App connectors

Send traffic for chosen internet domains out through one machine, so services with an IP allow-list only need one address.

Some services only let in addresses you've approved: a company GitHub, a cloud database, a client's firewall. An app connector is a machine in your network that sends traffic for those services' domains out from its own public address. You add that one address to the allow-list, and your whole team gets in through it, wherever they are.

Only traffic for the domains you choose takes this route. Everything else goes out the normal way.

Set one up

Pick a connector machine. It should be always on and have a fixed public address, like an office server or a small cloud VM. Linux, macOS and Windows machines can be connectors.
Create an app. In the dashboard, open Apps, add an app with a name (like github), and list its domains:
text
```
github.com
*.github.com
```
*.github.com covers the domain and everything under it.
Choose the connector for the app. You can list several; devices use the first one that's online, in the order you list them.
Add the connector's public address to the service's allow-list.

How it works

The connector looks up the app's domains every minute and reports the addresses to the coordination service. Devices in your network then send traffic for those addresses to the connector, which forwards it to the internet. Names looked up under a *. domain stay routed for an hour.

Rules and limits

1 to 50 domains per app, app names up to 64 characters
Up to 512 routed addresses per connector per app
Only public IPv4 addresses are routed: never private, loopback, link-local, multicast or 100.64.0.0/10 addresses
Devices that use an app are automatically allowed to reach the connector on port 53 (DNS)

Access

Name an app in an access rule as app:<app ID> to decide who can use it.