# Connectors

1. [Home](https://www.agilicus.com/)
2. [Agilicus AnyX Administrative Web Interface](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/)
3. [Concepts](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/)
4. Connectors

![](https://www.agilicus.com/www/7fcfbb2e-featured-anyx-admin-conceptsconnectors.png)## Connectors

[CONTACT](/contact-us/)

A **connector** is the piece of Agilicus AnyX that runs on your side of the network and links your local resources to the Agilicus cloud. It is the component that makes zero trust access possible without opening any inbound ports.

## What a connector does

The connector maintains **outbound-only** connections to the Agilicus cloud. When a user is authenticated and authorised for a resource, the identity-aware proxy forwards the request to the connector, and the connector connects to the resource on your local network and relays the traffic back.

Because the connector only ever makes connections **out** to the cloud:

- your firewall needs no inbound rules for the platform;
- your resources are invisible to the public internet;
- the connector works on almost any network, including networks behind carrier-grade network address translation; and
- the connector can reach resources on networks that are not directly connected to it (through other connectors or routing).

```
%%{init: {"theme": "base", "themeVariables": {"background": "#ffffff", "primaryColor": "#e8f1fb", "primaryBorderColor": "#1f4e79", "primaryTextColor": "#111111", "lineColor": "#4a4a4a", "secondaryColor": "#f5f5f5", "fontFamily": "Inter, sans-serif"}} }%%
flowchart LR
    subgraph Cloud["Agilicus cloud"]
        AP[Identity-aware proxy]
    end
    subgraph Site["Your site"]
        C1[Connector]
        C2[Connector]
        R1[Web application]
        R2[Database]
        R3[Legacy system]
    end
    AP <-->|outbound-only tunnel| C1
    AP <-->|outbound-only tunnel| C2
    C1 --> R1
    C1 --> R2
    C2 --> R3
```

## Deployment options

Connectors run on a wide range of platforms. The portal's [connector overview](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/) shows every connector you have deployed and its health. Supported deployments include:

- a **container** (Docker or Kubernetes), the easiest way to run a connector in modern environments;
- **Linux, FreeBSD, and embedded systems** (a generic installer);
- popular **routers and appliances** such as Ubiquiti EdgeRouter, Mikrotik, pfSense/Netgate, OpenWRT, QNAP, and NanoPi;
- **Microsoft Windows** (for a Windows host or a Windows cluster);
- **single-board computers** such as a Raspberry Pi; and
- **cloud virtual machines** (for example an AWS EC2 instance inside a private VPC).

Each connector needs to be able to reach the Agilicus cloud (HTTPS outbound) and to reach the resources it fronts. It does not need a public IP address.

## Installing and sign-in

A connector is created in the portal (see [Connectors](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/)) and then installed on the target device using the instructions shown after creation. Once installed, the connector signs in to the platform (usually with a token or via a sign-in flow) and appears in the connector overview with its status and diagnostic counters.

See also:

- [Agilicus connector](https://www.agilicus.com/product-guide/agilicus-connector) (web guide)
- [Connector sign-in](https://www.agilicus.com/product-guide/connector-sign-in)
- [Site firewall configuration](https://www.agilicus.com/site-firewall-configuration)

## High availability

You can run more than one connector for the same site so that a single connector failure does not interrupt access. The cloud load-balances across the healthy connectors. See [Connector high availability](https://www.agilicus.com/product-guide/agilicus-connector-high-availability) and the connector management pages in this guide.

## Diagnostic counters

Each connector reports diagnostic counters that you can inspect from the portal to understand its health: connection state, throughput, and any errors. These are covered in [Connectors](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/) and the web guide's [connector details and diagnostic counters](https://www.agilicus.com/product-guide/connector-details-diagnostic-counters).

## Good practices

- Place the connector **close to the resources** it fronts so traffic does not traverse unnecessary segments.
- Keep the connector software up to date.
- Run at least two connectors for production sites to survive hardware failure.
- Restrict outbound access from the connector to only what it needs (the Agilicus cloud addresses and the local resources).
- Use a dedicated, minimal host (container or appliance) rather than a shared general-purpose server.

## See also

- [Zero trust architecture](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/zero-trust-architecture/)
- [Connectors](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/) (portal screens)
- [Forwarding](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/) (external forwarding through connectors)
- [Getting started: connect to sites](/anyx-guide/agilicus-anyx-administrative-web-interface/getting-started/connect-to-sites/)

## Web guide

- [Agilicus connector](https://www.agilicus.com/product-guide/agilicus-connector)
- [Generic connector install (Linux, FreeBSD, embedded)](https://www.agilicus.com/product-guide/generic-connector-install)
- [Best practices for connectors](https://www.agilicus.com/best-practices-for-connectors)
- [Does my connector need to be directly connected to my networks?](https://www.agilicus.com/does-my-connector-need-to-be-directly-connected-to-my-networks)
- [Connector high availability](https://www.agilicus.com/product-guide/agilicus-connector-high-availability)