> ## Documentation Index
> Fetch the complete documentation index at: https://link.datarelay.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Use case: Fixed TCP remote database

> Reach a legacy TCP database through an Agent-owned Fixed TCP Remote Service.

# Publish a legacy database via Fixed TCP Remote Service

**Outcome:** An external database support client reaches one internal TCP database listener, through a stable DRLink Remote Access endpoint and a restricted source policy.

**Example:** approved DBA public IP 203.0.113.10 → Server → branch gateway Agent → Oracle-like listener at 10.50.1.20:1521. Use your actual protocol and database client.

> [!NOTE]
>
> This is a **Fixed TCP Remote Service** (inbound Remote Access), not the separate outbound Internet Access fixed-listener feature. It does not configure HTTP CONNECT, a transparent proxy or a full VPN.

## Step 1 — verify target network and credentials

From the gateway Agent OS, verify that **10.50.1.20:1521** is reachable. Keep database TLS, DB accounts, encryption and authentication configured on the destination. DRLink does not supply database credentials.

## Step 2 — describe destination and Fixed TCP port

![Real Data Relay Link CLI capture — Service Object type choices: 1 SSH/TCP 22, 3 HTTPS/TCP 443, or 6 Fixed TCP as needed.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/service-object-type.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=42a9c0489cf532fba96595426ad4f46d)

*Figure 1. Service Object type choices: 1 SSH/TCP 22, 3 HTTPS/TCP 443, or 6 Fixed TCP as needed. CLI output example; sensitive addresses and hostnames are masked.*

![Real Data Relay Link CLI capture — Real CLI confirmation that a Fixed TCP Service Object was saved; endpoint/DB connectivity must be tested separately.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/fixed-object-created.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=e7d51b72cc740559339b4dcfb12f2083)

*Figure 2. Real CLI confirmation that a Fixed TCP Service Object was saved; endpoint/DB connectivity must be tested separately. CLI output example; sensitive addresses and hostnames are masked.*

**Server REPL:**

```text theme={null}
set network-object branch-db type ip value 10.50.1.20
set network-object dba-public type ip value 203.0.113.10
set service-object oracle-db type fixed-tcp port 1521
show service-object oracle-db
show managed-hosts
```

Verify the enrolled gateway's Managed Host name (example **branch-gateway**). A Fixed TCP Service Object uses a different endpoint pool from regular TCP; do not change a running Remote Service across those pool classes in place.

## Step 3 — restrict access before publishing

**Server REPL:**

```text theme={null}
set remote-access dba-to-db mode whitelist source dba-public destination branch-gateway service oracle-db enabled
set remote-access enabled
test remote-access source dba-public destination branch-gateway service oracle-db
```

Expected: **ALLOW** for the approved source. Review all matching Rules and the `show remote-access` state for unintended sources.

## Step 4 — create the service on the gateway Agent

![Real Data Relay Link CLI capture — Captured Remote Services inventory: distinguish DEGRADED from DISABLED; a listed endpoint is not proof of live traffic.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/agent-services.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=adfc77e440bd1beeb16212314f989462)

*Figure 3. Captured Remote Services inventory: distinguish DEGRADED from DISABLED; a listed endpoint is not proof of live traffic. CLI output example; sensitive addresses and hostnames are masked.*

**Gateway Agent REPL:**

```text theme={null}
set remote-service branch-oracle destination branch-db service oracle-db enabled
show remote-service branch-oracle
```

Record the public endpoint. Expect **HEALTHY** only when the currently connected relay/runtime and destination can be verified.

## Step 5 — verify the database workflow

From the approved external DBA workstation:

```bash theme={null}
nc -vz <drlink-public-host> <allocated-fixed-tcp-public-port>
```

A successful TCP probe only proves a socket handshake. Complete the actual protocol-specific database login/query using your vendor's database client pointed at the public endpoint. Confirm a rejected connection from a different public source and correlate the policy audit.

## Recovery and teardown

If connection fails, check Server policy and the gateway's `system diagnostics`, the target listener and external port mapping. The host's database encryption and account controls remain mandatory. Retire only this service with `unset remote-service branch-oracle` on the owning gateway Agent after reviewing DB-client interruptions; do not retire the whole Managed Host.

## Current behavior check — 2026-10-28

Fixed TCP remains a Service Object subtype using its separate Server endpoint pool. An existing Remote Service cannot switch across standard TCP/Fixed TCP pools in place. Read the allocated endpoint from show remote-service branch-oracle, rather than assuming the public port equals the database target port.

[Current CLI inventory](https://link.datarelay.run/drlink/cli-reference.md) · [MCP compatibility](https://link.datarelay.run/reference/mcp-validation.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.