Managing Tunnels

Installing an app on a production device switches the tunnel of every port in its port template on. Users with the network privilege on the device can deactivate and reactivate tunnels from the device’s app settings.

Activating a Tunnel

1. Open a device in your project.
2. Find the running app in the apps list.
3. Click the settings icon.
4. Go to the Remote Access section.
5. Toggle the tunnel on for the desired port.

When activated:

• HTTP/HTTPS ports: A URL on the tunnel domain is generated. Click the URL or the globe icon on the device’s app list to open the service in your browser. It is private: it opens only for users signed in to IronFlock with access to the device, or for requests carrying an IronFlock account API key, unless the port is switched Public (HTTP and HTTPS ports only), which admits anyone - for example a cloud webhook.
• TCP/UDP ports: A remote port number is allocated and shown in the settings. Use this port with your client application (e.g., VNC viewer, TIA Portal).

The Globe Icon

When a tunnel is active, a globe icon appears on the device’s app card in the map view and app list. Clicking it opens the main remote access URL (the port marked with main: true in the port template).

Deactivating a Tunnel

Toggle the tunnel off in the Remote Access section of the app settings. The tunnel’s URL or remote port stops working immediately.

Audit Logging

Every tunnel activation and deactivation is logged:

• Who activated or deactivated the tunnel
• When the action occurred
• Which port was affected

Additionally, actual usage of the tunnel (connections through the proxy) is logged. This audit trail is available in the device’s settings under the audit log panel.

Required Privileges

To switch a tunnel on or off, switch a port public, or reserve a port, a user needs the network privilege on the device. The project owner and the user who added the device have it by default.