Manage mobile farm device traffic proxying

When proxying, mobile farm device traffic is routed through your device, such as a server or laptop. To connect devices, you create a secure TLS connection—a tunnel—between them. Outbound traffic from a mobile farm device can be filtered using built-in firewall rules. For details about the firewall, see the Manage firewall rules for proxying mobile farm device traffic instructions.

note

For example, traffic proxying can be used if you need to connect devices in the internal perimeter of a corporate network to mobile farm devices for testing. You connect the mobile farm device and one of the devices that has access to the corporate network with a tunnel. From there, traffic can be routed to other devices on that network.

To get started, you need to prepare proxying. You only need to do this once, after which you can start and stop traffic proxying whenever necessary.

Prepare traffic proxying

Add a Proxy key.
Configure the firewall.
Download the reverse proxy utility file to your device.

1. Add a Proxy key

A proxy key can be added to your profile or another user's profile and then used to proxy traffic from mobile farm devices. If you are configuring proxying for automated tests, add a proxy key for a service user.

The key will be available in all projects to which the user has been added.

To your profile
To another user's profile

In the control panel, in the upper-right corner, open the menu (account number) and select Profile.
Go to the Access section → Proxy keys tab.
Click Add key.
Enter a key name.
Click Generate key.
In the Key field, click and save the key in a safe place — you will not be able to view it after closing the window.

2. Configure the firewall

Firewall rules will apply only when you start traffic proxying.

All inbound traffic is allowed; this cannot be changed.

All outgoing traffic is denied by default. You can configure rules for outgoing traffic—add rules or allow all traffic. Rules will apply to all protocols.

If you use rules for domain names, keep in mind that domain names are resolved on your device and the firewall filters traffic before DNS resolution.

For your information

For example, you added a rule to allow traffic by the IP address 1.1.1.1. If you make a request to example.com that is associated with the IP address 1.1.1.1 on your device, this rule will not apply. When passing through the firewall, the IP address and domain name are not yet associated. The rule will apply to this request only if you allow traffic for example.com.

Add rules
Allow all traffic

In the control panel, in the top menu, click Products and select Mobile Farm.
Ensure you are in the correct project. If you need to change the project, open the project menu (name of the current project) and select a project.
Go to the Firewall section.
Click Create rule.
Select an action for the rule.
Enter an IP address, subnet, or domain name. The domain name is resolved on your device, so the firewall filters traffic before DNS resolution. When adding a rule, consider what you use in requests to your device.

For the rule to apply to all addresses, click All addresses.
Enter one port or a port range.

For the rule to apply to all ports, click All ports.
Click . The rule will be added to the top of the list.
To add another rule, repeat steps 4–8.
Optional: to change the order of the rules, drag and drop the rule to the required position.

Rules are executed in order in the list, from top to bottom. The first matching rule takes effect. If the first rule allows traffic, the traffic will be allowed, even if a deny rule is configured below it.

3. Download the reverse proxy utility file to your device

On your device that you are tunneling to the mobile farm device, download the reverse proxy utility file.
Optional: verify the utility file's integrity:

2.1. Download the checksum file to the same directory where you downloaded the utility file. The checksum file name must match the utility file name, but with the .sha256 extension.

2.2. Open the CLI.

2.3. Ensure the hashes match:
```
sha256sum -c <file_name>
```
Specify <file_name> — the name of the file with the .sha256 extension that you downloaded in step 2.1.
Save the name of the reverse proxy utility file that you downloaded in step 1. For Windows, the file name includes the .exe extension.
If your device is running macOS, remove the built-in security system restrictions for the utility file:

4.1. Make the utility file executable:
```
chmod +x <file_name>
```
Specify <file_name> — the name of the utility file that you saved in step 3.

4.2. Remove the quarantine attribute from the utility file:
```
xattr -d com.apple.quarantine <file_name>
```
Specify <file_name> — the name of the utility file that you saved in step 3.

Start traffic proxying

You can run one tunnel on your device at a time. Multiple mobile farm devices can be connected to this tunnel. To do this, you must enable traffic proxying on each mobile farm device.

Start the tunnel on your device.
Enable traffic proxying on the mobile farm device.

1. Start the tunnel on your device

On your device where you downloaded the utility file, open the CLI.
Start the tunnel.
```
<file_name> start --token <proxy-key>
```
Specify:
- <file_name> — the name of the file that you saved when downloading the reverse proxy utility file to your device in stage 3 in step 3. For Windows, the file name includes the .exe extension.
- <proxy-key> — the Proxy key that you saved when preparing proxying in stage 1. A Proxy key can be used to open only one tunnel. When enabling proxying on the mobile farm device, the tunnel can be identified by the used Proxy key.

2. Enable traffic proxying on the mobile farm device

In the control panel, in the top menu, click Products and select Mobile Farm.
Ensure you are in the correct project. If you need to change the project, open the project menu (the name of the current project) and select a project.
Go to the Devices section.
In the device row, click on the device manufacturer and model.
Click Start using.
On the toolbar above the device management window, click . If you have one open tunnel, traffic proxying will start immediately.
If you have multiple open tunnels, select the Proxy key that you used to start the required tunnel in stage 1.

Stop traffic proxying

Traffic proxying will stop if:

the tunnel is closed;
or you disable proxying on the mobile farm device. Use this if you continue using the device and need internet access, or if you are finishing work with the device.

Closing the tunnel

After the tunnel is closed, mobile farm device traffic will not go anywhere. The device will not have internet access until you disable proxying on the mobile farm device.

You can close the tunnel yourself, or it may close automatically.

To close the tunnel:

in the terminal of your device, press Ctrl + C;
or close your device terminal;
or turn off your device.

The tunnel may close automatically if:

no mobile farm device has been connected to the tunnel for 30 minutes;
the Proxy key used to start the tunnel is deleted.

If you need to continue traffic proxying after closing the tunnel, start the tunnel on your device again.

Disable traffic proxying on the mobile farm device

In the control panel, in the top menu, click Products and select Mobile Farm.
Ensure you are in the correct project. If you need to change the project, open the project menu (the name of the current project) and select a project.
Go to the Devices section.
In the device row, click on the device manufacturer and model.
Click Start using.
On the toolbar above the device management window, click .