BLAZINGFAST — TCP PROXY
Reviewed: 5 October 2026. Setup: 00-index.txt.
Production release: SDK/CLI 0.1.17; contract 2026-10-07.1. Check GET /v1/version and GET /v1/capabilities before using optional workflow features. Strict response validation is enforced.

PURPOSE
Forward public TCP listening ports to IPv4 backend ports, with optional per-port
backend overrides, PROXY protocol v2, connection/packet limits, source CIDR rules
and country access. This is not the HTTP Website Protection product or UDP preview.

PUBLIC API
GET /v1/tcp-proxy/{serviceId}: current configuration and port entitlement.
PATCH /v1/tcp-proxy/{serviceId}: backendIp, ports, allowedSourceCidrs,
blockedSourceCidrs and/or countryPolicy. Supplied arrays replace the full array;
omitted fields are preserved. Send a stable Idempotency-Key.
GET /v1/tcp-proxy/{serviceId}/stats?range=24h (also 1h or 7d).
Permissions: tcp_proxy.read / tcp_proxy.write plus service/project access.

CLI
bf tcp-proxy show SERVICE_UUID
bf tcp-proxy stats SERVICE_UUID --range 24h
After inspecting and preparing the replacement patch:
bf tcp-proxy update SERVICE_UUID --file tcp-patch.json --request-key tcp-change-001 --confirm-replace
The file contains only intended configuration fields. Include every port you
want to keep if replacing ports. Read back and test the public listening endpoint.

MCP
Hosted: get_tcp_proxy, get_tcp_proxy_stats, request_tcp_proxy_backend,
request_tcp_proxy_ports, request_tcp_proxy_access_policy.
Changes obey the connection's policy and paid entitlement; they do not buy ports.
Local MCP has no dedicated TCP Proxy tools. Use the CLI, SDK or public API.

LIMITS AND SAFETY
Country modes are disabled, allow, block (not Website Protection's off/allow/deny).
Only enable PROXY protocol when the backend accepts it. Excessively tight limits
can block legitimate long-lived connections. Do not expose management ports.
Additional paid ports require eligible upgrade checkout in the dashboard; adding
a mapping does not purchase capacity. No UDP support is claimed for this product.
Traffic bytes are window totals, not instantaneous rates; connection events are
not the number of currently open sockets. Missing/stale telemetry is not zero.