fm CLI reference

fm tunnel

fm tunnel listens on a local port and sends each connection to a remote host and port from your static IPs. It carries outbound traffic only.

fm tunnel 5432:db.example.com:5432

Your driver then connects to 127.0.0.1:5432. Give it the real server name for TLS checks, as the databases guide shows.

# Several mappings in one process
fm tunnel 5432:db.example.com:5432 3306:mysql.example.com:3306

# Text logs instead of JSON lines
fm tunnel --log text 5432:db.example.com:5432

# A config file somewhere else
fm tunnel --config /run/secrets/fixedmark.toml 5432:db.example.com:5432

Credentials

fm reads credentials from a config file first, then from FIXEDMARK_SOCKS_URL. It never calls a Fixedmark API when it starts, so an API outage cannot stop your app from booting.

The default file is $XDG_CONFIG_HOME/fixedmark/config.toml, or ~/.config/fixedmark/config.toml. Pass --config to name another one.

# ~/.config/fixedmark/config.toml
app_id = "APP_ID"
token = "fmc_TOKEN"
endpoint = "mum.egress.fixedmark.com:1443"

Without a file, fm reads the SOCKS URL the dashboard shows. It accepts socks5s://, socks5h://, and socks5://, and always connects over TLS on port 1443.

export FIXEDMARK_SOCKS_URL="socks5h://APP_ID:TOKEN@mum.egress.fixedmark.com:1080"
fm tunnel 5432:db.example.com:5432

Running beside your app

The tunnel must run as long as your app does. On a platform with one start command, start it in the background first:

web: fm tunnel 5432:db.example.com:5432 & node server.js

• Your app may start before the tunnel listens. Retry the first connection, as most pools do.
• Serverless functions cannot keep a background process. Use a SOCKS5 driver there.
• If the endpoint is unreachable, fm retries with backoff, then exits with code 4.

Logs and exit codes

fm writes one JSON line per event to standard output, or text with --log text. It logs endpoint connected, each connection closed with bytes and duration, and endpoint unreachable, retrying.

A destination your allowlist refuses shows as not_allowed on that one connection. The tunnel keeps running.

Other commands

These commands call the REST API with an API key. Run fm auth login once to store the key, or set FM_API_KEY.

Inbound routes

Inbound traffic uses fm routes, not fm tunnel. Routes belong to an app. create and list need --app with the app's id or name, and the other fm routes commands take it optionally. fm routes create gives a service on a connector's machine a hostname on the shared pool, or with --dedicated-ip a port on a dedicated IP of the app. See Tunnels and Dedicated inbound IP. Tunnels on Pro and up, with a dedicated inbound IP as an add-on at $9 per IP-month.

# A hostname on the shared pool for a service on a connector's machine
fm routes create --app shop --kind http --name web --connector billing-db --to 127.0.0.1:8080 --partner 198.51.100.0/24

# A TCP port on a dedicated IP, to a host the node dials
fm routes create --app shop --kind tcp --name db --dedicated-ip IP_ID --origin db.example.com:5432 --partner 198.51.100.0/24

fm routes list --app shop
fm routes show web
fm routes placement web --dedicated-ip IP_ID
fm routes delete web

A route takes --origin or --connector with --to, never both. --origin needs --dedicated-ip, since a shared IP never dials out. --proxy-protocol goes with --connector only. show, placement, partners set, and delete name a route by id or name and search every app unless you pass --app. fm routes reference lists every flag.

fm connectors

fm connectors manages an app's connectors. Create and rotate write the new token to fm-connector-NAME.token in the current directory at mode 0600, print the install line, and never show the token again. --token-file PATH writes it somewhere else.

fm connectors create --app APP_ID --name billing-db
fm connectors list --app APP_ID
fm connectors rotate --app APP_ID billing-db
fm connectors delete --app APP_ID billing-db

list shows each connector's token prefix, state, open sessions, and when it was last seen. delete is refused with connector.in_use while a route names the connector.

The connector itself is fixedmarkd, a separate program on the machine that holds your service, not an fm command. On that machine, from the directory with the token file, run the install line. Connectors covers fixedmarkd's commands, service, status, and exit codes.

sudo fixedmarkd install --token-file fm-connector-billing-db.token