Skip to content
Network & DNS
Skip navigation
Network & DNS
View as Markdown

Send Traffic From Your Address

Bring up a bound egress on this host, run a job through it, and prove the far end saw the identity you expect.

Published

On this page (5)

Send Traffic From Your Address Documentation

This is the whole job for one host: bring the egress up, put a command behind it, and prove to yourself that the far end saw your agent's address and not the host's.

You need an API key on this machine and an agent to bind to. If you have neither yet, do Create an Identity first.

1. Install the CLI

bash
curl -fsSL https://get.whisper.online | sh

2. Sign in

bash
whisper login

That opens a browser approval. On a machine with no browser, pass the key instead: whisper login whisper_live_....

3. Bring the egress up

bash
whisper connect --agent shipping-bot

connect holds the connection open and prints one local proxy string of the form socks5h://127.0.0.1:<port>. The port is an unused loopback port unless you pin it with --port. The default tier is auto, so it tries the routed tunnel first and falls back to the bound proxy; the success line names the tier it landed on. To force one, add --tier wireguard or --tier socks5 (see Connectivity Tiers).

If you pass no --agent, connect uses the agent saved in ~/.config/whisper/agent. With no agent at all it creates one, and because every agent carries a human name it will ask for --name.

4. Put a job behind it

The short way sets the environment for you, so no proxy string reaches your shell history:

bash
whisper run curl -s https://rdap.whisper.online/egress-ip
{"ip":"2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"}

whisper run catches every tool that honours the standard proxy variables, so whisper run git clone https://example.com/repo.git and whisper run python agent.py work the same way.

For a job you cannot launch through the CLI, export the printed proxy into its environment instead, using the port from step 3:

bash
export ALL_PROXY=socks5h://127.0.0.1:<port>
export HTTPS_PROXY=$ALL_PROXY
export HTTP_PROXY=$ALL_PROXY

5. Prove the source

The echo at https://rdap.whisper.online/egress-ip reports the source address it was reached from, and it takes no key, so anyone can run it. Compare its answer with the agent the CLI thinks you are on:

bash
whisper ip --agent shipping-bot

The two must match. Then close the loop with stock DNS: the address the echo returned has a reverse record, and that record names the identity.

bash
dig -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 +short
ae3b051ff3bf7f478.t<tenant>.agents.whisper.online.

If the echo returns the host's own address rather than the agent's, the job is not going through the proxy: check that the process inherited the variables from step 4, and that whisper connect is still running in the foreground or as a service.

If the far end you care about answers only on the older protocol, read Reaching IPv4 Destinations before you hand anyone an allowlist entry.

To script this instead of typing it, the same egress is requested with one control-plane call, documented on Request Connectivity.