TCP & UDP Tunnels
Forward raw socket services and understand the public endpoint's security boundary.
Use HTTP tunnels for websites and HTTP APIs. Use TCP or UDP when the client needs to connect to a raw socket service rather than a URL.
| Protocol | Typical local service | Public endpoint |
|---|---|---|
| HTTP | Development website, webhook receiver, HTTP API | URL |
| TCP | SSH, PostgreSQL, other stream-based services | Host and assigned port |
| UDP | Datagram-based game or diagnostic service | Host and assigned port |
TCP
Authenticate, start the local service, then forward its port:
outray login
outray tcp 5432Connect your database client to the host and port printed by OutRay, not to your local port number.
To request a public port:
outray tcp 5432 --remote-port 25432The requested port must be in the tunnel server's configured range and available. A busy or invalid requested port produces an error; it is not silently replaced with a different port. Omit --remote-port for automatic allocation.
UDP
outray udp 5000
outray udp 5000 --remote-port 35000Clients send datagrams to the printed public endpoint. OutRay forwards them to the local UDP service and relays its responses. UDP does not provide TCP's connection or delivery guarantees.
As with TCP, an explicit public port must be available and within the server's configured range. The local and public port numbers do not have to match.
Port ranges
The server's default allocation pools are 20000–30000 for TCP and 30001–40000 for UDP. Use the assigned endpoint from the CLI instead of assuming a particular public host or port.
Security
The hosted CLI-to-OutRay connection uses TLS-protected WebSockets. That does not automatically encrypt a visitor's raw TCP or UDP connection to the public endpoint.
Use your service's own authentication and encryption: for example, SSH authentication or database TLS. An API token authorizes the tunnel connection, not external clients connecting to it.
HTTP subdomains, custom domains, and --password are not access controls for TCP or UDP. Do not expose an unauthenticated database, remote shell, or internal control service.
Troubleshooting
If a requested remote port fails, choose another valid port or omit the flag.
If the endpoint connects but the service does not respond, verify the local service on the same machine, confirm its protocol, and check service authentication or firewall rules. UDP services must respond to the forwarded datagram for the CLI to relay a reply.
For multiple services or a TCP/UDP target on another local hostname, use a TOML configuration.