Protecting a TLS-wrapped TCP service

Use the TLS preset for a non-HTTP or end-to-end encrypted TCP application that speaks TLS and should remain encrypted through to the backend. Confirm the backend address and listening port before continuing; TLS does not require one specific port number.

Add the TLS port

On the service's Ports page, select Add Port and configure:

  1. The public TCP port used by the application.
  2. TLS under Layer 7 (Other) as the protocol.
  3. The Reverse Proxy or tunnel backend and its listening port.

This example uses TCP port 8443 only as an illustration; replace it with the port used by your application:

PortsProtocolDomainBackend Actions
>
:
 

    With this preset, the TLS session and application data are forwarded to the backend. The backend remains responsible for its certificate, TLS settings, authentication, and application behavior. Enable PROXY (v2) only when the backend application explicitly supports and is configured to accept it.

    For protocol comparisons and backend methods, see Port types. For the distinction between TLS pass-through and HTTP/HTTPS protection, see Layer 7 protection modes.

    Test and secure the backend

    Wait for deployment to complete, then connect to the filtered address using the application's normal TLS client. Confirm that the certificate presented is the backend application's expected certificate. Keep host and provider firewalls enabled and allow the application port only from the current Backend Communication IP Addresses shown in the Dashboard. For a tunnel, also allow the selected tunnel protocol between its endpoints.