How connections are used. Find features by task.
From device onboarding to business routing, then to permissions, operational status and team costs. Choose what you are working on to open the corresponding feature page.
Browse the feature directoryDevice access
Device access
Choose a subscription or standalone connection configuration for employee clients, routers and firewalls.
Client links
Import the subscription for the corresponding client. After the rules are published, refresh the configuration from the original link.
Device networking
Declare internal subnets for supported devices. Once both sides enable it, they can reach each other's internal networks through the same Relay.
Rules and routing
Traffic routing and paths
Choose the egress per service and decide whether rules run on the client or on the node.
Client-side traffic routing
Use Surge 6, Mihomo or Shadowrocket to choose paths for different destinations.
Node-side traffic routing
Change the service egress centrally on the Gateway or Connector; devices keep using their existing connection settings.
Two-hop relay
Reuse existing nodes and select the ingress, relay and final egress separately.
Dedicated egress per device
Choose Cloud Pulse for just one WireGuard or RouterOS configuration.
Port forwarding
Use a dedicated node to map specified TCP and UDP public ports to services on a device.
Security and audit
Access and identity
Manage account, source and device permissions separately, and review the corresponding events and audit records.
Account login security
Use a Passkey or a password plus TOTP, and manage the current browser session.
Identity and business verification
Submit your company information; each member completes their own ID and identity verification separately.
Source admission
Authenticate the actual public IPv4 from the target device, then approve it according to the quota or hand it over to an administrator.
Device configuration revocation
Deactivate an individual configuration, revoke its connections and intranet access, and keep your other connections intact.
Ingress security events
See the stage and reason a connection was rejected, and resolve false blocks on the current ingress source.
Access audit
From the final egress, view destinations, protocols, and traffic, and query recent and archived records.
Account activity audit
Subject to your permissions, review member changes, resource requests, service entitlements, and takeover history.
Operations and maintenance
Operational observability
From the connection topology, view node health, version acknowledgements, and terminal traffic windows.
Node health and recovery
Distinguish public network probes, heartbeats, and the data plane, and restore faulty services according to maintenance conditions.
Firmware upgrades and version locking
Select a compatible release for each node, and view download, application, and platform lock status.
Team and costs
Team collaboration
Invite colleagues to sign in individually, with roles divided into owner, administrator, and user.
Resources and billing
Choose resource subscriptions and traffic plans separately, and understand how the first segment is counted once.
Terminal and member rate limiting
Set an individual limit for a configuration, or restore the member policy shared across concurrent connections.
Traffic metering
View plan balances and periods, and check usage by member, terminal, and daily connections.
Orders and billing
Review purchases and payments, organize balance transactions, and request invoices when you qualify.
Subscriptions and renewals
Arrange renewals for Gateway and Connector, and review payment methods, billing cycles, and results.
Bring your own infrastructure
Deployment and bring-your-own resources
Choose hosted nodes, or reuse supported servers and SOCKS5 proxies.
Bring Your Own Gateway · BYOG
Connect an existing server as a Gateway, keeping its provider and ingress location.
Bring Your Own Connector · BYOC
Connect an existing server as a Connector and choose final egress or transit use.
Bring Your Own Proxy · BYOP
Connect your existing SOCKS5 as a private team egress, with no Agent installation required.