Some of the systems you want to automate live on a private network, behind a firewall, with no public address. A tunnel network lets Tines 3B reach them without opening any inbound ports.
You create the network in settings, then run a lightweight exit-node container on a host inside your network. It makes a single outbound connection to Tines 3B, and your workflows can then reach the destinations you allow. This guide walks you through setting one up.
Note: Before you start, make sure you have:
The tunnel feature enabled. Tunnel networks are turned on per deployment. If you don't see a network option when you go to create one, it isn't enabled for your tenant yet, and you'll need to reach out to us to turn it on.
The right permission. Creating a network needs the create networks permission. Managing access to a network or deleting one needs the manage networks permission.
A host inside your private network. You'll run a Docker container there that can reach the internal destinations you want to automate, and can make outbound connections to Tines 3B.
To create the network, head to the networking section in your settings.
Select the plus button and choose network.
Give the network a clear name, for example "Production VPC."
Add the destinations this tunnel can reach. For each one, pick a type and enter a value:
Hostname pattern. A hostname glob such as
*.internal.acme.com.CIDR. An IP range such as
10.0.0.0/16.
Select Add after each destination, then select Create.
When you select create, Tines 3B creates a client certificate for the tunnel. This usually takes a second or two.
As soon as the network is provisioned, Tines 3B shows a tunnel token. This is a single value that carries everything the exit node needs to connect: the gateway endpoint, the network's certificate and key, and the certificate authority it trusts.
Note: Copy the token and store it somewhere safe right away. It's shown only once and won't be visible after you close the dialog. If you lose it, you'll need to create a new network to bring another exit node online.
Run the exit node
The provisioning screen gives you the exact commands to run, filled in for your network. Run them on a host inside your private network. Because the exit node dials out to Tines 3B over an encrypted mTLS connection, you don't need any inbound firewall rules.
The steps are:
Sign in to the registry. The exit-node image is hosted at
oci.tines.com. Authenticate Docker on the host before pulling it.Run the exit node. Start the container with your tunnel token and the destinations it should serve. The screen fills these in for you.
Check the logs. Tail the container's logs to confirm the tunnel handshake succeeded.
The run command looks like this, with your own token and CIDRs in place:
docker run \
-d \
--pull=always \
--restart=always \
--name=tunnel-exit-node \
-e TUNNEL_TOKEN='<your tunnel token>' \
-e DESTINATION_CIDRS='10.0.0.0/16' \
oci.tines.com/3b-tunnel/tunnel-exit-node:latest
Once the container is running and the logs show a successful handshake, the tunnel is live.
Grant access to the network
Creating a network doesn't automatically make it available to everyone. On the access tab, you decide who can route traffic through it:
Open the network and go to the access tab.
Add members, groups, or a whole space.
Choose the role each one should have.
Once a space has access, workflows in that space can send their requests through the tunnel to reach your private destinations.
Control destinations with rules
The rules tab in networking is a separate, tenant-wide control over where steps can send traffic. Each rule allows or denies a destination, defined by a hostname pattern or CIDR, and optionally a specific port. Managing rules needs the Manage egress rules permission. Use rules when you want an extra layer of allow or deny policy on top of your networks.
To create a rule, go to settings, open networking, and select the rules tab.
Click the plus button, then choose rule.
Set the action to allow or deny.
Choose hostname or CIDR, then enter the destination.
Enter a port, or leave it blank to match any port, then select add rule.
Your rule takes effect for new workflow traffic once it's saved.
Manage or remove a network
Back on the networks tab, each network shows its type and when it was created, and whether it's disabled. To remove one, open its menu and select delete.
Note: Deleting a network is permanent, and any steps that route through it will stop reaching their destinations, so make sure nothing depends on it first.