Skip to main content
This Quick Start connects a function on the Network acme-prod to a web service at 10.20.3.7:8080, behind the tunnel chicago-dc. Two hosts within the user’s network run the tunnel process.

​
Prerequisites

  • A Network with a WireGuard Interface, and a function shipped with a network binding to that interface. Here the Network is acme-prod and the binding is PRIVATE_NET.
  • A host within the user’s network that reaches the subnet. It needs an outbound connection to Telnyx. It needs no public IP address, no inbound port, and no root.
  • The telnyx-edge CLI, v0.5.14 or newer, on the workstation and on that host.

​
Create the Tunnel

Workstation
Output
The token is the tunnel process’s only credential. Telnyx shows it once.

​
Run the Tunnel Process

On the tunnel host, start the process with the token:
Tunnel host
Output
The process opens an outbound TLS connection to Telnyx and logs one line when it connects. It keeps running in the foreground, and it reconnects on its own when its connection drops. Without --token, it reads the token from TELNYX_TUNNEL_TOKEN. Run the same command on a second host within the user’s network. Both processes serve the tunnel. Telnyx spreads requests across them, and either one carries requests when the other stops.

​
Check the Tunnel

Workstation
Output
healthy means at least one process is connected. Lifecycle lists the statuses.

​
Route the Subnet

Add a route on the Network that sends the subnet to the tunnel:
Workstation
Output
The route list shows it beside the route that the WireGuard Interface installed:
Workstation
Output

​
Reach the Subnet From the Function

The function reaches the subnet through its network binding:
Function
The function needs no redeploy and no change to func.toml. It picks up the new route within about a minute. The web service in this Quick Start answers with the address it saw the connection from. That address is the tunnel host’s, not the function’s:
Output

​
Remove the Route

Workstation
Output
The function’s requests to 10.20.0.0/16 then fail. The tunnel stays healthy.

​
Stop the Tunnel Process

Stop the process on each host with Ctrl+C or SIGTERM. The tunnel turns inactive once no process is connected.

​
Delete the Tunnel

Workstation
Output
A tunnel that a route names cannot be deleted. Lifecycle shows what the CLI reports instead.