Skip to content
xPort

xport tcp

Terminal window
xport tcp 5432
xport tcp 127.0.0.1:6379
xport tcp db.internal:5432 --name rawdb

Any protocol, not just web services. xport tcp registers a raw TCP session on the relay; you get a public tcp://<host>:<port> address that forwards bytes verbatim to your local service — PostgreSQL, MySQL, Redis, Kafka, gRPC, WebSockets, SSH, anything that speaks TCP.

Example output:

       ____            _
 __  _|  _ \ ___  _ __| |_
 \ \/ / |_) / _ \| '__| __|
  >  <|  __/ (_) | |  | |_
 /_/\_\_|   \___/|_|   \__|


Forwarding: tcp://tcp.xport.host:12453 → localhost:5432
Expires: 2026-11-02 18:30:00 CET
Press Ctrl-C to stop.

Connect with any client through the public address:

Terminal window
psql postgres://user:pass@tcp.xport.host:12453/mydb

How it works

Section titled “How it works”
  1. The relay allocates one port per session from its configured range (hosted: 12000–12999 on tcp.xport.host; self-hosted: whatever tcp.* in the relay config says).
  2. Every connection to that port flows through one of your standing data connections — raw bytes in both directions, no HTTP framing. The relay never parses your protocol.
  3. The port is released when the session ends (Ctrl-C, expiry, or xport stop).

Limits and rules

Section titled “Limits and rules”
  • Works with --name, --expires, --detach, --json, and the share registry like every other mode.
  • --password, --policy-file, and --domain are HTTP features and are rejected — a raw TCP stream has no place for Basic auth or HTTP rules. Protect the service itself (SSH keys, database passwords).
  • SMTP targets (port 25) are refused before anything dials, so your machine cannot become an open relay.
  • Hosted service: TCP tunnels are a Pro/Team feature (they occupy real ports on the edge). Anonymous and free accounts get a clear upgrade hint. Self-hosted relays offer them freely — token mode is the operator’s own decision.
  • Cloudflare and similar HTTP proxies cannot forward TCP: the hosted edge (tcp.xport.host) answers directly, DNS-only.

Self-hosting

Section titled “Self-hosting”

Enable the pool in the relay configuration:

tcp:
  enabled: true
  host: "0.0.0.0"
  port_min: 12000
  port_max: 12999
  public_host: "tcp.example.com"

Open the port range in your firewall and point a DNS record at the relay. Spec: RFC-0003 — TCP Forwarding Extension.

Options

Section titled “Options”

All persistent options apply except the HTTP-only ones noted above.