Exploring Reverse Tunnel

  • Release version: Australia
  • Updated May 31, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Exploring Reverse Tunnel

    Reverse Tunnel enables ServiceNow Zero Copy Connectors to securely access private or on-premises data sources without opening inbound firewall ports. It achieves this by establishing encrypted outbound connections from a private relay within the customer’s network to a ServiceNow-hosted gateway, ensuring data remains encrypted and secure throughout the transmission.

    Show full answer Show less

    This solution extends connectivity to data sources hosted in private cloud or on-premises environments that are not publicly accessible, maintaining robust security and compliance.

    Key Features

    • Gateway: Hosted on the ServiceNow platform, it authenticates connections from private relays, enforces authorization, and routes encrypted traffic to customer data sources without decrypting it.
    • Private Relay: Deployed within the customer network (similar to a MID Server), it makes outbound connections to the gateway and proxies communication with private data sources. It automatically authenticates using certificates managed by ServiceNow.
    • Gateway Controller: Manages gateway instances on the ServiceNow platform, including creation and assignment to private relays.
    • Role-based Users:
      • Relay manager: Manages relay registration and monitors connection health with the required role.
      • Relay user: Service account used by the private relay to authenticate and receive configuration.
    • Automated Certificate Management: Simplifies secure authentication between relays and the gateway.

    Implementation Workflow

    • Install the Zero Copy Reverse Tunnel application (snzctunnel) to manage relays and services.
    • Create a relay user service account with the appropriate role for relay authentication.
    • Download and configure the private relay artifact within the customer network and start the relay.
    • Upon startup, the relay registers with the ServiceNow instance, creating a relay record.
    • Request and assign gateway instances to the relay record automatically.
    • Add service endpoints for each private data source to be accessed through the tunnel.
    • Configure and test Zero Copy Connectors with the relay credentials to ensure connectivity.

    Benefits

    • Securely connects to private cloud or on-premises data sources without requiring inbound firewall changes.
    • Establishes encrypted connections that protect credentials and IP addresses, enhancing security.
    • Enables centralized monitoring and management of private relays and their connectivity status from within the ServiceNow instance.

    Next Steps

    To effectively implement and manage Reverse Tunnel, customers should consult documentation on configuring Reverse Tunnel and monitoring relay connectivity to ensure optimal setup and operation.

    Reverse Tunnel enables Zero Copy Connectors to reach private or on-premises data sources through encrypted outbound connections without having to open inbound firewall ports.

    Reverse Tunnel overview

    Reverse Tunnel extends Zero Copy Connectors access to data sources hosted in private cloud networks or on-premises networks. Because it accepts outbound connections from private relays deployed in the customer network and routes encrypted traffic to the correct data source without decrypting it, Zero Copy Connectors can reach data sources that aren't publicly accessible.

    Key components

    Gateway
    The central infrastructure component hosted on the ServiceNow platform that accepts authenticated connections from private relays, enforces registration and hostname authorization, and routes encrypted traffic to customer-side data sources.
    Private relay
    A component deployed in the customer network that connects outbound to the gateway and proxies traffic between the gateway and the customer's private cloud data source. The relay is deployed in the customer network and operates like a MID Server in placement and connectivity.
    Note:
    Private relays authenticate with the gateway automatically using certificates issued by the ServiceNow instance. Certificate configuration and management are handled automatically.
    Gateway Controller
    Manages gateway instances on the ServiceNow platform. Handles gateway creation and assignment to private relays.

    Reverse Tunnel users

    Table 1. Users
    User Description
    Relay manager Registers and manages private relays and monitors relay connection and registration health. Requires the sn_zc_tunnel.relay_manager role.
    Relay user A service account that the private relay uses to authenticate with the instance and fetch its configuration.

    Reverse Tunnel workflow

    The setup workflow involves the following primary activities:

    1. Install the sn_zc_tunnel (Zero Copy Reverse Tunnel), which provides the interface to manage relays and services.
    2. Service account creation: The relay manager creates a service account in User Administration with the sn_zc_tunnel.relay_user role and notes the password for relay configuration.
    3. Relay setup: The relay manager downloads the relay artifact Reverse Tunnel Relay from the store app, extracts the files, and configures and starts the relay.
    4. Relay record configuration: After the relay starts, the relay registers with the instance and a new record is created in the Relay [sn_zc_tunnel_relay] table. The relay manager requests a gateway instance.

      Two gateway records are automatically attached to the Gateways field, tied to the instance name.

    5. Backend services registration: The relay manager adds a service endpoint to the relay record for each data source to be accessed through the tunnel. For details, see Manage relay service endpoints through Reverse Tunnel.
    6. Zero Copy Connectors connection setup: The relay manager configures the connector in Zero Copy Connectors with the required credentials and tests the connection.

    Reverse Tunnel benefits

    Table 2. Benefits of Reverse Tunnel
    Benefit Feature
    Connect to private cloud or on-premises data sources without having to open inbound firewall ports. Reverse Tunnel
    Establish encrypted connections between your private network and Workflow Data Fabric without exposing data source credentials or IP addresses. Reverse Tunnel
    Manage and monitor private relay registrations and connection health from your ServiceNow instance. Monitoring relay connectivity

    What to explore next

    To learn more about configuring and using Reverse Tunnel, see: