Intranet Tunneling
Intranet Tunneling allows the GatewayRuntime service on the intranet where Watchdog is located to expose to a specified external address via the Studio Broker. Studio provides the broker, while Watchdog creates clients and forwards local or intranet services.
Job Role
| Role | Interface | Function |
|---|---|---|
| Studio Broker | Studio Web > intranet tunneling | receives Watchdog client connections and listens for access traffic at external addresses. |
| Watchdog Client | Watchdog Web > Tunnel Management | Actively connects to Studio Broker, forwarding local or intranet services to the Broker. |
| Source address | Watchdog client configuration | the target services accessible to Watchdog machines, such as 127.0.0.1:6100. |
| External Addresses | The Watchdog client configuration | the Broker side listens to addresses for external access, such as 0.0.0.0:8889. |
Typical Access Link:
Studio Broker Configuration
Menu Path: Studio Web > Intranet Traversal.
The top of the page displays the broker's current operating status, listening ports, number of bound endpoints, and runtime. The "Refresh" button in the upper right corner is used to reread the status.
| Configuration Items or Actions | Instructions |
|---|---|
| Enable Tunnel | Whether Studio Broker Configuration is enabled. |
| Tunnel Port | Watchdog client connects to the Broker's port, range 1-65535. The default value is 7789, and this port needs to be allowed to be allowed in the firewall of the server where Studio is located. |
| Authentication Token | the first authentication value used by the Watchdog client when connecting to the Broker. The default value is Dmtp, which is required. Studio and Watchdog must be exactly the same. |
| Access Key | Secondary checksum used by the Watchdog client when binding tunnel endpoints. After filling out the Studio side, the Watchdog side must enter the same value; When secondary verification is not used, both ends remain empty for easy troubleshooting. |
| Save | Save the current form configuration. |
| Reset | Reload the saved configuration and discard the page without saving the changes. |
| Start the service | start the saved broker configuration. After modifying the port, authentication token, or access key, click "Save" before starting the service. |
| Stop service | stop a running broker. |
Recommended order
Save the configuration first, then start the service. After modifying the port, authentication token, or access key, the broker status should be restored and confirmed.
Studio Endpoint Information
View the bound Watchdog client endpoint in the "Endpoint Information" tab. When the broker is not running, the endpoint list is empty.
| Column | Description |
|---|---|
| Tunnel Label | Watchdog client name. |
| Tunnel ID | The tunnel identifier generated by this binding. |
| Tunnel mode | Current tunnel mode. |
| External address | Broker-side address where external visitors connect. |
| Binding Time | The time when the client was successfully bound. |
When the Watchdog client shows as connected but Studio has no endpoints, it is usually due to inconsistent access keys, an external port occupied, or client binding failure.
Watchdog Client Configuration
Menu Path: Watchdog Web > Tunnel Management.
| Operations | Instructions |
|---|---|
| Enable Tunnels | Enable or disable the Watchdog tunnel feature globally. |
| Add a client | Open the configuration drawer and add a client. |
| Card/Tables | Switch display modes; Table views can be batch deleted. |
| Activate all | Activate all configured clients. |
| Disable all | Disable all clients. |
| Configuration | Open the full configuration drawer. |
| Refresh | Reread client status. |
Configure Drawer
| Configuration Items | Description |
|---|---|
| Enable the Tunnel | global toggle and save for effect. |
| Client Configuration | Displays saved clients and can expand editing. |
| Add client | Add client configuration. |
| Save | Save global switches and all client configurations. |
Client Forms
| Configuration Items | Description |
|---|---|
| Client name | required; duplicates are not allowed within the same Watchdog. |
| Enable | to control whether the client participates in activation. |
| Tunnel server address | Studio Broker's server IP or domain name. |
| Tunnel server port | Studio Broker port, range 1-65535. Enter the Broker port saved in Studio Web's "Intranet Tunneling" section, commonly 7789; Other values are only filled in if Studio Broker is indeed changed to another port. |
| Authentication token | is the same as Studio Broker's authentication token. |
| access key | matches the access key for Studio Broker. When entering the access key on the Studio side, the Watchdog side must enter the same value; When not using secondary verification, both ends are left empty. |
| Source Address | The target service address that the Watchdog machine can access, such as 127.0.0.1:6100. If GatewayRuntime and Watchdog are not on the same machine, you should enter the gateway address accessible by the network where Watchdog is located. |
| External addresses | Broker-side listening addresses, for example, 0.0.0.0:8889. External visitors ultimately access this port of the Studio server. |
| Reconnection interval (seconds) | Wait time for automatic reconnection after client disconnection. If network jitter is frequent, increase the volume appropriately to avoid continuous rapid reconnections. |
When saving, it checks the client name, broker address, source address, external address, and port range. Duplicate client names cannot be saved.
