# DUT tunnel

By default the DUT connected to an LAA is inside a private network managed by
the LAA. In this network, the DUT is only able to access the LAA private IP and
nothing else. Not NAT nor rooting is in place.

:::{admonition} Private network
:class: warning
Forbidding the DUT to access the local network or even internet is a **security
feature** that should not be disabled without seeking permissions from the
network administrators.
:::

However some test suite requires access to some cloud services. The LAA can now
create a tunnel from the private network to a cloud server to forward traffic
from the DUT to some cloud services.

## Usage

In order to use the DUT tunnel, browse to the LAA page on LMS and click on
`Start` in the `Wstunnel access` card.

![wstunnel start](/_images/software/connectivity/wstunnel-start.png){align=center}

After some seconds, the tunnel will be available.

![wstunnel ok](/_images/software/connectivity/wstunnel-ok.png){align=center}

Now the DUT is able to transparently access to a given list of cloud services
via the tunnel.

## Technology

In order to tunnel the traffic from the DUT to the cloud services, the LAA
starts [wstunnel](https://github.com/erebe/wstunnel) service with a set of
traffic rules.

Every tcp and udp traffic coming from the DUT will transparently be forwarded
to wstunnel client that will forward the traffic to the wstunnel server over
websocket. The tunnel is managed by Linaro at
[wstunnel.lavacloud.io](http://wstunnel.lavacloud.io).