> ## Documentation Index
> Fetch the complete documentation index at: https://link.datarelay.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Use case: One LAN gateway, multiple services

> Use one DRLink Agent as the relay for two independent internal servers.

# Publish multiple internal LAN services through one Agent

**Outcome:** A single Agent Host acts as a relay for one internal SSH host and one internal HTTPS application. The destination machines do not each need their own Agent.

**Example:** Agent Host at 10.20.0.10 can reach SSH host 10.20.0.21:22 and HTTPS host 10.20.0.22:443. The Agent makes outbound connectivity to the DRLink Server.

## Step 1 — check LAN and enrollment

![Real Data Relay Link CLI capture — Agent Host menu: choose 1 to manage its Remote Services; 3 opens ConfigurationBundle.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/agent-guided-menu.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=5752f997527236ce70218caf77a3dc4a)

*Figure 1. Agent Host menu: choose 1 to manage its Remote Services; 3 opens ConfigurationBundle. CLI output example; sensitive addresses and hostnames are masked.*

First verify that gateway **10.20.0.10** can reach both target IPs/ports. For a new Agent select the **two LAN targets** in Zero-Touch below. Do not use SSH only to publish the gateway's own SSH unnecessarily. Prepare LAN routing/firewalls separately.

## New gateway: enroll both services with Zero-Touch

On the Server run `set enrollment zero-touch`, select **Linux**, name/describe the host and choose **Choose Remote Services**.

| Selection | Service ID | Target host | Target port |
| - | - | - | - |
| Add SSH | lan-ssh | 10.20.0.21 | 22 |
| Add HTTPS | lan-web | 10.20.0.22 | 443 |

Enter the target's existing OS username for SSH, add both services, then **Finish**. Run the generated command once on the **gateway**; Objects, Remote Services and public endpoints are automatic. On the Agent inspect `show remote-services` and each actual service name, then continue at **Step 4**. Steps 2–3 below are only for manual additions to an existing Agent.

## Step 2 — describe both destinations and services

![Real Data Relay Link CLI capture — Service Object type choices: 1 SSH/TCP 22, 3 HTTPS/TCP 443, or 6 Fixed TCP as needed.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/service-object-type.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=42a9c0489cf532fba96595426ad4f46d)

*Figure 2. Service Object type choices: 1 SSH/TCP 22, 3 HTTPS/TCP 443, or 6 Fixed TCP as needed. CLI output example; sensitive addresses and hostnames are masked.*

![Real Data Relay Link CLI capture — Real Network Object creation confirmation; this alone does not publish a Remote Service.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/network-object-created.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=e854966ca5d57fe25e13c96627b0c57f)

*Figure 3. Real Network Object creation confirmation; this alone does not publish a Remote Service. CLI output example; sensitive addresses and hostnames are masked.*

**Server REPL:**

```text theme={null}
set network-object lan-ssh-host type ip value 10.20.0.21
set network-object lan-web-host type ip value 10.20.0.22
set service-object ssh type tcp port 22
set service-object web-https type tcp port 443
show network-objects
show service-objects
```

Each Network Object is **one destination**. A Network Group or CIDR range is not a valid Remote Service destination.

## Step 3 — create two Remote Services on the gateway

![Real Data Relay Link CLI capture — Captured Remote Services inventory: distinguish DEGRADED from DISABLED; a listed endpoint is not proof of live traffic.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/agent-services.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=adfc77e440bd1beeb16212314f989462)

*Figure 4. Captured Remote Services inventory: distinguish DEGRADED from DISABLED; a listed endpoint is not proof of live traffic. CLI output example; sensitive addresses and hostnames are masked.*

**Gateway Agent REPL:**

```text theme={null}
show status
set remote-service lan-ssh destination lan-ssh-host service ssh enabled
set remote-service lan-web destination lan-web-host service web-https enabled
show remote-service lan-ssh
show remote-service lan-web
```

Each service has its own stable Server endpoint. An Agent can own more than one Remote Service; the target does not have to be the Agent itself.

## Step 4 — test both real applications

From the approved **outside workstation**:

```bash theme={null}
ssh -p <ssh-public-port> <actual-ssh-user>@<drlink-public-host>
```

For HTTPS, create/confirm the DNS and application certificate for the **publicly used host name**, then open in a browser:

```text theme={null}
https://<certificate-matching-public-host>:<web-public-port>/
```

Expected: SSH reaches **10.20.0.21:22** and the browser reaches **10.20.0.22:443**. DRLink passes through backend application TLS; it does not replace that host's certificate. Do not bypass invalid certificate validation to claim success.

## Step 5 — check isolation

**Server REPL:**

```text theme={null}
show managed-host <gateway-managed-host-name> remote-services
show remote-access
system audit
```

Confirm that there are only two intended Remote Services. Set a narrow Remote Access WHITELIST for the gateway and each selected service if the endpoint must not be broadly reachable. Do not assume an existing Rule creates a third tunnel.

## Recovery / cleanup

If one destination fails, the other service can remain operational. On the gateway, use `system diagnostics` and `system synchronize`; fix the target service or LAN route. To retire an individual mapping, use `unset remote-service lan-ssh` or `unset remote-service lan-web` on the owning Agent after reviewing any service interruption. Do not delete the gateway's Managed Host just to remove one mapping.

## Current behavior check — 2026-10-28

A reachable LAN target may legitimately be saved DEGRADED until current runtime verification succeeds. The owning Agent is the Relay Host; never create the Remote Service on the Server. Destination + Service duplication on that Agent is rejected.

[Current CLI inventory](https://link.datarelay.run/drlink/cli-reference.md) · [MCP compatibility](https://link.datarelay.run/reference/mcp-validation.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.