> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tunnel Quick Start

> Reach a subnet behind a Tunnel from an Edge Compute function, without any modification to the user's router or firewall.

This Quick Start connects a function on the [*Network*](https://developers.telnyx.com/docs/network/overview.md) `acme-prod` to a web service at `10.20.3.7:8080`, behind the tunnel `chicago-dc`. Two hosts within the user's network run the tunnel process.

The diagram shows the setup this Quick Start builds. An Edge Compute function
with the network binding `PRIVATE_NET` reaches the *Network* `acme-prod`
through its WireGuard Interface, `acme-prod-wg`, on `172.27.0.0/24`. A route
on `acme-prod` sends `10.20.0.0/16` to the tunnel `chicago-dc`. Two tunnel
hosts, `dc1-tunnel-a` and `dc1-tunnel-b`, run the tunnel's token and open
outbound TLS connections to Telnyx, with no port forwarding.
Either tunnel host dials the web service at `10.20.3.7:8080`, which sees the
connection from that host.

## Prerequisites

* A *Network* with a WireGuard Interface, and a function shipped with a [network binding](https://developers.telnyx.com/docs/edge-compute/runtime/bindings/network.md) to that interface. Here the *Network* is `acme-prod` and the binding is `PRIVATE_NET`.
* A host within the user's network that reaches the subnet. It needs an outbound connection to Telnyx. It needs no public IP address, no inbound port, and no root.
* The `telnyx-edge` CLI, v0.5.14 or newer, on the workstation and on that host.

## Create the Tunnel

```bash Workstation theme={null}
telnyx-edge tunnel create chicago-dc
```

```text Output theme={null}
Created tunnel chicago-dc (6afe50f3-bcff-48e9-93e8-4a906a91067e)
Token (shown once, store it now):
tnl_…
```

The token is the tunnel process's only credential. Telnyx shows it once.

## Run the Tunnel Process

On the tunnel host, start the process with the token:

```bash Tunnel host theme={null}
telnyx-edge tunnel run --token tnl_…
```

```text Output theme={null}
INF connected  site=tunnel-relay.telnyx.com:8443  conn=0  tunnel=6afe50f3-bcff-48e9-93e8-4a906a91067e  relay=tunnel-relay.telnyx.com:8443
```

The process opens an outbound TLS connection to Telnyx and logs one line when it connects. It keeps running in the foreground, and it reconnects on its own when its connection drops. Without `--token`, it reads the token from `TELNYX_TUNNEL_TOKEN`.

Run the same command on a second host within the user's network. Both processes serve the tunnel. Telnyx spreads requests across them, and either one carries requests when the other stops.

## Check the Tunnel

```bash Workstation theme={null}
telnyx-edge tunnel get chicago-dc
```

```text Output theme={null}
NAME         STATUS    CONNECTIONS
----------   -------   -----------
chicago-dc   healthy   2
...
```

`healthy` means at least one process is connected. [Lifecycle](https://developers.telnyx.com/docs/network/tunnel/concepts/lifecycle.md) lists the statuses.

## Route the Subnet

Add a route on the *Network* that sends the subnet to the tunnel:

```bash Workstation theme={null}
telnyx-edge network route add acme-prod 10.20.0.0/16 --tunnel chicago-dc
```

```text Output theme={null}
Added route 1a826484-8bfe-4346-b9fc-26aa70a22ccc  acme-prod  10.20.0.0/16 -> tunnel chicago-dc  (status: active)
```

The route list shows it beside the route that the WireGuard Interface installed:

```bash Workstation theme={null}
telnyx-edge network route list acme-prod
```

```text Output theme={null}
ID                                     CIDR            NEXT HOP                                                   ORIGIN       STATUS
------------------------------------   -------------   --------------------------------------------------------   ----------   ------
1a826484-8bfe-4346-b9fc-26aa70a22ccc   10.20.0.0/16    tunnel chicago-dc                                          static       active
03aefa24-609b-4fce-b88a-0dc9afeed95d   172.27.0.0/24   wireguard_interface 03aefa24-609b-4fce-b88a-0dc9afeed95d   attachment   active
```

## Reach the Subnet From the Function

The function reaches the subnet through its network binding:

```ts Function theme={null}
import { env } from "@telnyx/edge-runtime";

const response = await env.PRIVATE_NET.fetch("http://10.20.3.7:8080/");
```

The function needs no redeploy and no change to `func.toml`. It picks up the new route within about a minute.

The web service in this Quick Start answers with the address it saw the connection from. That address is the tunnel host's, not the function's:

```json Output theme={null}
{"service": "site-dest", "address": "10.20.3.7:8080", "client": "10.20.0.10", "path": "/"}
```

## Remove the Route

```bash Workstation theme={null}
telnyx-edge network route delete 1a826484-8bfe-4346-b9fc-26aa70a22ccc
```

```text Output theme={null}
Deleted route 1a826484-8bfe-4346-b9fc-26aa70a22ccc
```

The function's requests to `10.20.0.0/16` then fail. The tunnel stays `healthy`.

## Stop the Tunnel Process

Stop the process on each host with `Ctrl+C` or `SIGTERM`. The tunnel turns `inactive` once no process is connected.

## Delete the Tunnel

```bash Workstation theme={null}
telnyx-edge tunnel delete chicago-dc
```

```text Output theme={null}
Deleted tunnel chicago-dc (6afe50f3-bcff-48e9-93e8-4a906a91067e)
```

A tunnel that a route names cannot be deleted. [Lifecycle](https://developers.telnyx.com/docs/network/tunnel/concepts/lifecycle.md#deletion) shows what the CLI reports instead.