Networking

Each workspace has a virtual network interface with configurable firewall rules. You control what traffic goes in and out.

Network architecture

Each workspace gets its own internal IP (e.g., 10.0.0.15)
All traffic passes through a per-VM firewall
Outbound internet is allowed by default (configurable)
Inbound traffic is denied by default (must explicitly open)

Internet access

By default, workspaces can reach the public internet. Disable this for sandboxed/untrusted code:

// Block outbound internet entirely
await ws.network.update(id, {
  allow_internet: false,
});

// Allow only specific hosts
await ws.network.update(id, {
  allow_internet: true,
  egress: ['api.github.com', 'registry.npmjs.org', 'cdn.jsdelivr.net'],
});

When allow_internet is false:

All outbound connections are blocked
The egress list is cleared
DNS still resolves but connections are refused

Firewall rules

Egress (outbound)

Control which external hosts the workspace can reach:

await ws.network.update(id, {
  egress: [
    'api.openai.com',       // Specific host
    '10.0.0.0/8',           // CIDR range
    'registry.npmjs.org',    // Package registry
  ],
});

Maximum 50 entries
Supports hostnames and CIDR notation
Only active when allow_internet: true

Ingress (inbound)

Control which sources can reach the workspace:

await ws.network.update(id, {
  ingress: ['10.0.0.0/8'],      // Allow from private network
  ingress_ports: [80, 443, 22], // Allow specific ports
  public_access: true,           // Allow from internet
});

ingress: allowed source hosts/CIDRs (max 50)
ingress_ports: allowed destination ports (max 50, range 1–65535)
public_access: enables the special host keyword for internet inbound

Public access

Expose workspace ports to the internet with auto-generated HTTPS URLs:

// Expose port 3000
const endpoint = await ws.publicAccess.expose(id, {
  port: 3000,
  label: 'Web Server',
});

console.log(endpoint.url);
// https://a1b2c3.preview.oblien.com

How it works:

The port is registered in the routing layer
A unique hash generates the subdomain
https://{hash}.preview.oblien.com → proxied to workspace port
HTTPS termination is automatic - your app serves plain HTTP

Key details:

Up to 20 ports per workspace
Preview URLs are public - anyone with the link can access
Workspace must be running to expose ports
Revoking a port removes the public endpoint immediately

Choose the primary managed proxy address for outbound HTTP/HTTPS. Managed failover can use a different exit address when that proxy fails; use a customer-controlled proxy when destinations require one fixed source IP.

const result = await ws.network.applyOutboundIp(id, {
  ip: '203.0.113.50',  // From GET /zone/mine
});

console.log(result.ip);       // "203.0.113.50"
console.log(result.country);  // "US"

This replaces the default primary proxy address. It does not guarantee that every connection uses this address during a managed-egress failover.

Managed egress failover

The gateway can try the workspace's assigned proxy, then an ordered list of provider-configured backup proxies or direct host addresses. It handles TCP HTTP/HTTPS on ports 80 and 443. This policy does not change UDP, QUIC, DNS, or other TCP-port routing.

Oblien operators configure the policy per server in Admin → Servers → Managed egress. Openship and other resellers inherit the policy for managed proxies; no application proxy environment variables or SDK upgrade are required. Customer-supplied proxies remain strict and are not silently replaced by a host IP.

A new connection gets one complete policy version. Published changes leave established connections on their current route. Connection failures, proxy CONNECT rejection, and closure before an eligible TLS ServerHello can select a backup. The gateway preserves TLS and SNI unchanged; the application continues to verify the destination's certificate.

Application traffic is never replayed. Once a route starts relaying application data, its connection cannot move transparently to another IP. The application must reconnect after a later connection failure and use its normal idempotency handling. TLS early data is not replayed to another route.

Workspace and namespace destination restrictions, disabled internet, account suspensions, and transfer allowances still apply. Backup traffic uses the same existing byte ledger. A provider failure does not turn an exhausted allowance into free internet. Private, loopback, metadata, and host-local destinations cannot be reached through direct fallback.

Failed routes have a short, bounded cooldown per workspace and destination so repeated requests avoid the same failed connection. Admin shows the applied policy revision, selected routes, failure reasons, and counters since daemon startup. The outbound_ip returned by the workspace API identifies its assigned primary proxy, not a guarantee of the source IP for every connection.

SSH access

Connect to Oblien's SSH gateway with your account connection. No public workspace IP or jump-host configuration is needed.

if (!(await ws.ssh.status(id)).ssh_enabled) {
  await ws.ssh.enable(id); // Owner only
}
const connection = await ws.ssh.connection(id);
const { host, port, username } = connection.ssh;
console.log(`ssh ${port === 22 ? '' : `-p ${port} `}${username}@${host}`);
// Use connection.ssh.password when your SSH client asks for a password.

In the dashboard, open SSH and select Enable SSH or Get SSH connection. The returned host, port, username and temporary password also work in SSH/SFTP clients. Verify the displayed gateway fingerprint.

The gateway routes to the native workspace SSH server and checks your access while connected. See SSH for file transfers, port forwarding, expiry and optional native account settings.

Default configuration

New workspaces start with:

Setting	Default
`allow_internet`	`true`
`public_access`	`false`
`ingress`	`[]` (none)
`ingress_ports`	`[]` (none)
`egress`	`[]` (unrestricted when internet is on)
`outbound_ip`	Shared (no dedicated IP)
`ssh`	Disabled
`private_links`	`[]` (none - fully isolated)

Workspaces are network-dark on the inbound side by default - no workspace, gateway, or external service can connect until you explicitly open access.

Private links

Allow workspace-to-workspace communication over the internal network. Private links whitelist a specific workspace's IP in the target's firewall:

// Allow ws_agent to reach ws_target
await ws.network.update('ws_target', {
  private_link_ids: ['ws_agent'],
});