--- name: satellite-connector-agent-path title: Configuring the request path from your Connector agent description: Configure the outgoing request destination for your Connector agent, including routing through a proxy and setting the Satellite Tunnel server Ingress host. last-updated: 2026-08-27 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/satellite?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Configuring the request path from your Connector agent {: #connector-agent-path} Configure the outgoing request destination for your Connector agent, including routing through a proxy and setting the Satellite Tunnel server Ingress host. {: shortdesc} ## Configuring a proxy for your Satellite Connector agent {: #config-connector-proxy} You can use a forward proxy to establish the tunnel connection for your Satellite Connector agent. There are various ways to set up a proxy. These instructions assume that you have a properly configured proxy, which is accessible from the machine running the Connector agent. The following instructions have been tested with the Connector agent machine running Ubuntu 22.04 with an explicit Squid proxy running on a different machine from the Connector agent. The `HTTP_PROXY` and `HTTPS_PROXY` environment variables are used to redirect traffic to your proxy. For example: ```txt HTTP_PROXY=http://myUserName:myPassword@my.proxy.example.com:3128 HTTPS_PROXY=https://myUserName:myPassword@my.proxy.example.com:3129 ``` {: codeblock} Setting these environment variables for your Connector agent to use depends on your runtime environment. On a container platform, add them to your `env.txt` file. ```txt SATELLITE_CONNECTOR_ID=U2.....wZyI SATELLITE_CONNECTOR_IAM_APIKEY=/agent-env-files/apikey SATELLITE_CONNECTOR_TAGS=test HTTP_PROXY=http://myUserName:myPassword@192.168.3.87:3128 HTTPS_PROXY=https://myUserName:myPassword@192.168.3.87:3129 ``` {: codeblock} On Windows, add them to your `config.json` file. ```json { "SATELLITE_CONNECTOR_ID": "U2.....wZyI", "SATELLITE_CONNECTOR_IAM_APIKEY": "C:\\path\\to\\apikey", "SATELLITE_CONNECTOR_TAGS": "test", "PRETTY_LOG": true, "HTTP_PROXY": "http://myUserName:myPassword@192.168.3.87:3128", "HTTPS_PROXY": "https://myUserName:myPassword@192.168.3.87:3129" } ``` {: codeblock} If your Connector agent is running on a container platform, ensure that your container platform runtime is also using the proxy when pulling images from `icr.io`. For more information, see [Configure the Docker daemon to use a proxy server](https://docs.docker.com/engine/daemon/proxy/#httphttps-proxy){: external}. {: important} ## Configuring a Tunnel server Ingress host for your Satellite Connector agent {: #config-connector-ingress} You can configure the Satellite Tunnel server Ingress host that your Connector agent will forward traffic to. The Connector agent supports specifying either public or private Ingress hosts. To help with compliance management, you can configure a single network destination to reduce the number of outbound IP addresses to allow on your firewall. Also, by specifying an internal Ingress host, you can ensure that the traffic between your Connector agent and Tunnel server stays in your private network and no traffic uses the public internet. ### Specifying an internal host {: #specify-host} Internal Ingress hosts are regional with the format `d-{nn}-ws.private.{mzr}.link.satellite.cloud.ibm.com` (for example, a tunnel server private Ingress in us-south is `d-01-ws.private.us-south.link.satellite.cloud.ibm.com`). These hosts resolve to Cloud Service Endpoint (CSE) IP addresses which are IBM reserved addresses in the 166.9.x.x range. By connecting the agent using these addresses, you can ensure all traffic to the Tunnel server will stay in IBM's internal private network. Follow the steps to configure your Connector agent to use an internal Ingress host. 1. Review the [prereqs](https://cloud.ibm.com/docs/satellite?topic=satellite-run-agent-locally&format=markdown#agent-prepreqs) for running a Connector agent. 1. If the Connector agent is unable to reach the CSE endpoint IP addresses of the tunnel server directly from your local network, you may need to create a relay through which to send the agent requests. For more information, refer to [creating a relay](https://cloud.ibm.com/docs/satellite?topic=satellite-direct-link-tutorial&format=markdown#dl-create-coreos-relay). 1. Set the `SATELLITE_CONNECTOR_DIRECT_LINK_INGRESS` parameter along with your other required [agent parameters](https://cloud.ibm.com/docs/satellite?topic=satellite-run-agent-locally&format=markdown#review-parameters). For example: On a container platform, in your `env.txt` file. ```txt SATELLITE_CONNECTOR_ID=U2.....wZyI SATELLITE_CONNECTOR_IAM_APIKEY=/agent-env-files/api-key SATELLITE_CONNECTOR_TAGS=test SATELLITE_CONNECTOR_DIRECT_LINK_INGRESS=d-01-ws.private.us-south.link.satellite.cloud.ibm.com ``` {: codeblock} On Windows, in your `config.json` file. ```json { "SATELLITE_CONNECTOR_ID": "U2.....wZyI", "SATELLITE_CONNECTOR_IAM_APIKEY": "C:\\path\\to\\apikey", "SATELLITE_CONNECTOR_TAGS": "test", "PRETTY_LOG": true, "SATELLITE_CONNECTOR_DIRECT_LINK_INGRESS": "d-01-ws.private.us-south.link.satellite.cloud.ibm.com" } ``` {: codeblock} 1. Follow the steps to run your Connector agent [on your container platform](https://cloud.ibm.com/docs/satellite?topic=satellite-run-agent-locally&format=markdown#connector-agent-container-platform) or [on Windows](https://cloud.ibm.com/docs/satellite?topic=satellite-run-agent-locally&format=markdown#run-agent-windows). ### Specifying a single network destination {: #specify-dest} You can specify a single network destination instead of multiple destinations to reduce the number of outbound IP addresses to allow on your firewall. You can limit traffic to only use the tunnel server Ingress IP addresses in a single region by setting the `SATELLITE_CONNECTOR_DIRECT_LINK_INGRESS` parameter to a specific regional host. Public Ingress hosts are regional with the format `c-{nn}-ws.{mzr}.link.satellite.cloud.ibm.com` (for example, a tunnel server public Ingress in us-south is `c-01-ws.us-south.link.satellite.cloud.ibm.com`). To use the public Ingress in us-south, include the following parameter: - On a container platform, in your `env.txt` file. ```txt SATELLITE_CONNECTOR_DIRECT_LINK_INGRESS=c-01-ws.us-south.link.satellite.cloud.ibm.com ``` - On Windows, in your `config.json` file. ```json "SATELLITE_CONNECTOR_DIRECT_LINK_INGRESS": "c-01-ws.us-south.link.satellite.cloud.ibm.com" ``` This setting will allow you to limit your firewall to only allow the us-south IP addresses (169.46.88.106, 169.61.31.178, 169.61.156.226) as described in [network requirements](https://cloud.ibm.com/docs/satellite?topic=satellite-understand-connectors&format=markdown#network-requirements).