Skip to main content

TunHub

Use Cloudaware TunHub to provide secure, outbound-only connectivity from private/on-prem networks to the Cloudaware platform, with improved support for dynamic and containerized environments.

info

Overview​

TunHub is Cloudaware's tunneling service that provides secure, outbound-only connectivity from customer networks to the Cloudaware platform. TunHub is built to ensure reliability, scalability, and connectivity flexibility for customers with modern, dynamic network architectures by providing:

  • Dedicated outbound port ranges (20000–21999) for predictable firewall rules
  • Compatibility with Kubernetes-managed tunnels and ephemeral workloads
  • Great connection stability and lower error rates under varied network conditions
  • Support for customers using shared or dynamic external IPs

How It Works​

TunHub uses a Breeze host as a local proxy inside your private network. The Breeze host maintains an outbound-only connection to the Cloudaware TunHub. Cloudaware then uses TunHub tunnel and routes to access private endpoints required by integrations.

Capabilities​

The integration supports:

  • Secure, agent-assisted tunnel via Breeze
  • Outbound-only connectivity from private networks to Cloudaware
  • TunHub tunnels with one or more routes per private endpoint
  • Alternate destination host/port for use in Cloudaware integrations (e.g., vCenter, SCCM, Jira, Kubernetes)

Prerequisites​

  • A trial/active Cloudaware account and a Cloudaware user with access to Admin for managing integrations.
  • A server or Kubernetes workload that:
    • Can reach the private endpoints you want Cloudaware to access
    • Has outbound network access to Cloudaware services
  • Breeze Agent installed on that host (or managed via Kubernetes deployment).
  • Ability to allow outbound connections per the requirements.

Breeze Host Requirements (OS and Resources)​

  • Operating System: Linux only
    • Ubuntu 14 and newer
    • CentOS/RedHat/Oracle Linux 6–9
    • Debian 9 and newer
    • Amazon Linux (note that Amazon Linux 2023 may require additional validation for TunHub)
  • CPU: minimum 1 core
  • Memory: minimum 256 MB
  • Storage: minimum 200 MB

Network Requirements​

From the Breeze host (or pod) to Cloudaware:

  • Outbound TCP 443 to breeze-server.cloudaware.com (Breeze control channel)
  • Outbound TCP 443 to gw.tunhub.cloudaware.com (TunHub control channel)
  • Outbound TCP 20000–21999 to gw.tunhub.cloudaware.com (TunHub dedicated data ports)

Ensure your firewall allows these outbound connections from any Breeze hosts that will terminate TunHub tunnels.

Setup Overview​

At a high level, configuring TunHub requires:

  1. Installing Breeze on a host (or Kubernetes workload) that can reach your private endpoints.
  2. Creating a TunHub tunnel in Cloudaware Admin and assigning Breeze channels.
  3. Adding one or more routes per private endpoint.
  4. Using the generated TunHub destination host/port values in your integrations.

Install Breeze​

Select an existing server or provision a new one that has access to resources in the private network and can communicate with Cloudaware. Then install the Breeze Agent:

  1. Log in to Cloudaware → Admin.
  2. In DevOps Integrations, find Breeze and click CONFIGURED.
  3. Select the desired version and download the agent.
  4. Install the Breeze agent on a server that meets the OS, resource, and network requirements above.
  5. Once Breeze is installed and connected, the server can act as a TunHub proxy.
note

For Kubernetes: deploy Breeze according to the Kubernetes Breeze deployment guide, ensuring the pod has outbound access to breeze-server.cloudaware.com and gw.tunhub.cloudaware.com on the required ports.

Create a TunHub Tunnel​

Create a tunnel to grant Cloudaware access to private network resources. Each tunnel must include at least one route.

  1. Log in to Cloudaware → Admin.
  2. In DevOps Integrations, find TunHub and click + ADD.
  3. Fill out the form:
    • Description — a descriptive name for this tunnel (for example, Kubernetes, etc).
    • Breeze Agent ID (Channel #1) — ID of the Breeze agent installed on the dedicated host. This value cannot be changed later; verify it carefully.
    • Breeze Agent ID (Channel #2) (optional) — ID of the Breeze agent installed on an additional host. The traffic will be load-balanced between both agents.
    • Dedicated Port — enable this option if you cannot provide unique public source IP addresses for all egress TunHub connections. TunHub assigns a dedicated port from the [20000–22000) range (ensure the firewall allows outbound connections on this range). If not selected, TunHub uses port 443 and expects the connection to originate from a unique public IP address.

Finding Breeze Agent IDs​

Use CMDB Navigator in Cloudaware to locate the Breeze Agent ID for a given server:

  • Open CMDB Navigator and find the target server (via CMDB list views or search).
  • Open the server record and note the Breeze Agent field.
  • For Azure Virtual Machines, use the VM ID value instead.

Examples of ID formats:

  • AWS EC2 Instance — i-XXXXXXXXXXXXXXXXX (Instance ID)
  • Azure Virtual Machine — XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX (VM ID)
  • Azure VM Scale Set Instance — XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX (VM ID)
  • vCenter Virtual Machine — vcenter_XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX_vm-1111111
  • Google GCE Instance — 1111111111111111111 (Google ID)
  • Physical Server — ipXX.XX.X.XX_macXXXXXXXXXX
note

Channel #1 and Channel #2 should have different public IP addresses.

Click Save to test the connection.

Review the integration status. A yellow status icon for the Channel #1 means TunHub is waiting for Breeze to connect; a green icon indicates a healthy tunnel.

Configure Routes​

Each TunHub tunnel must have at least one route. A route maps a private network address to a Cloudaware-accessible address and generates the alternate address Cloudaware uses in integrations.

  1. In the TunHub integration, open the three-dot menu for the tunnel → Edit Tunnel & Routes.
  2. Click + ADD ROUTE.
  3. Fill out the route form:
    • Name — route name (often the integration or service name, for example, internal-node, etc).
    • Remote Host — the domain name or IP address of the resource in the private network.
    • Remote Port — the service port on the private resource.
  4. Click Save and wait for the route status to turn green.
  5. Once the route is ready, note the generated Destination Host and Destination Port values. Use these values when configuring corresponding Cloudaware integrations.
note

Each private network resource should have its own route in TunHub integration.

Example Usage in Integrations​

IntegrationDestination Host/Port Example
JiraURL https://gw.tunhub.cloudaware.com:12345
NutanixHost https://gw.tunhub.cloudaware.com:1234 (remote port 9440 in TunHub)
SCCMHost https://gw.tunhub.cloudaware.com, Port 1245
SolarWindsURL https://gw.tunhub.cloudaware.com:12345 (remote port 17774 in TunHub)
VMware vCenterURL https://gw.tunhub.cloudaware.com:12345

Managed Kubernetes​

When using TunHub for Kubernetes-based resources:

  • A dedicated outbound port is required.
  • Breeze must run inside the Kubernetes cluster so the tunnel originates from the cluster’s internal network. Read more

Use the Kubernetes cluster identifier as the Breeze Agent ID, for example:

  • EKS: arn:aws:eks:<region>:<account_id>:cluster/<CLUSTER_NAME>
  • AKS: /subscriptions/<subscription_id>/resourceGroups/<resource_group>/providers/Microsoft.ContainerService/managedClusters/<CLUSTER_NAME>
  • GKE: /projects/<project_id>/locations/<location>/clusters/<CLUSTER_NAME>
tip

If the tunnel is marked as Managed by Cloudaware, users cannot edit or delete them directly.

Allowlisting​

If your environment uses outbound IP allowlists or domain restrictions, refer to Cloudaware Service Endpoints & Public IPs.