Tunnel behind NAT
Open project sites to the internet when the server has no public address or inbound ports are closed.
The tunnel is for a server at home, in an office or with a provider without a public IPv4, where inbound connections on 80 and 443 do not reach it. The agent opens a second outgoing connection to the Nolay relay, and visitors reach the site through it.
How it works
- The agent keeps an outgoing WSS connection to
relay.nolay.ru, the same way as with the hub. - Each project gets a permanent address like
k3n7x2q9ab.tunnel-noray.ru. The project name is not in the address, the address never changes and is never given to anyone else. - A visitor's request arrives at the relay, goes through the tunnel to the agent and on to the project container.
Tunnel addresses live on a separate domain, tunnel-noray.ru, not nolay.ru: this way project content does not share cookies and reputation with the panel.
How to turn it on
- Open the server in the panel, the Projects tab, the Tunnel block.
- Pick a mode:
- On: the tunnel always works;
- Auto: the tunnel turns on when the server is behind NAT and off with a public address;
- Off: sites are reachable only at the server address.
- Wait for the Connected state. Project addresses appear in the block.
Owners and admins of the organization can turn the tunnel on, and only with a confirmed email. On the free plan the tunnel can be turned on a day after sign-up.
Your own domain through the tunnel
Point your domain at the tunnel address with a CNAME record:
Then add the domain to the project as in Domains and HTTPS.
Limits
On the free plan a visitor sees a warning page on the first visit saying the site is served through a Nolay tunnel. Paid plans do not have it.
The relay records only request metadata: project address, response code, duration. Paths, headers and bodies are not recorded.
Troubleshooting
Next
Read what is stored where.