Skip to main content
Configure sandbox TCP and UDP ports to expose a service with a guest port, an external port, and allowed source IPv4 networks. Raw traffic uses the returned endpoint rather than the HTTPS application edge.

​
Configure exposure

Save this as ports.json, replacing the documentation address with your client’s public source network:
The API equivalent is PUT /sandboxes/{id}/raw-ports. HTTP 204 means the configuration was acknowledged. Connect to the network response’s endpoint hostname on the external port with the selected transport. Reachability depends on placement and the endpoint’s inbound connectivity.

​
Limits and access

  • External ports range from 20000 to 65535.
  • At most 16 transport/port exposures and 32 source networks per exposure are supported.
  • Source CIDRs must be canonical, non-overlapping IPv4 networks.
  • Guest port 0, ports 5800–6999 and 9222–9229, and guest transport ports 49983–49984 are excluded.
  • A conflicting transport/external-port reservation returns 409.
The ACL controls source networks. Add application TLS and authentication when your service needs them. API credentials must have write scope and belong to the machine’s organization.

​
Revoke exposure

Save [] as ports.json and submit it again:
Each PUT replaces the complete raw-port configuration. Updated ACLs apply to current and future packets. For browser applications, use authenticated HTTP forwarding.