---
title: "Manage mobile farm device traffic proxying"
sidebar_label: "Manage traffic proxying"
sidebar_position: 6
description: "How to prepare mobile farm device traffic proxying, start proxying, and stop it"
---

import Formbricks from '@theme/MDXComponents/Formbricks';
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
import { TabItemLabel } from '@selectel/docux/components';
import CopyIcon from '@selectel/docux/icons/copy';
import TrashIcon from '@selectel/docux/icons/trash';
import CheckIcon from '@selectel/docux/icons/check';
import KeyIcon from '@selectel/docux/icons/key';
import KeyOffIcon from '@selectel/docux/icons/key-off';

# Manage mobile farm device traffic proxying

When proxying, mobile farm device traffic is routed through your device, such as a server or laptop. To connect the devices, you create a secure TLS connection—a tunnel—between them. You can filter outbound traffic from a mobile farm device using built-in firewall rules. Read more about the firewall in the [Manage firewall rules for mobile farm device traffic proxying](/mobile-farm/manage/manage-firewall.mdx).

:::note

For example, traffic proxying can be used if you need to connect devices in the internal corporate network perimeter to mobile farm devices for testing purposes. You connect a mobile farm device and one of the devices with access to the corporate network via a tunnel. From there, traffic can be routed to other devices on that network.

:::

To begin, you need to [prepare](#prepare-proxy) proxying. You only need to do this once; after that, you can [start](#start-proxying-traffic) and [stop traffic proxying](#stop-proxying-traffic) whenever necessary.

## Prepare traffic proxying \{#prepare-proxy}

1. [Add a Proxy key](#add-proxy-key).
2. [Configure the firewall](#configure-firewall).
3. [Download the reverse proxy utility file to your device](#download-reverse-proxy-utility).

### 1. Add a Proxy key \{#add-proxy-key}

You can add a Proxy key to your profile or to another user's profile and then use it to proxy mobile farm device traffic. If you are configuring proxying for automated testing, add a Proxy key for a service user.

The key will be available in all projects to which the user has been added.

<Tabs queryString="add-public-proxy-key">
  <TabItem value="own-profile" default>
    <TabItemLabel>
      To your profile
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/profile/access/proxy-keys), in the upper right corner, open the menu (account number) and select **Profile**.
    2. Go to the **Access** → **Proxy keys** tab.
    3. Click **Add key**.
    4. Enter a key name.
    5. Click **Generate key**.
    6. In the **Key** field, click  and save the key in a secure place — you will not be able to view it after closing the window.<CopyIcon />
  </TabItem>

  <TabItem value="other-user-profile">
    <TabItemLabel>
      To another user's profile
    </TabItemLabel>

    The [Account Owner](/access-control/user-types.mdx#account-owner) and users with the [iam.admin](/access-control/role-reference.mdx#iam-admin) role can add keys for other users.

    1. In the [control panel](https://my.selectel.ru/iam/service-users), on the top menu, click **IAM**.

    2. Go to the section with the required [user type](/access-control/user-types.mdx):

       * **Panel users** — for users with access to the control panel;
       * **Service users** — for [service users](/access-control/user-types.mdx#service-users).

    3. Open the user page → **Access** tab.

    4. In the **Proxy keys** block, click **Add key**.

    5. Enter a key name.

    6. Click **Generate key**.

    7. In the **Key** field, click  and save the key in a safe place — you will not be able to view it after closing the window.<CopyIcon />
  </TabItem>
</Tabs>

### 2. Configure the firewall \{#configure-firewall}

Firewall rules will be applied only when you [start proxying traffic](#start-proxying-traffic).

All inbound traffic is allowed; this cannot be changed.

All outbound traffic is denied by default. You can configure rules for outbound traffic — add rules or allow all traffic. The rules will be applied to all protocols.

If you use rules for domain names, keep in mind that domain names are resolved on your device and the firewall filters traffic before DNS resolution.

:::info

For example, you added a rule to allow traffic for the IP address `1.1.1.1`. If you make a request to `example.com`, which is associated with the IP address `1.1.1.1` on your device, this rule will not be applied. When passing through the firewall, the IP address and domain name are not yet associated. The rule will be applied to this request only if you allow traffic for `example.com`.

:::

<Tabs queryString="configure-firewall">
  <TabItem value="add-rules" default>
    <TabItemLabel>
      Add rules
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/mobile-farm/), on the top menu, click **Products** and select **Mobile Farm**.

    2. Ensure you are in the correct project. If you need to change the project, open the project menu (name of the current project) and select a project.

    3. Go to the **Firewall** section.

    4. Click **Create rule**.

    5. Select an action for the rule.

    6. Enter an IP address, subnet, or domain name. The domain name is resolved on your device, so the firewall filters traffic before DNS resolution. When adding a rule, consider what you use in requests to your device.

       To apply the rule to all addresses, click **All addresses**.

    7. Enter one port or a port range.

       To apply the rule to all ports, click **All ports**.

