Remote access without VPN: reach a Gateway through a relay

A relay lets people on the internet reach an SSOGEN Gateway that sits inside a private network, without opening any inbound port to that network. The Gateway dials out to the relay and keeps the connection open; browsers connect to the relay, which passes the encrypted traffic through to the Gateway. SSOGEN also orders and renews the Gateway’s certificates for the relay’s names automatically (ACME, the standard behind free public certificates). This guide covers both: turning the Uplink relay on for a Gateway group, and what SSOGEN does about the certificates.

The examples use the fictional company Acme Corp: SSOGEN at https://sso.acme.example, a Gateway group eg_acme_hq in a network with no inbound access, and a relay on the domain relay.example.net.

Terms used here

Relay: a server on the internet that forwards encrypted connections between browsers and Gateways that dial it. The relay in this guide is one your own operations team runs (the Gateway installation guide, inside the Edge archive, covers it). A relay operated by SSOGEN is offered by arrangement.
Uplink: a Gateway group’s setting to dial a relay. It is None or Relay.
Relay registration: your organization’s admission to a relay. It has a Label, the first part of your relay names, such as acme.
Admit string: the one-time text, starting ssogen-relay-admit:, that lets the relay admit your registration. It is shown once and expires after 24 hours.
Relay names: the host names your Gateway group answers to through the relay, under your label.
CAA record: a DNS record on the relay’s domain that says which certificate authority, and which account at it, may issue certificates for a name.

If your Gateway can accept connections from your users or from your load balancer, you do not need a relay. If an application sits in a network the Gateway cannot reach, use an Outbound Connector instead: a connector reaches applications from a Gateway, and a relay reaches the Gateway from the internet. The two can be used together.

Before you start

A Gateway of version 4.3.0 or later, enrolled and online, in the group you want to put behind the relay (see Install and enroll an SSOGEN Gateway).
You are a super administrator.
The Gateway can open outbound HTTPS connections to SSOGEN and to the relay (port 443 and the relay’s tunnel port 9946). Place it in a separate network zone that allows only those outbound connections. The console reminds you: “Place this Gateway in a segmented network zone with an egress allowlist. It dials the relay and SSOGEN, and it is the only machine in the zone that holds your certificate keys.”
If you run SSOGEN on your own servers, SSOGEN itself must reach the certificate authority and its certificate-transparency search over HTTPS, and your people must be able to reach SSOGEN by another route: the relay carries the Gateway’s traffic, not SSOGEN’s own address. The SSOGEN installation guide lists the settings.

1. Create the relay registration

Open Secure access, then App Proxy routes. Choose the Gateway group, then open a route with Add a route or by selecting one.
Below the route form, find Uplink relay. It reads “A Gateway in a private network can dial out to a relay, so users reach its apps and Remote Access resources without any inbound firewall rule.”
Under Relay registrations, type your Label (1 to 63 lower-case letters, digits or hyphens, not starting or ending with a hyphen), for example acme, and select Create registration. A wrong label shows “Use 1 to 63 lower-case letters, digits or hyphens, not starting or ending with a hyphen.”
The Admit string for acme appears once, with its expiry. Copy it and select I have copied it. It cannot be shown again; if you lose it, remove the registration and create another.
Give the admit string to whoever runs the relay. On a relay your own team runs, the operator pastes it at the prompt of the relay’s admit command, on every relay host (the relay section of the Gateway installation guide, inside the Edge archive, has the steps and the second-person approval that the relay can require).

The registration’s line shows where it stands: Waiting for the relay hosts to admit it, Waiting for approval, Live, or Suspended by the relay operator. Remove acme takes the registration away: the relay stops routing the name at its next check and the Gateways lose their relay names.

If you do not see Relay registrations on this page, your registrations are handled for you; ask SSOGEN.

2. Turn the uplink on

In Uplink relay, set Uplink to Relay: this group dials a relay. (None: users reach this group directly is the other choice.)
In Relay registration, choose the registration, for example acme. The select stays empty (Choose a registration) until one exists.
Leave Treat the client address a relay reports as trustworthy off unless you operate the relay. When it is off, an address that arrived through a relay never counts as inside a trusted network in a sign-in policy, because the relay’s host is not yours.
Select Save uplink. The page says “Uplink saved. Gateways pick it up within a few minutes.”

Once the registration is Live, Relay names lists the names your group answers to (“No names yet. They appear when the relay registration is live.” until then). Use those names as the hostnames of your App Proxy routes.

Changing a Remote Access resource’s uplink or reach path clears its stored password, never an SSH key (see Remote Access).

3. Certificates are ordered for you

When the uplink is on, SSOGEN orders and renews the certificate for your relay names itself. Under Relay names, the section Certificate shows the state:

The console says	What it means
No certificate ordered yet	Nothing has been ordered.
Ordering a certificate	An order is in progress.
Certificate valid, then Valid until a date	The Gateway serves the certificate. SSOGEN renews it before it ends.
Renewing the certificate	A renewal is in progress.
The last order failed. SSOGEN tries again on its own.	The order failed; Last error gives a short code. SSOGEN retries; no action is needed unless it keeps failing.
CAA missing: the CAA record below is not published or names another account, so no certificate is ordered. Ask the relay operator to publish it.	See below.

What SSOGEN does for you:

It creates one account with the certificate authority for your organization (Let’s Encrypt by default) and agrees to the authority’s subscriber terms for it.
It proves control of each relay name with the TLS-ALPN-01 challenge, answered by your Gateway through the relay. No DNS change is needed for the challenge.
It orders and renews the certificate, and shows its state here.
It searches public certificate-transparency logs once a day by default. If a certificate for your names appears that SSOGEN did not order, the audit trail records edge.certificate.unexpected_issuance and every super administrator is emailed.

The CAA record

Before SSOGEN orders anything it checks that the DNS of the relay’s domain allows only your SSOGEN account to issue for your names. The record is shown under Certificate in a copy box labelled CAA record for the relay operator, in this form:

acme.relay.example.net CAA 0 issue "letsencrypt.org; accounturi=<your account>; validationmethods=tls-alpn-01"

The record is published on the relay’s domain by whoever runs the relay: your own operations team for a relay you run, and SSOGEN for a relay it operates, where SSOGEN also runs the DNS and the certificate account. A relay your team runs prints the record for the operator to apply. Until it is published, the state stays CAA missing and no certificate is ordered. Nothing is issued without it.

When a failed order or an unexpected certificate needs your attention, every super administrator gets an email, when a mail server is set up and the switch App Proxy certificate and tunnel alerts is on (Settings, SMTP). The audit trail records edge.certificate.acme_failed.

4. Watch the link

If the Gateway should hold a tunnel to the relay and does not for three minutes, or SSOGEN’s own check of the relayed path fails (it runs every five minutes), the Uplink relay section shows “An uplink alarm is raised.” with a line such as Uplink down at relay-1 (Gateway edge_acme_hq_01), since 14:02 or Relayed path failing at relay-1, and “Requests through the relay can fail until it clears.” The audit trail records edge.tunnel.alarm_raised and edge.tunnel.alarm_cleared, and super administrators get one email per alarm.

If you cannot reach the application, check in this order: the registration is Live; the Certificate state is Certificate valid; the Gateway shows online on Gateways; the Gateway’s host can make outbound connections to the relay on 443 and 9946.

Outbound Connector for private networks
Publish an internal web application through the App Proxy, for the route and the hostnames.
Troubleshooting the gateway