# App connectors

> Send traffic for chosen internet domains out through one machine, so services with an IP allow-list only need one address.

Some services only let in addresses you've approved: a company GitHub, a cloud database, a client's firewall. An **app connector** is a machine in your network that sends traffic for those services' domains out from **its own public address**. You add that one address to the allow-list, and your whole team gets in through it, wherever they are.

Only traffic for the domains you choose takes this route. Everything else goes out the normal way.

## Set one up

1. **Pick a connector machine.** It should be always on and have a fixed public address, like an office server or a small cloud VM. Linux, macOS and Windows machines can be connectors.
2. **Create an app.** In the dashboard, open **Apps**, add an app with a name (like `github`), and list its domains:

   ```text
   github.com
   *.github.com
   ```

   `*.github.com` covers the domain and everything under it.
3. **Choose the connector** for the app. You can list several; devices use the first one that's online, in the order you list them.
4. **Add the connector's public address** to the service's allow-list.

## How it works

The connector looks up the app's domains every minute and reports the addresses to the coordination service. Devices in your network then send traffic for those addresses to the connector, which forwards it to the internet. Names looked up under a `*.` domain stay routed for an hour.

## Rules and limits

- 1 to 50 domains per app, app names up to 64 characters
- Up to 512 routed addresses per connector per app
- Only public IPv4 addresses are routed: never private, loopback, link-local, multicast or `100.64.0.0/10` addresses
- Devices that use an app are automatically allowed to reach the connector on port 53 (DNS)

## Access

Name an app in an [access rule](/features/access-controls) as `app:<app ID>` to decide who can use it.