Skip to main content

​
Publish multiple internal LAN services through one Agent

Outcome: A single Agent Host acts as a relay for one internal SSH host and one internal HTTPS application. The destination machines do not each need their own Agent. Example: Agent Host at 10.20.0.10 can reach SSH host 10.20.0.21:22 and HTTPS host 10.20.0.22:443. The Agent makes outbound connectivity to the DRLink Server.

​
Step 1 — check LAN and enrollment

Real Data Relay Link CLI capture — Agent Host menu: choose 1 to manage its Remote Services; 3 opens ConfigurationBundle. Figure 1. Agent Host menu: choose 1 to manage its Remote Services; 3 opens ConfigurationBundle. CLI output example; sensitive addresses and hostnames are masked. First verify that gateway 10.20.0.10 can reach both target IPs/ports. For a new Agent select the two LAN targets in Zero-Touch below. Do not use SSH only to publish the gateway’s own SSH unnecessarily. Prepare LAN routing/firewalls separately.

​
New gateway: enroll both services with Zero-Touch

On the Server run set enrollment zero-touch, select Linux, name/describe the host and choose Choose Remote Services. Enter the target’s existing OS username for SSH, add both services, then Finish. Run the generated command once on the gateway; Objects, Remote Services and public endpoints are automatic. On the Agent inspect show remote-services and each actual service name, then continue at Step 4. Steps 2–3 below are only for manual additions to an existing Agent.

​
Step 2 — describe both destinations and services

Real Data Relay Link CLI capture — Service Object type choices: 1 SSH/TCP 22, 3 HTTPS/TCP 443, or 6 Fixed TCP as needed. Figure 2. Service Object type choices: 1 SSH/TCP 22, 3 HTTPS/TCP 443, or 6 Fixed TCP as needed. CLI output example; sensitive addresses and hostnames are masked. Real Data Relay Link CLI capture — Real Network Object creation confirmation; this alone does not publish a Remote Service. Figure 3. Real Network Object creation confirmation; this alone does not publish a Remote Service. CLI output example; sensitive addresses and hostnames are masked. Server REPL:
Each Network Object is one destination. A Network Group or CIDR range is not a valid Remote Service destination.

​
Step 3 — create two Remote Services on the gateway

Real Data Relay Link CLI capture — Captured Remote Services inventory: distinguish DEGRADED from DISABLED; a listed endpoint is not proof of live traffic. Figure 4. Captured Remote Services inventory: distinguish DEGRADED from DISABLED; a listed endpoint is not proof of live traffic. CLI output example; sensitive addresses and hostnames are masked. Gateway Agent REPL:
Each service has its own stable Server endpoint. An Agent can own more than one Remote Service; the target does not have to be the Agent itself.

​
Step 4 — test both real applications

From the approved outside workstation:
For HTTPS, create/confirm the DNS and application certificate for the publicly used host name, then open in a browser:
Expected: SSH reaches 10.20.0.21:22 and the browser reaches 10.20.0.22:443. DRLink passes through backend application TLS; it does not replace that host’s certificate. Do not bypass invalid certificate validation to claim success.

​
Step 5 — check isolation

Server REPL:
Confirm that there are only two intended Remote Services. Set a narrow Remote Access WHITELIST for the gateway and each selected service if the endpoint must not be broadly reachable. Do not assume an existing Rule creates a third tunnel.

​
Recovery / cleanup

If one destination fails, the other service can remain operational. On the gateway, use system diagnostics and system synchronize; fix the target service or LAN route. To retire an individual mapping, use unset remote-service lan-ssh or unset remote-service lan-web on the owning Agent after reviewing any service interruption. Do not delete the gateway’s Managed Host just to remove one mapping.

​
Current behavior check — 2026-10-28

A reachable LAN target may legitimately be saved DEGRADED until current runtime verification succeeds. The owning Agent is the Relay Host; never create the Remote Service on the Server. Destination + Service duplication on that Agent is rejected. Current CLI inventory · MCP compatibility
Last modified on October 29, 2026