Link (origin tunnels)

The origin dials out.

A connector on your server opens a connection to a landing point we run and keeps it open. Requests arrive over that connection. Your server accepts nothing from the internet, and its address appears nowhere.

01

What this is for

Hiding an origin behind a CDN only works if the origin also refuses everybody who did not come through the CDN. That is a firewall rule that has to be kept correct forever, and an address that leaks once — an old DNS record, a mail header, a certificate transparency log — stays leaked.

A tunnel removes the question. There is no inbound port to protect, so there is no rule to get wrong, and an address that leaks reaches a server that will not answer it.

  • Works behind NAT, behind CGNAT, and on a connection with no fixed address — it dials out.
  • One connector can hold two landing points in different cities, so losing a city does not take the site down.
  • The origin is reached over an address that exists only inside our network; it is not routable from the internet.
02

Set one up

  1. In the console open CDN → Link and create a tunnel: a name, the city it lands in, and the local address to forward to — usually http://127.0.0.1:8080.
  2. Copy the credential. It is shown once and is not stored anywhere we can read it back.
  3. Put the connector on the machine your site runs on and run it with the command the console gives you.
  4. Point a Shield site at the tunnel instead of at an origin address.
Install the connector
curl -fsSL https://dash.yunzheng.space/assets/orbit-link-linux-amd64 -o /usr/local/bin/orbit-link
chmod +x /usr/local/bin/orbit-link
Run it — the console fills in the endpoint and fingerprint for your tunnel
orbit-link --token lnk_… --endpoint 203.0.113.4:7844 --fingerprint sha256:… --local http://127.0.0.1:8080

Builds are published for Linux (x86-64 and arm64), macOS (Apple silicon and Intel) and Windows. The console links all of them.

03

How the connection is secured

The connector dials an address, not a hostname, so there is no name for a public certificate to vouch for. Instead it pins the landing point's public key: the fingerprint on the command line is a SHA-256 of that key, and the connector refuses to talk to anything that does not present it.

The credential goes the other way: the landing point checks it and accepts the tunnel. A wrong credential and a tunnel that does not exist are refused identically — the difference between them is precisely what somebody guessing would like to learn.

Issuing a new credential disconnects the connector still using the old one, within about a minute. Have the new one ready to install before you rotate. Losing the install command is not a reason to rotate: the endpoint and fingerprint are on the tunnel's Install button at any time.
04

When UDP is blocked

The connector prefers QUIC on UDP 7844 and falls back to TCP on the same port. On a network that drops UDP entirely, add --tcp to skip straight to the fallback rather than waiting for QUIC to give up.

Only outbound connections are needed in both cases. Nothing ever dials your server.

05

Questions

Does my server need a public IP address?

No. That is the point. It needs to be able to make an outbound connection, which is all a home connection or a container on a private network can usually do.

What happens when the connector stops?

The tunnel goes away and the site behind it becomes unreachable. There is deliberately no public fallback address: keeping one would reintroduce exactly the leak the product exists to prevent. Run the connector under a supervisor — the console gives you a systemd unit.

Can one tunnel serve several sites?

Yes. Several Shield hostnames can pull from the same tunnel; the connector forwards them all to the same local address, and your own server decides what to do with each Host header.

Is it available on my account?

Link is switched on per platform. If the console says it is not switched on yet, the address pool has not been assigned — ask support.

Next

Related

Getting started

How an Orbit account is organised, what lives where in the console, and the shortest path from signing in to serving a name from our network.

DNS hosting

Add a zone, point your registrar at our name servers, and manage records. Includes weighted answers, health-checked records, ALIAS at the apex and zone-file import.

Connect a hostname

Delegate the whole domain, delegate one hostname, or add a CNAME and leave your DNS where it is. What each one costs you and when to pick it.

← All documentation