mirror of
https://github.com/fosrl/docs-v2.git
synced 2026-10-01 10:19:23 +02:00
42 lines
2.3 KiB
Plaintext
42 lines
2.3 KiB
Plaintext
---
|
||
title: "Ports and ICMP"
|
||
description: "Configure TCP and UDP port modes and ICMP (ping) for private resources"
|
||
---
|
||
|
||
For each private resource, TCP and UDP are configured separately. Each protocol uses one of three modes: All, Blocked, or Custom. ICMP (ping) is controlled on its own and does not follow those TCP/UDP modes.
|
||
|
||
## Port restrictions
|
||
|
||
Port settings apply to users, roles, and machines that have access to the resource. They limit which application traffic can reach the resource’s destination through Pangolin.
|
||
|
||
### All
|
||
|
||
All means no port filtering for that protocol: every port on the destination is reachable through the tunnel. This is the default-style behavior when you are not narrowing traffic to a subset of ports.
|
||
|
||
Use All when the service needs arbitrary ports (for example ephemeral ports on the client side are handled by the stack, but the server listens on many ports) or when you have not yet tightened access.
|
||
|
||
### Blocked
|
||
|
||
Blocked means that protocol is not allowed to the destination through Pangolin: no TCP or no UDP traffic passes, depending on which row you set. The other protocol can still be All or Custom independently-for example TCP Custom (only `443`) with UDP Blocked for a HTTPS-only workload that should not receive UDP to that destination.
|
||
|
||
Use Blocked when you want to turn off a protocol entirely for that resource.
|
||
|
||
### Custom
|
||
|
||
Custom means only the ports you list are allowed; every other port for that protocol is denied. Enter either:
|
||
|
||
* a single port (e.g. `80`),
|
||
* a comma-separated list (e.g. `80,443,8080`), or
|
||
* a range with a hyphen (e.g. `8000-8100`).
|
||
* lists and ranges (e.g. `80,443,8080-8090,9000-9010`)
|
||
|
||
Use Custom for least-privilege access: allow only the ports your application actually needs (see also [SSH](/manage/ssh) for allowing TCP `22` when using Pangolin SSH).
|
||
|
||
## ICMP
|
||
|
||
By default, ICMP (ping) to the resource’s destination is enabled. To turn it off, disable the ICMP option when configuring access to the resource. That stops ICMP echo requests (ping) to the destination for principals that have access.
|
||
|
||
<Note>
|
||
ICMP ping does not work when using a resource [alias](/manage/resources/private/alias) as the target-ping applies to the resource’s configured destination (FQDN, IP, or CIDR), not to alias hostnames.
|
||
</Note>
|