---
sourceDocument: Australia Workflow Data Fabric
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/integrate-applications

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Workflow Data Fabric

ft:clusterId :

    - crint

bundleId :

    - crint

workflow :

    - Creator


---

# Explore

# Exploring Reverse Tunnel {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Exploring Reverse Tunnel

Reverse Tunnel enables ServiceNow Zero Copy Connectors to securely access private or on-premises data sources by establishing encrypted outbound connections, eliminating the need to open inbound firewall ports.
It extends access to data sources within private cloud or on-premises networks by routing encrypted traffic through a gateway without decrypting it, ensuring data security and network isolation.
Show full answer Show less  

## Key Components

* **Gateway:** A central ServiceNow platform component that accepts authenticated outbound connections from private relays, enforces registration and hostname authorization, and routes encrypted traffic to the customer's data sources.
* **Private Relay:** Deployed within the customer network like a MID Server, it establishes outbound connections to the gateway and proxies traffic between the gateway and private cloud data sources. It uses certificates automatically managed by ServiceNow for authentication.
* **Gateway Controller:** Manages gateway instances, including creation and assignment to private relays.

## Users and Roles

* **Relay Manager:** Registers and manages private relays, monitors connection and registration health, and requires the *snzctunnel.relaymanager* role.
* **Relay User:** A service account used by the private relay to authenticate and fetch its configuration with the *snzctunnel.relayuser* role.

## Setup Workflow

* Install the *snzctunnel* plugin to manage relays and services.
* Create a service account for relay authentication with the appropriate role and note the password.
* Download, configure, and start the Reverse Tunnel Relay artifact within the customer network.
* Relay registers with the ServiceNow instance, creating a relay record linked to gateway records automatically.
* Add service endpoints to relay records for each data source to be accessed.
* Configure Zero Copy Connectors with required credentials and test the connection.

## Benefits

* Securely connect to private cloud or on-premises data sources without opening inbound firewall ports.
* Establish encrypted, outbound connections that protect data source credentials and IP addresses.
* Manage and monitor private relay registrations and connection health directly from your ServiceNow instance.

## Next Steps

To fully leverage Reverse Tunnel, explore detailed configuration guides and monitoring capabilities to ensure optimal connectivity and security of your private data source integrations.  
Reverse Tunnel enables Zero Copy Connectors to reach private or on-premises data sources through encrypted outbound connections without having to open inbound firewall ports.

## Reverse Tunnel overview {#exploring-reverse-tunnel__cf-exploring-parent-overview}

Reverse Tunnel extends Zero Copy Connectors access to data sources hosted in private cloud networks or on-premises networks. Because it accepts outbound connections from private relays deployed in the customer network and routes
encrypted traffic to the correct data source without decrypting it, Zero Copy Connectors can reach data sources that aren't publicly accessible.

## Key components {#exploring-reverse-tunnel__section_ngg_sry_kjc}

Gateway
:   The central infrastructure component hosted on the ServiceNow platform that accepts authenticated connections from private relays, enforces registration and hostname authorization, and routes encrypted traffic to customer-side data
    sources.

Private relay
:   A component deployed in the customer network that connects outbound to the gateway and proxies traffic between the gateway and the customer's private cloud data source. The relay is deployed in the customer network
and operates like a MID Server in placement and connectivity.  
Note:  
Private relays authenticate with the gateway automatically by using certificates. ServiceNow issues and renews the certificates, so you don't need to configure or manage them.

Gateway Controller
:   Manages gateway instances on the ServiceNow platform. Handles gateway creation and assignment to private relays.

## Reverse Tunnel users {#exploring-reverse-tunnel__cf-exploring-parent-users}

{#exploring-reverse-tunnel__table_jrf_cpy_kjc__entry__2}

| User | Description |
|-|-|
| Relay manager | Registers and manages private relays and monitors relay connection and registration health. Requires the sn_zc_tunnel.relay_manager role. |
| Relay user | A service account that the private relay uses to authenticate with the instance and fetch its configuration. |
[Table 1. Users]

{#exploring-reverse-tunnel__table_jrf_cpy_kjc}

## Reverse Tunnel workflow {#exploring-reverse-tunnel__cf-exploring-parent-workflow}

The setup workflow involves the following primary activities:

1. Install the `sn_zc_tunnel` (Zero Copy Reverse Tunnel), which provides the interface to manage relays and services.
2. Service account creation: The relay manager creates a service account in User Administration with the sn_zc_tunnel.relay_user role and notes the password for relay configuration.
3. Relay setup: The relay manager downloads the relay artifact `Reverse Tunnel Relay` from the store app, extracts the files, and configures and starts the relay.
4. Relay record configuration: After the relay starts, the relay registers with the instance and a new record is created in the `Relay
   [sn_zc_tunnel_relay]` table.

   Gateway records are automatically added to the Gateways field, tied to the instance name.
5. Backend services registration: The relay manager adds a service endpoint to the relay record for each data source to be accessed through the tunnel. For details, see [Manage relay service endpoints through Reverse Tunnel](https://www.servicenow.com/docs/UWI~9k1knkXaVwK7i0xwog "Add or update the service endpoints assigned to a private relay to control which data sources are accessible through Reverse Tunnel.").
6. Zero Copy Connectors connection setup: The relay manager configures the connector in Zero Copy Connectors with the required credentials and tests the connection.
{#exploring-reverse-tunnel__cf-exploring-parent-workflow-ol}

## Reverse Tunnel benefits {#exploring-reverse-tunnel__cf-exploring-parent-benefits}

{#exploring-reverse-tunnel__table_mrf_cpy_kjc__entry__2}

| Benefit | Feature |
|-|-|
| Connect to private cloud or on-premises data sources without having to open inbound firewall ports. | Reverse Tunnel |
| Establish encrypted connections between your private network and Workflow Data Fabric without exposing data source credentials or IP addresses. | Reverse Tunnel |
| Manage and monitor private relay registrations and connection health from your ServiceNow instance. | [Monitoring relay connectivity](https://www.servicenow.com/docs/aQxUV89H9Z8AcOvxVyxD6w "Monitor the connection health and registration status of private relays registered with Reverse Tunnel.") |
[Table 2. Benefits of Reverse Tunnel]

{#exploring-reverse-tunnel__table_mrf_cpy_kjc}

## What to explore next {#exploring-reverse-tunnel__cf-exploring-parent-links}

To learn more about configuring and using Reverse Tunnel, see:

* [Configuring Reverse Tunnel](https://www.servicenow.com/docs/HCmiDlzQo8TtMFTUoyKPXQ "Configure Reverse Tunnel to establish secure, private connectivity between your private cloud data sources and Workflow Data Fabric.")
* [Monitoring relay connectivity](https://www.servicenow.com/docs/aQxUV89H9Z8AcOvxVyxD6w "Monitor the connection health and registration status of private relays registered with Reverse Tunnel.")
{#exploring-reverse-tunnel__ul_nrf_cpy_kjc}