TCP Routing
TCP routing allows an API Gateway to handle raw network traffic at the transport layer, enabling it to serve as an entry point for non-HTTP protocols such as databases, game servers, messaging brokers, or custom protocols.
Proper TCP routing makes it possible to:
🔁 Consolidate entry points for multiple TCP-based services.
📡 Expose internal services to the internet with controlled access.
🔌 Handle any binary or custom protocol without deep inspection.
🔍 What are the Benefits of TCP Routing?
Unlike HTTP and TLS routing, TCP routing operates at Layer 4 of the OSI model. The API Gateway uses the destination port or IP to determine the target backend—ideal for workloads that don't use HTTP.
With TCP routing, the gateway can route connections using:
- Port-based rules (e.g., port 5432 → PostgreSQL service, port 4222 → NATS server).
- Static or dynamic IP/port mappings to backend services.
- Connection-level metadata, such as source IP or client certificate, if applicable.
Key Benefits:
- Protocol Agnostic Routing: Support non-HTTP services or custom TCP protocols.
- High Performance: Route traffic with minimal latency and overhead.
- Secure Exposure of Internal Services: Control who can access backend services on the transport layer.
TCP Routing Examples
The following examples showcase how you can route TCP traffic to your upstream services.
You must first create a TCP Address.
When you create a TCP address, a random hostname and port will be assigned to you, e.g. 1.tcp.ngrok.io:12345
.
See the TCP Endpoints page for more details on how ngrok handles TCP endpoints.
- AgentEndpoint
- CloudEndpoint with AgentEndpoint
- Gateway API
Loading…
1. Create an AgentEndpoint
for your upstream Service
Loading…
2. Create a CloudEndpoint
that routes to the AgentEndpoint
Loading…
For TLS and TCP Routes, you must put the domain in the Gateway.Spec.Addresses
field as the ngrok operator needs to know what domains to use when creating endpoints for you and Gateway API forbids using the hostname field
on Gateway listeners for TCP/TLS protocols.
Since the Gateway.Spec.Addresses
are expected to bind to all listeners, you may want to create separate Gateways for TLS and TCP endpoints to prevent unwanted conflicts and overlap.
For these reasons, TCP and TLS routing is often more easily configurable using the AgentEndpoint
resources directly instead of Gateway API configuration.
1. Create a Gateway
If you already have a Gateway
you can use that instead
Loading…
2. Create a TCPRoute
Loading…