TCP and UDP endpoints

HTTP and gRPC ingress gives you a hostname with HTTPS. For anything else — a database client, a game server, a message broker, a custom binary protocol — you add a TCP or UDP ingress instead. You get a public address and a port.

Adding a TCP or UDP endpoint

1. Open the service panel → Settings tab → Networking.
2. Click TCP Proxy or UDP Proxy.
3. Enter the port your service listens on inside the environment.
4. Click Apply.

Once it is live, the Settings tab shows the public address and the assigned public port. That port is chosen by the platform and is not the same as your internal port — point your clients at the public one.

Internal:  my-service listens on 5432
Public:    102.221.184.10:31544

Restricting who can connect

A public port is reachable from anywhere on the internet by default. You can narrow this to a list of source addresses.

1. Open the service panel → Settings tab.
2. Find the TCP or UDP ingress entry and click Allowed sources.
3. Enter one or more CIDR ranges, one per line.
4. Click Apply.

Once the list is non-empty, connections from anywhere else are dropped before they reach your service.

Use it for the addresses you actually know: your office's static IP, a partner's egress range, a CI provider's published ranges. It is not a substitute for authentication — most clients do not have a fixed address, and an allowlist cannot tell two users behind the same address apart.

Changing or removing the allowlist

Edit the list and apply again. Clearing it entirely opens the port back up to everyone.

Multiple endpoints

A service can have several ingress entries at once — for example an HTTP endpoint for its API and a TCP endpoint for a protocol port. Each gets its own configuration, and TCP and UDP entries each get their own allowlist.

Removing an endpoint

Open the service panel → Settings tab, click the trash icon on the ingress entry, and apply. The public port stops accepting connections. The service keeps running.