Skip to main content

​
Server Installation

The Data Relay Link server is the public entry point. It runs the bundled relay-server runtime plus enrollment, registry, lifecycle, and drlink management components. For the simplest first deployment, use an Ubuntu 24.04 x86_64 server with a direct public IP. Ubuntu 24.04 is the clearest Real E2E-validated server baseline for the stable release; Ubuntu 22.04 has automated portability coverage but is not presented as an equivalent real-host validation claim.
If you do not already have a static public IP or spare Linux server, use the screenshot-based OCI Free Tier Server Preparation guide to prepare an Always Free-eligible Ubuntu VM with a Reserved Public IPv4 address first.
Other Linux families have different validation levels; see Supported Platforms.

​
Choose the topology first

The original field guide summarized the three common network layouts in one diagram. Use it as a visual map before choosing the actual product mode. Data Relay Link deployment layouts: Direct, NAT, and Enterprise single-443
The diagram shows Direct, Direct behind NAT, and Enterprise single-443 as network layouts. NAT itself is not a third product mode; the product modes are Direct and Enterprise single-443.
NAT is a network topology, not a third Data Relay Link mode. The two product modes are Direct and Enterprise single-443.

​
Direct mode defaults

TCP/22 is optional for your own administrative SSH access to the server; it is not part of the Data Relay Link tunnel path.

​
If the server is behind NAT

Example: Clients must use the public control/enrollment endpoints, not the server’s private address. See Firewall & NAT.

​
Install the current stable release

Current published stable: v2.2.1 with bundled/tested relay engine v0.71.0.
Use the immutable stable tag for field installs rather than mutable main unless you intentionally want development behavior.

​
What the installer asks for

Expect questions about:
  1. public IP / public control endpoint
  2. optional public service hostname
  3. internal server IP
  4. Direct vs Enterprise single-443
  5. public and local control ports
  6. public and local enrollment/allocator ports
  7. published service range
The installer does not create AWS Security Groups, OCI Security Lists, external firewall/NAT rules, UFW/firewalld/iptables policy, or DNS records.

​
Verify immediately after installation

doctor is read-only and checks installation state, permissions, PKI, service state, registry consistency, topology, and common network problems.

​
Persistent state you should understand

These files/state protect trust, identity, and public-port reservations. Do not manually edit them during normal operation.

​
Server readiness checklist

  • required systemd services are active
  • drlink doctor has no blocking finding
  • public control/enrollment endpoints are reachable from the client network
  • published service range is allowed by the server-side firewall/NAT
  • if using DNS, the public hostname resolves to the correct public entry point

​
Next

Last modified on September 10, 2026