---
sourceDocument: Australia Workflow Data Fabric
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/integrate-applications

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Workflow Data Fabric

ft:clusterId :

    - crint

bundleId :

    - crint

workflow :

    - Creator


---

# Connect a private relay to the Reverse Tunnel gateway

# Connect a private relay to the Reverse Tunnel gateway {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Configure and register a private relay to establish an encrypted connection to the Reverse Tunnel gateway.

## Before you begin

* The host machine must be running Linux x86-64 or Windows x86-64.
* The host machine must have outbound network access to the ServiceNow instance on port 443.
* After the relay registers, the host machine must also have access to each gateway host on its data port and admin port. For the purpose of each port, see [Reverse Tunnel architecture](https://www.servicenow.com/docs/igkMIgLPKBoXJ9oypPUWDw "A private relay opens outbound connections to your instance and to the gateway. Knowing the ports and their purposes helps you configure firewall rules.").
* A user account must be available to create a service account for the relay.

{#connect-customer-relay__ul_ikr_bt3_ljc}

Role required: sn_zc_tunnel.relay_manager

## Procedure

1. Download the relay artifact Reverse Tunnel Relay from the ServiceNow Store.
2. Extract the artifact files.
3. Verify outbound network access from the host machine to your ServiceNow instance on port 443.  
   Replace `<instance>` with the name of your ServiceNow instance.

   On Windows, run the following command:

       Test-NetConnection -ComputerName <instance>.service-now.com -Port 443

   On Linux, run the following command:

       nc -zv <instance>.service-now.com 443

   For examples of the output, see [Verify outbound network access for a private relay](https://www.servicenow.com/docs/wDXZF7hH0dfenx1ulSinNw "Verify that the relay host machine can reach each Reverse Tunnel gateway host on the data port and the admin port.").
4. Configure and start the relay following the README instructions included in the extracted artifact.
5. Navigate to AllPrivate RelayRelays and verify a relay record was created.  
   Note:  
   After successful registration, a record ID is stored in the config.yaml file. Do not modify or remove this value.
6. Verify outbound network access from the relay host machine to each gateway host.  
   Outbound firewall rules must permit access to each gateway host on its data port and admin port. For the required steps, see [Verify outbound network access for a private relay](https://www.servicenow.com/docs/wDXZF7hH0dfenx1ulSinNw "Verify that the relay host machine can reach each Reverse Tunnel gateway host on the data port and the admin port.").
7. Register backend services to the relay.
   1. Note the fully qualified domain name (FQDN) and port number of the data source you want to access through the tunnel.  
      For example: `acme.snowflakecomputing.com:443`.
   2. In the relay record, select Unlock Services.
   3. Select Lookup using list icon ![]() to open the Service Endpoints list.
   4. Select New.
   5. Enter a name for the service endpoint and the FQDN and port number.
   6. Select Submit.
   7. Save the record.

   {#connect-customer-relay__substeps_mkr_bt3_ljc}  
   Assigned services are reported to the gateway, which routes incoming traffic to the correct relay. To add or update service endpoints after initial setup, see [Manage relay service endpoints through Reverse Tunnel](https://www.servicenow.com/docs/UWI~9k1knkXaVwK7i0xwog "Add or update the service endpoints assigned to a private relay to control which data sources are accessible through Reverse Tunnel.").
8. Set up the zero copy connection.
   1. Navigate to AllZero Copy Connectors (Workflow Data Fabric).
   2. Select the connector you want to configure with the relay.
   3. Enter the credentials for the connector.  
      Note:  
      The connection URL hostname must exactly match the FQDN registered as a service endpoint. If the backend data source has an IP allowlist restriction, verify the relay is running on the same machine that is on the allowlist.
   4. Select Test Connection.  
      If the connection test succeeds, the private tunnel setup is complete.
   {#connect-customer-relay__substeps_nkr_bt3_ljc}
{#connect-customer-relay__steps_jkr_bt3_ljc}

*[\>]: and then