test SSH access

​Part II — Install Data Relay Link v2.2.1

​6. Prepare only the packages you need

​7. Install the immutable stable release

​8. Verify the server

​9. Verify reboot persistence

​Part III — Connect the first client

​10. Generate a Zero-Touch SSH enrollment

​11. Verify the client and connect

​Final checklist

​Troubleshooting split

​Next steps

Publish Services

Firewall & NAT

​Official OCI references

OCI Free Tier Data Relay Link Server

What you will build

10-minute map

Part I — Build the OCI network and VM

1. Open Virtual Cloud Networks

2. Create the VCN, Internet Gateway, route, subnet, and ingress rules

2-1. Create the VCN

2-2. Create the Internet Gateway

2-3. Add the Internet route to the default route table

2-4. Start creating the public subnet

2-5. Configure the public subnet

2-6. Configure the Security List

Recommended single-443 ingress

3. Create the Ubuntu compute instance

3-1. Enter the basic Compute Instance settings

3-2. Select Canonical Ubuntu 24.04

3-3. Select the VCN and public subnet

3-4. Disable automatic public IPv4 and configure the SSH key

3-5. Review the boot volume

3-6. Review before creating the instance

3-7. Confirm the created instance and Free/Eligible indicator

4. Attach a Reserved Public IPv4

5. Test SSH access

Part II — Install Data Relay Link v2.2.1

6. Prepare only the packages you need

7. Install the immutable stable release

8. Verify the server

9. Verify reboot persistence

Part III — Connect the first client

10. Generate a Zero-Touch SSH enrollment

11. Verify the client and connect

Final checklist

Troubleshooting split

Next steps

Official OCI references