Name
nebius tunnel connect
Connect to a tunnel TCP service through the public edge.
The argument is the tunnel route address <service>-<weakid>.<domain>:<port>
and is passed to the dialer as-is. The host part is sent as the TLS server
name (SNI), which is how the edge routes the connection; —sni overrides it,
e.g. when connecting to an IP address directly. The server certificate is
verified against the system roots by default.
The command performs no API calls and does not require a configured profile.
By default the command is a local port forwarder: it binds —listen
(127.0.0.1:0 unless set), prints the actual bound address to stdout as a
single line, and forwards every accepted connection through its own TLS
connection to the edge. It runs until interrupted; active connections are
closed on shutdown.
With —stdio the process instead becomes a byte pipe suitable as an SSH
ProxyCommand: stdout carries tunnel bytes exclusively, and all diagnostics
go to stderr.
Synopsis
Examples
Options
--connect-timeout (duration: 2h30m10s)
TCP+TLS dial timeout per connection.
--insecure (bool)
Skip TLS certificate verification; prints a warning to stderr.
--listen (string)
Listener mode (the default) bind address; address is printed to stdout.
--sni (string)
TLS server name (SNI) to send instead of the host part of the address; the edge routes on SNI, so set this when connecting by IP address.
--stdio (bool)
Pipe stdin/stdout to the TLS connection (for use as an SSH ProxyCommand).
Global Options
-h, --help (bool)
Show this message.
-p, --profile (string)
Set a profile for interacting with the cloud.
--format (string)
Output format. Supported values: yaml|json|jsonpath|table|text.
-f, --file (string)
Input file. For ‘update’ commands automatically set —full=true.
-c, --config (string)
Provide path to config file.
--debug (bool)
Enable debug logs.
-I, --impersonate-service-account-id (string)
Impersonate into the service account and use its token for a command.
--color (bool)
Enable colored output.
--no-browser (bool)
Do not open browser automatically on auth.
--auth-timeout (duration: 2h30m10s)
Set the timeout for the request including authentication process, default is 15m0s.
--per-retry-timeout (duration: 2h30m10s)
Set the timeout for each retry attempt, default is 20s.
--retries (uint)
Set the number of retry attempts, 1 is disable retries, default is 3.
--timeout (duration: 2h30m10s)
Set the timeout for the main request, default is 1m0s.
--no-check-update (bool)
Suppress check for updates.
--no-progress (bool)
Suppress progress indicators and spinners.