Appliance |
| Manages and applies the appliance configuration. Works with the Controller ( |
| Handles all DNS requests on the appliance. | |
| Listens for TCP connections and forwards them to | |
| Frontend for all the HTTPS traffic. Routes traffic to the correct daemon and the admin UI. | |
| Receives audit logs from | |
| Gathers audit logs from all daemons running on the appliance and forwards them to Rsyslog and the LogServer. | |
| Handles SSH connections to the appliance. | |
Controller |
| Handles all authentication, authorization, entitlements, policies and conditions, tokens, and so on. |
Gateway |
| Handles VPN traffic and has the firewall engine. There are multiple |
| Handles client claims and entitlement tokens, and generates firewall rules that it then sends to | |
| Name resolvers provide support for various types of cloud resolver ( | |
| Handles client failover through the ARP (IPv4) and NDP protocol (IPv6). This daemon also responds to ARP and NDP requests on the local network, enabling routers and endpoints to route return traffic to clients through the tunnel. | |
Connector |
| Manages the client service. |
| Manages the client driver. | |
| Creates and destroys the namespaces needed to run the clients. | |
| Sets and unsets the network interfaces and routes needed to run the clients. | |
Portal |
| Session management |
| Specific session instance | |
| Responsible for creating or destroying client instances | |
| DNS forwarding between | |
| Entry point for user's browsers. Performs tunneling towards endpoints through clients. | |
LogServer |
| Parses audit logs and inserts them into Opensearch. |
| Log database used for audit logs. | |
| Log viewer used to view audit logs. | |
LogForwarder |
| Parses audit logs and forwards them to configured destinations. |
Metrics Aggregator |
| Handles metrics for Prometheus and SNMP. |
Daemon names in logs
- Updated on May 29, 2026
- Published on Dec 15, 2025
- 1 minute read
Was this article helpful?