# Tunnel behind NAT

URL: https://docs.nolay.ru/en/guides/tunnel/
Updated: 2026-09-23

> Open project sites to the internet when the server has no public address or inbound ports are closed.

The tunnel is for a server at home, in an office or with a provider without a public IPv4, where inbound connections on 80 and 443 do not reach it. The agent opens a second outgoing connection to the Nolay relay, and visitors reach the site through it.

## How it works

1. The agent keeps an outgoing WSS connection to `relay.nolay.ru`, the same way as with the hub.
2. Each project gets a permanent address like `k3n7x2q9ab.tunnel-noray.ru`. The project name is not in the address, the address never changes and is never given to anyone else.
3. A visitor's request arrives at the relay, goes through the tunnel to the agent and on to the project container.

Tunnel addresses live on a separate domain, `tunnel-noray.ru`, not `nolay.ru`: this way project content does not share cookies and reputation with the panel.

## How to turn it on

1. Open the server in the panel, the Projects tab, the Tunnel block.
2. Pick a mode:
   - **On**: the tunnel always works;
   - **Auto**: the tunnel turns on when the server is behind NAT and off with a public address;
   - **Off**: sites are reachable only at the server address.
3. Wait for the Connected state. Project addresses appear in the block.

*Tunnel mode and project addresses.*

Owners and admins of the organization can turn the tunnel on, and only with a confirmed email. On the free plan the tunnel can be turned on a day after sign-up.

## Your own domain through the tunnel

Point your domain at the tunnel address with a `CNAME` record:

| Type | Name | Value |
|---|---|---|
| `CNAME` | `app.example.com` | `k3n7x2q9ab.tunnel-noray.ru` |

Then add the domain to the project as in [Domains and HTTPS](/en/guides/domains/).

## Limits

| What | How much |
|---|---|
| Traffic | by plan, 5 GiB a month on the free plan |
| Speed | up to 20 Mbit/s per tunnel |
| Concurrent requests | up to 200 per tunnel |

On the free plan a visitor sees a warning page on the first visit saying the site is served through a Nolay tunnel. Paid plans do not have it.

The relay records only request metadata: project address, response code, duration. Paths, headers and bodies are not recorded.

## Troubleshooting

| What you see | Why | What to do |
|---|---|---|
| The switch is off with an explanation | Email not confirmed, or a day has not passed on the free plan | Confirm the email or wait |
| “Tunnel removed by operator” | Nolay staff blocked the tunnel, the reason is in the banner | Contact support |
| The Waiting for agent state | The agent did not connect to the relay | Check outgoing access to `relay.nolay.ru:443` and `journalctl -u nolay-agent` |

## Next

Read [what is stored where](/en/concepts/data/).