    8. Click . The rule will be added to the top of the list.<CheckIcon />

    9. To add another rule, repeat steps 4–8.

    10. Optional: to change the order of the rules, drag and drop the rule to the required position.

    Rules are executed in the order they appear in the list — from top to bottom. The first matching rule takes effect. If the first rule allows traffic, the traffic will be allowed, even if rules below it are set to deny.
  </TabItem>

  <TabItem value="allow-all">
    <TabItemLabel>
      Allow all traffic
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/mobile-farm/), on the top menu, click **Products** and select **Mobile Farm**.
    2. Ensure you are in the correct project. If you need to change the project, open the project menu (name of the current project) and select a project.
    3. Go to the **Firewall** section.
    4. Click **Allow all traffic**.
  </TabItem>
</Tabs>

### 3. Download the reverse proxy utility file to your device \{#download-reverse-proxy-utility}

1. On your device, which you are connecting via tunnel to the mobile farm device, download the [file with the reverse proxy utility](https://s3.mobfarm.selectel.ru/proxy/index.html).

2. Optional: verify the utility file's integrity:

   2.1. Download the hash sum file to the same directory where you downloaded the utility file. The hash sum file name must match the utility file name, but with the `.sha256` extension.

   2.2. Open the CLI.

   2.3. Ensure the hashes match:

   ```bash
   sha256sum -c <file_name>
   ```

   Specify `<file_name>` — the name of the file with the `.sha256` extension that you downloaded in step 2.1.

3. Save the name of the reverse proxy utility file that you downloaded in step 1. For Windows, the file name includes the `.exe` extension.

4. If your device is running macOS, remove the built-in security system restrictions for the utility file:

   4.1. Make the utility file executable:

   ```bash
   chmod +x <file_name>
   ```

   Specify `<file_name>` — the name of the utility file you saved in step 3.

   4.2. Remove the quarantine attribute from the utility file:

   ```bash
   xattr -d com.apple.quarantine <file_name>
   ```

   Specify `<file_name>` — the name of the utility file you saved in step 3.

## Start traffic proxying \{#start-proxying-traffic}

You can run one tunnel on your device at a time. Multiple mobile farm devices can be connected to this tunnel. To do this, traffic proxying must be enabled on each mobile farm device.

1. [Start the tunnel on your device](#start-tunneling).
2. [Enable traffic proxying on the mobile farm device](#enable-proxy).

### 1. Start the tunnel on your device \{#start-tunneling}

1. On your device where you downloaded the utility file, open the CLI.

2. Start the tunnel.

   ```bash
   <file_name> start --token <proxy-key>
   ```

   Specify:

   * `<file_name>` — the name of the file that you saved when [downloading the reverse proxy utility file to your device in step 3](#download-reverse-proxy-utility) on step 3. For Windows, the file name includes the `.exe` extension.
   * `<proxy-key>` — the proxy key you saved when [preparing proxying in step 1](#add-proxy-key). A proxy key can be used to open only one tunnel. When [enabling proxying](#enable-proxy) on the mobile farm device, the tunnel can be identified by the used proxy key.

### 2. Enable traffic proxying on the mobile farm device \{#enable-proxy}

1. In the [control panel](https://my.selectel.ru/mobile-farm/), on the top menu, click **Products** and select **Mobile Farm**.

2. Ensure you are in the correct project. If you need to change the project, open the project menu (name of the current project) and select a project.

3. Go to the **Devices** section.

4. In the device row, click on the device manufacturer and model.

5. Click **Start using**.

6. On the toolbar above the device control window, click . If you have one open tunnel, traffic proxying will start immediately.<KeyOffIcon />

7. If you have several open tunnels, select the proxy key you used for [starting the required tunnel in step 1](#start-tunneling).

## Stop traffic proxying \{#stop-proxying-traffic}

Traffic proxying will stop if:

* the [tunnel will be closed](#tunnel-closing);
* or you [disable proxying on the mobile farm device](#disable-proxy). Use this if you continue to use the device and need internet access, or if you [are finishing work with the device](/mobile-farm/manage/finish-working-with-device.mdx).

### Closing the tunnel \{#tunnel-closing}

After closing the tunnel, the mobile farm device traffic will not go anywhere. There will be no internet access on the device until you [disable proxying on the mobile farm device](#disable-proxy).

You can close the tunnel yourself, or it may close automatically.

To close the tunnel:

* in your device terminal, press **Ctrl + C**;
* or close your device terminal;
* or turn off your device.

The tunnel may close automatically if:

* no mobile farm device has been connected to the tunnel for 30 minutes;
* the Proxy key used to start the tunnel is deleted.

If you need to continue proxying traffic after closing the tunnel, [start the tunnel on your device](#start-tunneling) again.

### Disable traffic proxying on the mobile farm device \{#disable-proxy}

1. In the [control panel](https://my.selectel.ru/mobile-farm/), on the top menu, click **Products** and select **Mobile Farm**.

2. Ensure you are in the correct project. If you need to change the project, open the project menu (name of the current project) and select a project.

3. Go to the **Devices** section.

4. In the device row, click on the device manufacturer and model.

5. Click **Start using**.

6. On the toolbar above the device control window, click .<KeyIcon />

<Formbricks />