Tunneling
dxflow exposes a local service to the internet over a secure tunnel, giving it a public subdomain. Traffic flows between a central proxy hub and one or more bridge nodes.
Roles
| Role | What it does | When to use it |
|---|---|---|
| Proxy (hub) | Hands out subdomains, accepts incoming public traffic, and routes it to the right bridge. Manages authentication, SSL, and traffic limits. | Run a hub on a public host you control — one hub serves many bridges (requires a license). |
| Bridge (node) | Connects to a hub, receives a subdomain, and forwards traffic between the hub and your local service. Reconnects automatically. | Run a bridge on the machine where your local service lives (requires a license). |
Setting up tunnels
A tunnel has two halves and you run both: a hub on a public host, and a bridge on each machine whose service you want to expose. dxflow operates no shared public hub, so start your own hub before connecting any bridge.
Run your own proxy hub
A hub needs a public IP, a domain you control, and a wildcard DNS record (*.your-domain.com) pointing at it. Set the domain that subdomains are allocated under, then boot in proxy mode:
dxflow config set proxy-domain "your-domain.com"
dxflow boot up --proxy --https --daemon
proxy-domain has no default — boot up --proxy refuses to start until you set it, since the hub allocates every subdomain under it. Running a hub gives you full control over authentication, traffic limits, and subdomain allocation. For enterprise licensing or a managed hub deployment, contact us or see licensing.
Connect bridge nodes
Bridges require a bridge-enabled license, which is not part of the general license (see licensing).
On each private machine, point the bridge at your hub and boot in bridge mode:
dxflow config set bridge-gateway "https://your-domain.com/"
dxflow config set bridge-identity "mynode01"
dxflow boot up --bridge --daemon
bridge-gateway is the URL of your hub — scheme http or https and a hostname, with no port and no path beyond /. It has no default, so boot up --bridge refuses to start until you point it at a hub you run.
bridge-identity becomes the node's subdomain and is required too: two letters followed by 1–10 alphanumerics (^[a-z]{2}[a-z0-9]{1,10}$).
Once connected, the bridge receives a subdomain from the hub and your local service is reachable through it.
Subdomains
Each bridge gets a short, unique subdomain under the hub's proxy-domain (for example ab1234567890.your-domain.com). The hub assigns it automatically and handles SSL for it, so traffic to the subdomain is served over HTTPS.
Manual management
dxflow proxy list # List active proxies on the hub
dxflow proxy remove <identity> # Remove a specific proxy allocation
dxflow proxy prune # Remove unused proxies
There is no proxy create command — allocations are created automatically when a bridge connects. The proxy CLI supports only list, remove, and prune.
dxflow bridge list # List bridge connections
dxflow bridge disconnect <identity> # Disconnect a bridge temporarily
dxflow bridge connect <identity> # Reconnect a bridge
dxflow bridge prune # Clean up inactive bridges
Traffic limits
| Scope | Default |
|---|---|
| Proxy hub | Connections and traffic are unlimited until your license sets a limit. |
| Bridge nodes | Connections and traffic are unlimited until your license sets a limit. |
Connection and traffic limits are defined by your license.
Security
A bridge can only forward to a private, loopback, or local address — it cannot expose a service that is already public on the internet. This keeps tunnels pointed at services on your own machine or network.
Troubleshooting
| Error | Cause / Fix |
|---|---|
| PROXY domain must be specified | boot up --proxy ran without proxy-domain. Set the domain your hub allocates subdomains under. |
| BRIDGE gateway must be specified | boot up --bridge ran without bridge-gateway. Set the URL of the hub you run. |
| invalid identity | bridge-identity is unset or malformed. It must be two letters followed by 1–10 alphanumerics. |
| Bridge never reaches a hub | bridge-gateway points at a host that isn't running dxflow boot up --proxy. Check it with dxflow config get bridge-gateway. |
| Proxy not available | The identity doesn't exist on the hub — the proxy was removed or never created. Check dxflow proxy list. |
| Proxy not connected | The connection dropped or the network was interrupted. Verify bridge status and connectivity. |
| Bridge not allowed | Your license doesn't include the bridge feature. Upgrade to a bridge-enabled license (guide). |
| Traffic limit exceeded | The bridge reached the traffic limit set by your license. Upgrade for higher limits (guide). |
Debugging steps:
- Enable debug logging:
dxflow --log-level=debug boot up --proxy - Check that your local service is running and reachable.
- Confirm the bridge is connected with
dxflow bridge list.
API integration
REST APIs for programmatic control.
Proxy hub:
curl http://hub/api/proxy/ # List active proxies
curl -X POST http://hub/api/proxy/ # Create a new proxy
curl -X DELETE http://hub/api/proxy/prune/ # Remove inactive proxies
Bridge node:
curl http://node/api/bridge/ # List bridge connections
# Reconnect a specific bridge (identity in body/query, not the path)
curl -X PUT http://node/api/bridge/connect/ -d '{"identity":"<identity>"}'
curl -X DELETE http://node/api/bridge/prune/ # Clean up inactive bridges