TCP Tunnels — connection commands¶

In addition to HTTP, dixu_proxy proxies arbitrary TCP traffic over the same WebSocket connection used by device_client. The proxy terminates TLS — your device doesn't need to configure SSL for any protocol (except VNC). For the protocol-level implementation details (how the slug is identified per port), see dixu_proxy/README.md. This page is a practical command reference for users and support.

Docker stack limitation: SSH (port 22), RDP (3389) and VNC (5900) are unavailable when the tunnel is running as a container stack (📦 docker stack). Those toggles are disabled in the dashboard with an explanatory tooltip. Databases (PostgreSQL, MySQL, Redis, MongoDB) work in docker stacks as long as the DB container listens on the correct port inside the docker network.

Ports¶

Protocol	External port	Device port	Min. plan
SSH	2222	22	VIP
RDP	3389	3389	PRO
VNC	4900	5900	PRO
PostgreSQL	4432	5432	PERS
MySQL	4306	3306	PERS
Redis	4379	6379	PERS
MongoDB	4017	27017	PERS

Ports are enabled in the dashboard → Tunnel → Direct TCP.

Connection commands¶

# SSH — via ProxyCommand with DIXSU header
ssh -o "ProxyCommand=bash -c '{ echo DIXSU:slug; cat; } | nc slug.dix.su 2222'" \
  user@slug.dix.su

# RDP — direct connection (SNI from hostname)
xfreerdp /v:slug.dix.su:3389 /u:USER /cert:ignore

# VNC — direct TLS connection (requires x11vnc --ssl on the device)
vncviewer slug.dix.su::4900

# PostgreSQL — direct TLS connection
psql "host=slug.dix.su port=4432 dbname=mydb user=postgres sslmode=require"

# MySQL — direct TLS connection
mysql -h slug.dix.su -P 4306 -u root -p --ssl-mode=REQUIRED

# Redis — requires --sni (redis-cli doesn't pick up SNI from -h automatically)
redis-cli -h slug.dix.su -p 4379 --tls --insecure --sni slug.dix.su

# MongoDB
mongosh "mongodb://slug.dix.su:4017/mydb?tls=true&tlsAllowInvalidCertificates=true"

# SFTP
sftp -o "ProxyCommand=bash -c '{ echo DIXSU:slug; cat; } | nc slug.dix.su 2222'" \
  user@slug.dix.su

SSH keys (recommended)¶

Using keys instead of passwords is more secure and more convenient.

1. Generate a key on your local machine¶

ssh-keygen -t ed25519 -C "my-pc" -f ~/.ssh/dixsu_tunnel
# creates ~/.ssh/dixsu_tunnel (private) and ~/.ssh/dixsu_tunnel.pub (public)

2. Copy the public key to the device¶

ssh-copy-id -i ~/.ssh/dixsu_tunnel.pub \
  -p 2222 \
  -o "ProxyCommand=bash -c '{ echo DIXSU:slug; cat; } | nc slug.dix.su 2222'" \
  user@slug.dix.su

Or manually — log in to the device and run:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo "contents_of_dixsu_tunnel.pub" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

3. Connect with a key¶

ssh -i ~/.ssh/dixsu_tunnel \
  -p 2222 \
  -o "ProxyCommand=bash -c '{ echo DIXSU:slug; cat; } | nc slug.dix.su 2222'" \
  user@slug.dix.su

4. `~/.ssh/config` for convenience¶

Host mydevice
  HostName slug.dix.su
  User root
  Port 2222
  IdentityFile ~/.ssh/dixsu_tunnel
  ProxyCommand bash -c '{ echo DIXSU:slug; cat; } | nc slug.dix.su 2222'

After this: ssh mydevice, sftp mydevice

On the device, in /etc/ssh/sshd_config:

PasswordAuthentication no
PubkeyAuthentication yes

systemctl restart sshd

`~/.ssh/config` without keys¶

Host slug.dix.su
    ProxyCommand bash -c '{ echo DIXSU:slug; cat; } | nc %h 2222'

After this: ssh user@slug.dix.su, sftp user@slug.dix.su, and DBeaver's SSH tunnel config will also pick it up.

DBeaver — database connections¶

Direct TLS connection (recommended):

DBeaver → New Connection → select your DB:

Parameter	PostgreSQL	MySQL
Host	`slug.dix.su`	`slug.dix.su`
Port	`4432`	`4306`
SSL	enable	useSSL=true
Verify cert	disable	verifyServerCertificate=false

Don't use the SSH tab in DBeaver — the proxy already handles everything directly.

Via SSH tunnel (if you prefer):

Add ~/.ssh/config (see above) and in DBeaver: New Connection → PostgreSQL → SSH tab → Use SSH tunnel ✓, SSH Host: slug.dix.su, Port: 2222, SSH User: your_user. Select Native client (not JSch) — DBeaver then uses the system ssh that reads config.

SFTP and file managers¶

Set up ~/.ssh/config (see above) and connect directly: - Krusader / Dolphin / FileZilla: sftp://user@slug.dix.su/

How it works: SSH routing vs. other protocols¶

SSH uses a custom ProxyCommand that sends a DIXSU:slug header before the SSH handshake. The proxy reads this header to look up the right device.

RDP, VNC, databases can't send such a header, so they work via the TLS SNI mechanism: the client's TLS ClientHello contains slug.dix.su as the server name, which is used for routing. This is why all these protocols require TLS — plaintext connections (e.g. Minecraft Java, MQTT) cannot be routed and are not supported.

UDP is not supported at all — the WebSocket relay works over TCP only.