Devices that need a proxy are selected individually.
A standard Relay’s WireGuard or RouterOS configuration can be bound to a purchased or customer-provided Cloud Pulse. Other standalone configurations retain their own egress settings.
Change this device's egress. Other devices stay as they are.
Choose Cloud Pulse for a WireGuard or RouterOS configuration on the same Relay. Only this configuration’s public internet egress changes; its existing tunnel stays in use.
Learn about configuration scopeOne configuration, one egress setting.
The tunnel is retained, and intranet settings stay as they are.
Cloud Pulse binding only handles the public traffic that this configuration sends into the Relay. Devices keep using their existing tunnels, and configured intranet connectivity between terminals continues to work according to the original routing and access settings.
Final egress, executed by the Connector.
The final Connector uses the selected SOCKS5 to forward public traffic. After saving, the switching status is shown first; it is displayed as active only after the node confirms it has been applied.
Once egress is selected,
wait for node confirmation.
The firmware of both the Gateway and the final Connector must support configuration-level SOCKS5 binding. Select a verified Cloud Pulse, review the protocol capabilities and the detection results of the associated Connector, then save the egress.
To restore direct egress through the Connector, select "Do not use Cloud Pulse · Keep direct connection" and save. After clearing the currently configured binding, wait for the final Connector to confirm.
Continue with the existing SOCKS5 →Fix the egress per device, or route by service.
An independent Cloud Pulse binding selects the public egress for this configuration. If you need the node to choose different paths based on access targets, clear this binding first, then bind the terminal configuration to a node routing policy.
Learn about node traffic routing →Frequently asked questions.
If the selected proxy becomes unavailable, will traffic automatically switch to the Connector?
No. The related public access for the bound configuration will be blocked. Only after you explicitly switch to a verified Cloud Pulse, or clear the binding and choose a direct connection, and the final Connector has applied the change, will the new egress be used.
If the proxy only supports TCP, can it still handle UDP?
No. Services that require UDP must select a proxy that actually supports SOCKS5 UDP, and you should review the detection results. If UDP capability is missing, UDP access for that configuration will be blocked.
Will all RouterOS access use Cloud Pulse?
Only public internet traffic sent into Relay by this configuration is handled. Traffic outside the tunnel still follows RouterOS routing. Direct access here means egress directly from the final Connector, which differs from local direct access in an employee’s client.