> ## Documentation Index
> Fetch the complete documentation index at: https://docs.techulus.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# TCP/UDP Proxy

> Expose non-HTTP services like game servers and custom protocols.

Not every service speaks HTTP. Techulus Cloud supports exposing raw TCP and UDP ports through proxy nodes for services like game servers or custom protocols.

> **Database exposure warning:** Do not expose database ports publicly through the TCP/UDP proxy. Public database access increases security risk, and Techulus Cloud does not provide HA storage or automatic failover for production databases.

## Configuration

When adding a port to a service, set the protocol to `tcp` or `udp`:

| Field         | Description                                       |
| ------------- | ------------------------------------------------- |
| Port          | The container port your service listens on        |
| Protocol      | `tcp` or `udp`                                    |
| External port | The port exposed on the proxy node                |
| Public        | Whether this port is accessible from the internet |

Traffic is routed from the proxy node's external port through the WireGuard mesh to the container.

## TLS Passthrough

For TCP services that handle their own TLS, enable **TLS passthrough**. This forwards the encrypted connection directly to the container without Traefik terminating TLS.

## Firewall

The agent setup script configures firewall rules to allow traffic on the TCP/UDP proxy port ranges. If you set up servers manually, ensure the relevant ports are open.