Manage TCP Proxy

TCP Proxy forwards connections from your service's public proxy IP and listening ports to an IPv4 backend. It is separate from DNS-record Website Protection.

Open Manage → TCP Proxy, select a service, and review its Overview before editing Configuration.

Set a backend and port mapping

1. Confirm your application is running and reachable on the intended backend IPv4 address and port.
2. In Configuration, set the default backend IP.
3. Add a listening port and its backend port. A mapping such as 443 → 8443 forwards traffic arriving on proxy port 443 to backend port 8443.
4. Use a per-port backend override only when that port must route to a different IPv4 address.
5. Review the complete configuration, save it, and test the public proxy IP and port from an authorized client.

Do not expose backend administration ports unintentionally. Enable PROXY protocol v2 only if the backend application supports it; otherwise connections may fail.

Port entitlement and limits

Your service shows its configured and available ports. Adding a mapping does not purchase additional ports. Use the offered port-upgrade checkout when more paid ports are needed, and review its price before ordering.

Connection and packet limits can reduce unwanted traffic, but overly restrictive values can block legitimate clients. Read the existing configuration, change only what you intend, and test after saving.

Source and country access rules

Review allowed and blocked source CIDRs and country rules before changing them. Keep the access required by your users, monitoring and management tools. Country rules use two-letter country codes and the modes disabled, allow or block.

When using the API, supplied arrays replace the full existing array; omitted fields remain unchanged. A replacement that omits an existing allow rule may remove access. Read back the saved configuration and verify connectivity.

Interpret traffic statistics

Stats shows traffic and observed events for a selected time window. Byte totals are not an instantaneous transfer rate, and observed connection events are not a count of currently open connections. Missing data means unavailable, not zero.

If connections fail

Check the proxy IP and listening port, backend address and port, backend firewall, source/country rules and per-port limits. Confirm the application accepts the configured protocol. Review one change at a time rather than repeatedly replacing the complete policy.

For automation, see DNS, Website Protection and TCP Proxy.