Network PolicyConfigure Policies

Configure Raw TLS Passthrough

View as Markdown

Use raw TLS passthrough only when an allowed endpoint requires direct TLS negotiation. Keep L7 inspection for every endpoint that supports it.

Identify the TLS Failure

OpenShell normally terminates TLS for allowed HTTPS endpoints so it can inspect traffic. The proxy creates a new TLS connection to the upstream, including endpoints with access: full. Some Cloudflare-fronted upstreams reset that new handshake. Clients can report ECONNRESET or a TLS error such as curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL.

Protocols that require direct TLS negotiation can fail in the same way. For example, the WhatsApp HTTP/1.1 Noise-over-WebSocket handshake cannot use the proxy’s HTTP/2 ALPN negotiation.

Create a Passthrough Preset

Set access: full and tls: skip for the exact endpoint:

1preset:
2  name: cf-fronted-api
3  description: "Cloudflare-fronted API that resets re-originated TLS"
4network_policies:
5  cf_fronted_api:
6    name: cf_fronted_api
7    endpoints:
8      - host: api.example.com
9        port: 443
10        access: full
11        tls: skip
12    binaries:
13      - { path: /usr/local/bin/node }

Save the file as nemoclaw-blueprint/policies/presets/cf-fronted-api.yaml. The filename without .yaml must match preset.name.

Apply the catalog preset:

$nemohermes my-assistant policy-add cf-fronted-api

Run the same command after editing the file. NemoClaw compares the preset with the live policy and applies changed content.

The maintained whatsapp channel preset uses this structure for web.whatsapp.com. Refer to src/lib/messaging/channels/whatsapp/policy/hermes.yaml for an example. It combines tls: skip tunnel endpoints with inspected protocol: rest endpoints.

Understand the Security Boundary

tls: skip disables L7 inspection and egress-boundary credential resolution for that endpoint. The proxy cannot filter the HTTP method, path, or body after it creates the tunnel. Endpoint rules cannot constrain what the agent sends through the tunnel. The proxy also cannot replace an OpenShell credential placeholder inside the encrypted request. This configuration does not unblock endpoints that require both raw passthrough and egress-boundary credential resolution.

The declared host, port, and binaries scope remain in effect. Use tls: skip only for the exact hosts that require raw passthrough. Do not use a broad wildcard.