> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bead.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox TCP and UDP ports

> Configure sandbox TCP and UDP ports and restrict source networks through the raw-port API.

Configure sandbox TCP and UDP ports to expose a service with a guest port, an external port, and allowed source IPv4 networks. Raw traffic uses the returned endpoint rather than the HTTPS application edge.

## Configure exposure

Save this as `ports.json`, replacing the documentation address with your client's public source network:

```json theme={null}
[
  {"protocol":"tcp","port":7777,"external_port":30000,
   "allowed_cidrs":["203.0.113.4/32"]},
  {"protocol":"udp","port":7777,"external_port":30000,
   "allowed_cidrs":["203.0.113.4/32"]}
]
```

```bash theme={null}
bead ports ID --input ports.json
bead network ID
```

The API equivalent is `PUT /sandboxes/{id}/raw-ports`. HTTP 204 means the configuration was acknowledged. Connect to the network response's endpoint hostname on the external port with the selected transport. Reachability depends on placement and the endpoint's inbound connectivity.

## Limits and access

* External ports range from 20000 to 65535.
* At most 16 transport/port exposures and 32 source networks per exposure are supported.
* Source CIDRs must be canonical, non-overlapping IPv4 networks.
* Guest port 0, ports 5800–6999 and 9222–9229, and guest transport ports 49983–49984 are excluded.
* A conflicting transport/external-port reservation returns 409.

The ACL controls source networks. Add application TLS and authentication when your service needs them. API credentials must have write scope and belong to the machine's organization.

## Revoke exposure

Save `[]` as `ports.json` and submit it again:

```bash theme={null}
bead ports ID --input ports.json
```

Each PUT replaces the complete raw-port configuration. Updated ACLs apply to current and future packets.

For browser applications, use [authenticated HTTP forwarding](https://docs.bead.run/connect/ports.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.