Joint Debugging Process
- Open "Intranet Tunneling" in Studio Web.
- Enter the broker port, authentication token, and access key, then click "Save".
- Click "Start Service" and confirm that it is running.
- Open "Tunnel Management" in Watchdog Web and enable "Enable Tunnel."
- Add a client and fill in the Studio Broker address, port, authentication token, and access key.
- For the source address, enter the GatewayRuntime address accessible to the Watchdog machine, for example,
127.0.0.1:6100. - For external addresses, fill in the broker-side exposed address, for example,
0.0.0.0:8889. - After saving the client configuration, click "Activate."
- Return to the "Endpoint Information" tab in Studio Web and confirm that the corresponding tunnel label and external address appear.
- From an external network, open
http://<studio-server-ip>:<external-port>and confirm that GatewayRuntime Web is accessible.
Parameter Example
| Parameter | Example Value | Description |
|---|---|---|
| Studio Broker address | 203.0.113.10 | A Studio server address accessible to the public network or Watchdog. |
| Broker port | 7789 | Watchdog client connection port. |
| Authentication token | Dmtp | consistent on both ends. It is recommended to switch to a higher strength value for the production environment. |
| Access key | site-key-001 | When the Studio side enables secondary verification, both ends are consistent; When not enabled, both ends are left empty. |
| GatewayRuntime service on a | 127.0.0.1:6100 | Watchdog machine at source address 127.0.0.1:6100. |
| External address | 0.0.0.0:8889 | Studio server listens for ports accessed from outside. |
| External access address | http://203.0.113.10:8889 | Address used by external visitors. |
Security and Network Check
| Checklist | Explanation |
|---|---|
| Port Release | Studio Broker port and outbound address port both need to be released within the firewall. |
| Authentication Information | Authentication tokens must match the Watchdog client. The access key is a secondary checksum, and when the Studio side enters it, the Watchdog side must also enter the same value; When not in use, both ends are left empty. |
| Source address connectivity | The source address should be accessible on the Watchdog machine. |
| External port occupies | The external address port cannot be occupied by other processes on the Studio server. |
| Access Scope | In production environments, do not arbitrarily expose management ports to the public network; if necessary, use a firewall whitelist. |
Common Issues
| Phenomena | Handling Suggestions |
|---|---|
| Studio Broker Startup Failure | Check whether the Broker port is occupied, whether the port range is correct, and whether the configuration has been saved. |
| Watchdog client is not activated | Confirm that the global "enable tunnel" for Watchdog is enabled and save client configurations. |
| The client shows 'Not Connected' | Check whether Studio Broker is running, whether the server address and port are reachable, and whether the firewall is allowing access. |
| If connected but not bound to | Studio, enter the access key, check if the Watchdog access key matches; At the same time, check whether the external address port is occupied. |
| Studio endpoint list is empty | Switch to the "Endpoint Information" tab and refresh; If it remains empty, check the binding failure message in the Watchdog log. |
| GatewayRuntime is inaccessible externally | Check whether the external port, firewall, source address, and GatewayRuntime itself are running. |