Install a Cloudraw connector

Overview

A connector is a small service that runs on a machine in your network. It connects your applications, file servers and private networks to the Cloudraw network, so the people you allow can reach them from anywhere.

• Outbound only. The connector makes outgoing connections on TCP 443. You do not open any inbound port, and your applications are never exposed to the internet.
• Deny by default. Installing a connector gives nobody access. You publish an application, choose the connector that hosts it, and then add an access rule.
• Host only. The connector does not change the machine's routes or DNS. It only forwards the connections that Cloudraw sends to it.

Where to put it

• On a machine that is always on, inside the network where your applications live.
• The machine must reach the applications by the same names and addresses you will publish. If it can open the application, the connector can too.
• A small virtual machine is enough. One connector can host many applications.
• For a SaaS app locked to your IP, use a machine with a fixed public IP. The SaaS sees that IP.
• For RemoteApps, a Windows connector on the RDP server itself can publish them for you. See RemoteApp helper.
• Plan for a second connector on another machine. See High availability.

You need

• The Owner, Security admin or Connector operator role in the Cloudraw admin console.
• Administrator rights on the machine (an Administrator PowerShell on Windows, sudo on Linux).

Requirements

Outbound connections

Allow these from the connector machine. If your firewall filters by name, allow the names, not today's IP addresses.

• Web proxy (Windows). Downloads and update checks use the machine's system proxy with the machine's credentials. The connector's own connections to the Cloudraw network go out directly on TCP 443, so allow those even if web browsing goes through a proxy.
• SSL inspection. Do not decrypt traffic to *.cloudraw.com. The connector checks the Cloudraw certificates itself.
• Antivirus and EDR. Some products block or quarantine new network services. If yours does, allow C:\Program Files\Cloudraw Connector\cloudraw-connector.exe. The Windows installer detects this and tells you (see Troubleshooting).

Install on Windows

1. Add the connector in CloudrawIn the admin console open Connectors and click Add connector. Give it a name, for example office-connector-1, and choose Windows.
2. Copy the install commandIt is one short line that looks like this: irm https://orchestrator-stg.cloudraw.com/c/<code> | iex Always copy it from your console. The link is for this one connector only. It works for 24 hours.
3. Run it as administratorOn the connector machine, right-click Windows PowerShell, choose Run as administrator, paste the command and press Enter.
4. Wait for "Online"The installer prints "connector is running and connecting". Within a few seconds the connector shows Online in the console.

What the installer sets up

Install on Linux

1. Add the connector in CloudrawIn Connectors click Add connector, name it and choose Linux.
2. Copy the install commandIt looks like this: curl -fsSL https://orchestrator-stg.cloudraw.com/c/<code> | sh The link works for 24 hours.
3. Run it on the connector machineRun it as a user who can use sudo. The script asks for sudo itself.
4. Wait for "Online"The script prints "connector is running" and the console shows the connector Online.

What the installer sets up

Check it with:

Install with Docker

1. Add the connector in CloudrawIn Connectors click Add connector, name it and choose Docker.
2. Copy the docker run commandCopy it exactly as the console shows it. It starts a container named cloudraw-connector-<name> that uses the host's network, restarts by itself (--restart unless-stopped), and keeps the connector's identity in a Docker volume with the same name.
3. Run it on a Linux Docker hostThe host must reach your applications, just like a Linux connector.
4. Wait for "Online"Check the container with docker ps and docker logs cloudraw-connector-<name>.

Updates

Connectors installed with the current Windows or Linux command update themselves. Cloudraw decides when. The connector checks every 15 minutes.

When updates install

Connectors follow your workspace update policy, the same one your desktop clients use.

Update now

In Connectors, click Update now on a connector. It updates at its next check, within 15 minutes, even outside the window. If the connector is the only one hosting an application, people lose that application for a few seconds while the service restarts. With two connectors there is no interruption.

How an update is applied

1. The connector downloads the new version from Cloudraw.
2. It checks Cloudraw's signature and the file's checksum. If either is wrong, it installs nothing.
3. It replaces the files, restarts the service and checks that it runs.
4. If the check fails, it puts the previous version back by itself.
5. It reports the result to the console.

Versions

A connector version looks like 1.18.7-b9c: the base version (1.18.7) followed by the Cloudraw build (b9c). Builds are in order: 1.18.7, 1.18.7-b9, 1.18.7-b9c, 1.18.7-b10, then 1.18.8.

Update logs

• Windows: C:\ProgramData\cloudraw-connector\update.log
• Linux: /var/log/cloudraw-connector-update.log. To check the update feed and its signature without installing anything, run sudo cloudraw-connector-update --verify.

High availability

An application can be hosted by up to 5 connectors. While at least one of them is online, people can reach the application. If one connector stops, the next connection goes through another one. Nobody needs to do anything.

1. Install a second connectorPut it on a different machine, ideally on a different host or in another site, that can also reach the application.
2. Add it to the applicationOpen the application and, under Hosted by, select both connectors. The application shows an HA badge and "Hosted by 2 connectors — keeps working if one fails".

• Private networks can also be hosted by several connectors.
• The connector page lists what each connector hosts, and which of those have no second connector.
• To remove a connector that is one of several hosts of an application or a private network, first take it out of Hosted by there.
• For a SaaS app locked to your IP, each connector leaves from its own public IP. Allow all of them at the SaaS. See Lock a SaaS app to your connector's IP.

RemoteApp helper

If the Windows connector runs on the RDP server itself, it publishes your RemoteApps there for you. You do not need to edit the server's RemoteApp list by hand.

• It works for RDP applications whose server address is the connector's own machine: localhost, 127.0.0.1, or the server's own name.
• It needs connector build b11 or newer.
• It only adds and removes its own entries. It does not touch RemoteApps that someone else set up.
• It lists the programs installed on the server, so you can pick the program from a list when you publish. The list appears within a few minutes.
• It is on by default. You can turn it off per connector on the connector's page.

See Publish a RemoteApp for the full steps.

Troubleshooting

On Windows, when the connector does not come online, the installer runs a check and prints the cause and the fix. It also saves a report to C:\ProgramData\cloudraw-connector\cloudraw-diagnostics.txt. Send that file to support if you are stuck.

To remove a Windows connector, use Settings→Apps→Cloudraw Connector→Uninstall. It removes the service, the scheduled tasks, the data folder and the program folder. Then remove the connector in the Cloudraw console.