Manage mobile farm device traffic proxying

When proxying, traffic from mobile farm devices is routed through your device, for example, a server or a laptop. To connect the devices, you create a secure TLS connection—a tunnel—between them. Outgoing traffic from a mobile farm device can be filtered using built-in firewall rules. Read more about the firewall in the Managing firewall rules for proxying mobile farm device traffic instruction.

note

For example, traffic proxying can be used if you need to connect devices in the internal perimeter of a corporate network to mobile farm devices for testing. You connect the mobile farm device and one of the devices that has access to the corporate network with a tunnel. From there, traffic can be routed to other devices on that network.

To begin working, you need to prepare proxying. You only need to do this once, after which you can start and stop traffic proxying whenever necessary.

Prepare traffic proxying

1. Add a Proxy key.
2. Configure the firewall.
3. Download the reverse proxy utility file to your device.

1. Add a Proxy key

A proxy key can be added to your profile or another user's profile and then used to proxy traffic from mobile farm devices. If you are configuring proxying for automated tests, add a proxy key for a service user.

The key will be available in all projects to which the user has been added.

To your profile

1. In the control panel, in the upper right corner, open the menu (account number) and select Profile.
2. Go to the Access → Proxy keys tab.
3. Click Add key.
4. Enter a key name.
5. Click Generate key.
6. In the Key field, click and save the key in a secure place—it cannot be viewed after the window is closed.

To another user's profile

Keys can be added to other users by the Account Owner and users with the iam.admin role.

1. In the control panel, on the top menu, click IAM.

2. Go to the section with the required user type:

   • Control panel users — for users with access to the control panel;
   • Service users — for service users.

3. Open the user page → Access tab.

4. In the Proxy keys block, click Add key.

5. Enter a key name.

6. Click Generate key.

7. In the Key field, click and save the key in a secure place—it cannot be viewed after the window is closed.

2. Configure the firewall

Firewall rules will only be applied when you start traffic proxying.

All inbound traffic is allowed; this cannot be changed.

All outgoing traffic is denied by default. You can configure rules for outgoing traffic—add rules or allow all traffic. Rules will apply to all protocols.

If you use rules for domain names, keep in mind that domain names are resolved on your device and the firewall filters traffic before DNS resolution.

For your information

For example, you added a rule to allow traffic for the IP address 1.1.1.1. If you make a request to example.com, which is associated with the IP address 1.1.1.1 on your device, this rule will not apply. When passing through the firewall, the IP address and domain name are not yet associated. The rule will apply to this request only if you allow traffic for example.com.

Add rules

1. In the control panel, on the top menu, click Products and select Mobile Farm.

2. Ensure you are in the correct project. If you need to change the project, open the project menu (name of the current project) and select a project.

3. Go to the Firewall section.

4. Click Create rule.

5. Select an action for the rule.

6. Enter an IP address, subnet, or domain name. The domain name is resolved on your device, so the firewall filters traffic before DNS resolution. When adding a rule, consider what you use in requests to your device.

   To have the rule apply to all addresses, click All addresses.

7. Enter one port or a port range.

   To have the rule apply to all ports, click All ports.

8. Click . The rule will be added to the top of the list.

9. To add another rule, repeat steps 4–8.

10. Optional: to change the order of the rules, drag and drop the rule to the required position.

Rules are executed in order in the list, from top to bottom. The first matching rule takes effect. If the first rule allows traffic, the traffic will be allowed, even if a deny rule is configured below it.

Allow all traffic

1. In the control panel, on the top menu, click Products and select Mobile Farm.
2. Ensure you are in the correct project. If you need to change the project, open the project menu (name of the current project) and select a project.
3. Go to the Firewall section.
4. Click Allow all traffic.

3. Download the reverse proxy utility file to your device

1. On your device, which you are connecting to a mobile farm device via a tunnel, download the file with the reverse proxy utility.

2. Optional: verify the utility file's integrity:

   2.1. Download the hash sum file to the same directory as the utility file. The name of the hash sum file must match the name of the utility file, but with the .sha256 extension.

   2.2. Open the CLI.

   2.3. Ensure the hashes match:

   sha256sum -c <file_name>

   Specify <file_name> — the name of the file with the .sha256 extension that you downloaded in step 2.1.

3. Save the name of the reverse proxy utility file that you downloaded in step 1. For Windows, the filename includes the .exe extension.

4. If your device is running macOS, remove the built-in security system restrictions for the utility file:

   4.1. Make the utility file executable:

   chmod +x <file_name>

   Specify <file_name> — the name of the utility file that you saved in step 3.

   4.2. Remove the quarantine attribute from the utility file:

   xattr -d com.apple.quarantine <file_name>

   Specify <file_name> — the name of the utility file that you saved in step 3.

Start traffic proxying

You can run one tunnel on your device at a time. Multiple mobile farm devices can be connected to this tunnel. To do this, you must enable traffic proxying on each mobile farm device.

1. Start the tunnel on your device.
2. Enable traffic proxying on the mobile farm device.

1. Start the tunnel on your device

1. On your device where you downloaded the utility file, open the CLI.

2. Start the tunnel.

   <file_name> start --token <proxy-key>

   Specify:

   • <file_name> — the name of the file that you saved when downloading the reverse proxy utility file to your device in step 3. For Windows, the filename includes the .exe extension.
   • <proxy-key> — the proxy key you saved when preparing proxying in step 1. A proxy key can be used to open only one tunnel. When enabling proxying on a mobile farm device, the tunnel can be identified by the proxy key used.

2. Enable traffic proxying on the mobile farm device

1. In the control panel, on the top menu, click Products and select Mobile Farm.

2. Ensure you are in the correct project. If you need to change the project, open the project menu (the name of the current project) and select a project.

3. Go to the Devices section.

4. In the device row, click on the device manufacturer and model.

5. Click Start using.

6. On the toolbar above the device management window, click . If you have one open tunnel, traffic proxying will start immediately.

7. If you have multiple open tunnels, select the proxy key you used to start the required tunnel in step 1.

Stop traffic proxying

Traffic proxying will stop if:

• the tunnel will be closed;
• or you disable proxying on the mobile farm device. Use this if you will continue using the device and need internet access, or if you are finishing work with the device.

Closing the tunnel

After the tunnel is closed, traffic from the mobile farm device will not go anywhere. There will be no internet access on the device until you disable proxying on the mobile farm device.

You can close the tunnel yourself, or it may close automatically.

To close the tunnel:

• in your device's terminal, press Ctrl + C;
• or close your device terminal;
• or turn off your device.

The tunnel may close automatically if:

• no mobile farm device has been connected to the tunnel for 30 minutes;
• the Proxy key used to start the tunnel is deleted.

If you need to continue proxying traffic after closing the tunnel, start the tunnel on your device again.

Disable traffic proxying on the mobile farm device

1. In the control panel, on the top menu, click Products and select Mobile Farm.

2. Ensure you are in the correct project. If you need to change the project, open the project menu (the name of the current project) and select a project.

3. Go to the Devices section.

4. In the device row, click on the device manufacturer and model.

5. Click Start using.

6. On the toolbar above the device management window, click .