---
title: Configuring a relay
description: "A relay is designed for deployment in networks that don't allow inbound connections, enabling access to resources within that private network."
component: privilege
page_id: privilege:human-privilege:configuration/gateways/relays
canonical_url: https://docs.pingidentity.com/privilege/human-privilege/configuration/gateways/relays.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: May 4, 2026
page_aliases: ["configuration:network-infrastructure/private-relays.adoc"]
section_ids:
  configure-a-relay-using-the-setup-wizard: Configure a relay using the setup wizard
  before-you-begin: Before you begin
  steps: Steps
  configure-a-relay-through-docker: Configure a relay through Docker
  before-you-begin-2: Before you begin
  steps-2: Steps
  next-steps: Next steps
---

# Configuring a relay

Relays allow you to deploy in networks that don't allow inbound connections from the internet. The relay, deployed as a Docker container, establishes a secure, egress-only connection to a PingOne Privilege gateway, enabling access to resources located within its private network.

PingOne Privilege allows you to add a relay using a setup wizard or through Docker.

## Configure a relay using the setup wizard

### Before you begin

* In the PingOne admin console, create an OIDC web application. For instructions, refer to [Creating a web application](https://docs.pingidentity.com/pingone/applications/p1_mfa_creating_a_web_application.html) in the PingOne documentation.

* Before you add a relay, create a new Virtual Machine (VM) to deploy the proxy container. Ensure the VM meets the required specifications for optimal performance and connectivity:

  * **CPU**: 2 cores, sufficient for processing proxy operations efficiently.

  * **RAM**: 4 GB ensures smooth container operation.

  * **Storage**: 20 GB accommodates system files and application data.

  * **Firewall Policy**:

    * **Outbound**: Allow all traffic.

* Supported Operating Systems:

  * `RHEL / CentOS (RPM x86_64)`

  * `Debian / Ubuntu AMD64`

  * `Debian / Ubuntu ARM64`

### Steps

To add a relay using the setup wizard:

1. In the PingOne Privilege admin console, go to **Directory > Gateways**.

2. Click **Add New**, and then click **Add via Wizard**.

3. Review the requirements for your VM, then click **Next**.

4. Install Docker based on the official [Docker installation guide for your OS](https://docs.docker.com/engine/install/).

5. Verify Docker is running using the following command in your CLI:

   `sudo docker ps`

   If the command runs without errors, Docker is installed and running successfully.

6. Select **Private Proxy** as your deployment mode. Click **Next**

7. In the following **Gateway Config** wizard, ensure **Relay** is selected.

8. Enter a **Relay Name** to identify your relay.

9. Enter the **Host Name** of the server where the relay will be installed.

10. **(Optional)**: Click the **Deploy RDP** checkbox to deploy a remote desktop.

11. Click **Next**.

12. Create the environment file with the following commands:

    1. To create the directory, if not already present:

       `sudo mkdir -p /var/lib/procyon`

    2. To create the file and open it:

       `sudo vi /var/lib/procyon/procyon-guest-agent.env`

    3. Copy the generated content from your setup tasks and paste it inside the newly created file and save it.

    4. In the setup wizard, click **Next**.

13. Select your operating system from the list. Click **Show Instructions** for the detailed steps for installing the package for your operating system.

14. Click **Finish**.

## Configure a relay through Docker

### Before you begin

* In the PingOne admin console, create an OIDC web application. For instructions, refer to [Creating a web application](https://docs.pingidentity.com/pingone/applications/p1_mfa_creating_a_web_application.html) in the PingOne documentation.

* Ensure the following inbound ports are open on the host where you will install the relay:

  * `22`

  * `443`

  * `3389`

  * `8680`

  * `8690`

### Steps

To add a relay through Docker:

1. In the PingOne Privilege admin console, go to **Directory > Gateways**.

2. Click **Add New**, and then click **Add via Docker**.

3. Select **Relay**.

4. Enter a unique **Cluster ID** to identify this relay group.

5. Enter the **Host Name** of the server where the relay will be installed.

6. Click **Copy Docker Command** to copy the command to your clipboard.

7. On your designated host within your on-premise network, run the copied Docker command you just copied.

   **Result:** The relay starts and automatically registers with the Endpoint Controller.

|   |                                                                                                                                                                                                |
| - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | The Endpoint Controller doesn't have automatic visibility into on-premises network topology. After deploying the relay, you must manually configure which resources are accessible through it. |

### Next steps

After adding the relay, go to the **Gateways** page in the admin console. Your new relay should be listed with a `Verified` status.