Manage mobile farm device traffic proxying

When proxying, mobile farm device traffic is routed through your device, such as a server or laptop. To connect the devices, you create a secure TLS connection—a tunnel—between them. You can filter outbound traffic from a mobile farm device using built-in firewall rules. Read more about the firewall in the Manage firewall rules for mobile farm device traffic proxying.

note

For example, traffic proxying can be used if you need to connect devices in the internal corporate network perimeter to mobile farm devices for testing purposes. You connect a mobile farm device and one of the devices with access to the corporate network via a tunnel. From there, traffic can be routed to other devices on that network.

To begin, you need to prepare proxying. You only need to do this once; after that, you can start and stop traffic proxying whenever necessary.

Prepare traffic proxying

1. Add a Proxy key.
2. Configure the firewall.
3. Download the reverse proxy utility file to your device.

1. Add a Proxy key

You can add a Proxy key to your profile or to another user's profile and then use it to proxy mobile farm device traffic. If you are configuring proxying for automated testing, add a Proxy key for a service user.

The key will be available in all projects to which the user has been added.

To your profile

1. In the control panel, in the upper right corner, open the menu (account number) and select Profile.
2. Go to the Access → Proxy keys tab.
3. Click Add key.
4. Enter a key name.
5. Click Generate key.
6. In the Key field, click and save the key in a secure place—it cannot be viewed after closing the window.

To another user's profile

Keys can be added to other users by the Account Owner and users with the iam.admin role.

1. In the control panel, on the top menu, click IAM.

2. Go to the section with the required user type:

   • Users — for users with access to the control panel;
   • Service users — for service users.

3. Open the user page → tab Access.

4. In the Proxy keys block, click Add key.

5. Enter a key name.

6. Click Generate key.

7. In the Key field, click and save the key in a secure place—it cannot be viewed after closing the window.

2. Configure the firewall

Firewall rules will be applied only when you start traffic proxying.

All inbound traffic is allowed; this cannot be changed.

All outbound traffic is denied by default. You can configure rules for outbound traffic — add rules or allow all traffic. The rules will be applied to all protocols.

If you use rules for domain names, keep in mind that domain names are resolved on your device and the firewall filters traffic before DNS resolution.

For your information

For example, you added a rule to allow traffic for the IP address 1.1.1.1. If you send a request to example.com, which is associated with IP address 1.1.1.1 on your device, this rule will not apply. When passing through the firewall, the IP address and domain name are not yet associated. The rule will only be applied to this request if you allow traffic for example.com.

Add rules

1. In the control panel, on the top menu, click Products and select Mobile Farm.

2. Ensure you are in the correct project. If you need to change the project, open the project menu (name of the current project) and select a project.

3. Go to the Firewall section.

4. Click Create rule.

5. Select an action for the rule.

6. Enter an IP address, subnet, or domain name. The domain name is resolved on your device, so the firewall filters traffic before DNS resolution. When adding a rule, consider what you use in requests to your device.

   To apply the rule to all addresses, click All addresses.

7. Enter one port or a port range.

   To apply the rule to all ports, click All ports.

8. Click . The rule will be added to the top of the list.

9. To add another rule, repeat steps 4–8.

10. Optional: to change the order of the rules, drag and drop the rule to the required position.

Rules are executed in the order they appear in the list — from top to bottom. The first matching rule takes effect. If the first rule allows traffic, the traffic will be allowed, even if rules below it are set to deny.

Allow all traffic

1. In the control panel, on the top menu, click Products and select Mobile Farm.
2. Ensure you are in the correct project. If you need to change the project, open the project menu (name of the current project) and select a project.
3. Go to the Firewall section.
4. Click Allow all traffic.

3. Download the reverse proxy utility file to your device

1. On the device you are connecting via a tunnel to the mobile farm device, download the reverse proxy utility file.

2. Optional: verify the utility file's integrity:

   2.1. Download the hash sum file to the same directory where you downloaded the utility file. The name of the hash sum file must match the utility file name, but with the .sha256 extension.

   2.2. Open the CLI.

   2.3. Ensure the hashes match:

   sha256sum -c <file_name>

   Specify <file_name> — the name of the file with the .sha256 extension that you downloaded in step 2.1.

3. Save the name of the reverse proxy utility file you downloaded in step 1. For Windows, the file name includes the .exe extension.

4. If your device is running macOS, remove the built-in security system restrictions for the utility file:

   4.1. Make the utility file executable:

   chmod +x <file_name>

   Specify <file_name> — the name of the utility file you saved in step 3.

   4.2. Remove the quarantine attribute from the utility file:

   xattr -d com.apple.quarantine <file_name>

   Specify <file_name> — the name of the utility file you saved in step 3.

Start traffic proxying

You can run one tunnel on your device at a time. Multiple mobile farm devices can be connected to this tunnel. To do this, traffic proxying must be enabled on each mobile farm device.

1. Start the tunnel on your device.
2. Enable traffic proxying on the mobile farm device.

1. Start the tunnel on your device

1. On your device where you downloaded the utility file, open the CLI.

2. Start the tunnel.

   <file_name> start --token <proxy-key>

   Specify:

   • <file_name> — the name of the file you saved when downloading the reverse proxy utility file to your device in step 3. For Windows, the file name includes the .exe extension.
   • <proxy-key> — the Proxy key you saved when preparing proxying in step 1. A Proxy key can only be used to open one tunnel. When enabling proxying on a mobile farm device, the tunnel can be identified by the Proxy key used.

2. Enable traffic proxying on the mobile farm device

1. In the control panel, on the top menu, click Products and select Mobile Farm.

2. Ensure you are in the correct project. If you need to change the project, open the project menu (name of the current project) and select a project.

3. Go to the Devices section.

4. In the device row, click on the device manufacturer and model.

5. Click Start using.

6. On the toolbar above the device management window, click . If you have one open tunnel, traffic proxying will start immediately.

7. If you have multiple open tunnels, select the Proxy key you used to start the required tunnel in step 1.

Stop traffic proxying

Traffic proxying will stop if:

• the tunnel is closed;
• or if you disable proxying on the mobile farm device. Use this if you will continue using the device and need internet access, or if you are finishing work with the device.

Closing the tunnel

After the tunnel is closed, mobile farm device traffic will not be routed anywhere. There will be no internet access on the device until you disable proxying on the mobile farm device.

You can close the tunnel yourself, or it may close automatically.

To close the tunnel:

• in your device terminal, press Ctrl + C;
• or close your device terminal;
• or turn off your device.

The tunnel may close automatically if:

• no mobile farm device has been connected to the tunnel for 30 minutes;
• the Proxy key used to start the tunnel is deleted.

If you need to continue traffic proxying after closing the tunnel, restart the tunnel on your device.

Disable traffic proxying on the mobile farm device

1. In the control panel, on the top menu, click Products and select Mobile Farm.

2. Ensure you are in the correct project. If you need to change the project, open the project menu (name of the current project) and select a project.

3. Go to the Devices section.

4. In the device row, click on the device manufacturer and model.

5. Click Start using.

6. On the toolbar above the device management window, click .