> ## Documentation Index
> Fetch the complete documentation index at: https://link.datarelay.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Use case: Private HTTPS console

> Access an internal HTTPS management application through a controlled Remote Service.

# Reach a private HTTPS administration console

**Outcome:** A support workstation securely reaches one appliance's HTTPS admin UI; you do not expose the entire appliance LAN.

**Example:** Agent on a reachable LAN host → firewall console 10.40.10.8:8443 → externally reserved DRLink TCP port.

## Step 1 — confirm the existing application

On the Agent/gateway OS, establish that **10.40.10.8:8443** is reachable and the admin application has a trusted certificate for the name end users will use. DRLink Remote Access uses **TLS passthrough**, not TLS termination. A certificate-name mismatch is a deployment problem, not a reason to disable verification.

## New Agent: configure the console with Zero-Touch

On the Server run `set enrollment zero-touch`, select **Linux**, name/describe the host, then **Choose Remote Services → Add HTTPS**. Enter Service ID `firewall-ui`, Target host **10.40.10.8**, Target port **8443**, then **Finish**. Run the generated command on the gateway that can reach that LAN.

The required Objects and Remote Service are automatic. Inspect `show remote-services` and the actual service detail on the Agent, then continue at **Step 4**. Steps 2–3 below are only for additional services on an existing Agent. Prepare required source restrictions before publishing.

## Step 2 — register the destination and service

![Real Data Relay Link CLI capture — Service Object type choices: 1 SSH/TCP 22, 3 HTTPS/TCP 443, or 6 Fixed TCP as needed.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/service-object-type.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=42a9c0489cf532fba96595426ad4f46d)

*Figure 1. Service Object type choices: 1 SSH/TCP 22, 3 HTTPS/TCP 443, or 6 Fixed TCP as needed. CLI output example; sensitive addresses and hostnames are masked.*

**Server REPL:**

```text theme={null}
set network-object firewall-console type ip value 10.40.10.8
set service-object console-https type tcp port 8443
show network-object firewall-console
show service-object console-https
```

Prefer setting the required Remote Access WHITELIST **before** publishing this sensitive UI. See [office-only allowlist](https://link.datarelay.run/use-cases/office-allowlist.md).

## Step 3 — publish only this port

![Real Data Relay Link CLI capture — On the owning Agent Host select 2 Create Remote Service; this does not create the service on the Server.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/agent-create-service-menu.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=6d4924f03d588729dd296b28abc0015a)

*Figure 2. On the owning Agent Host select 2 Create Remote Service; this does not create the service on the Server. CLI output example; sensitive addresses and hostnames are masked.*

After [enrolling an Agent](https://link.datarelay.run/guides/enrollment.md) that can reach the target LAN IP, use the **Agent REPL**:

```text theme={null}
set remote-service firewall-ui destination firewall-console service console-https enabled
show remote-service firewall-ui
```

Record the reserved public endpoint shown by the CLI.

## Step 4 — test from an authorized workstation

Configure a DNS name such as **console.example.net** to reach the DRLink public address. The backend HTTPS certificate must match **console.example.net** (or a separately verified name that the application actually presents). Access:

```text theme={null}
https://console.example.net:<reserved-public-port>/
```

For a DNS test that preserves both the URL hostname and TLS verification, replace placeholders and use:

```bash theme={null}
curl --resolve console.example.net:<reserved-public-port>:<drlink-public-ip> https://console.example.net:<reserved-public-port>/
```

Expected: the appliance login page over validated TLS, not a DRLink management login. Authenticate using the application's own identity mechanism.

## Step 5 — verify restricted access

![Real Data Relay Link CLI capture — Remote Access before any rules: No Policy, unmatched ALLOW. A new published service is not automatically source-restricted.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/server-inbound-default.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=6ccc484894e73895ddf128ee290fe3a5)

*Figure 3. Remote Access before any rules: No Policy, unmatched ALLOW. A new published service is not automatically source-restricted. CLI output example; sensitive addresses and hostnames are masked.*

**Server REPL:**

```text theme={null}
show remote-access
show managed-host <relay-host> remote-services
system audit
```

From a second, unapproved source, test access and confirm the **policy denial**, not merely a network timeout. If Remote Access has **no policy**, it defaults to **ALLOW**: publishing alone is not sufficient access restriction.

## Recovery

* **Certificate error:** correct DNS/certificate/SNI on the application, not a proxy rewrite; never turn off TLS verification to pass a test.
* **Browser timeout:** check external firewall, reserved port, Agent connectivity and target 10.40.10.8:8443.
* **Unexpected ALLOW:** inspect all matching Remote Access rules and their effective mode; `set remote-access disabled` is **ALLOW ALL**, not a safe emergency deny.
* **Retire console:** remove **firewall-ui** on the owning Agent after impact review, leaving unrelated LAN services untouched.

## Current behavior check — 2026-10-28

The application keeps its own TLS and login. Verify its certificate hostname at the allocated public endpoint without skipping certificate checks. After a reconnect, synchronize on the owning Agent and check the current Remote Service generation before declaring recovery.

[Current CLI inventory](https://link.datarelay.run/drlink/cli-reference.md) · [MCP compatibility](https://link.datarelay.run/reference/mcp-validation.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.