docs-v2/content/docs/manage/resources/public/raw-resources.mdx

---
title: "TCP / UDP"
description: "Expose raw TCP and UDP services on a Pangolin server port without authentication"
---

TCP and UDP public resources are protocol-agnostic proxies. Unlike HTTP/HTTPS, SSH, RDP, and VNC, they do **not** receive a fully qualified domain name or TLS certificate. Instead, each resource binds to a port on the Pangolin server host. Clients connect to `<pangolin-server>:<port>` and traffic is forwarded to the downstream service through a site connector.

Because TCP and UDP resources are not protocol-aware, they do **not** enforce Pangolin authentication or access rules. They are simple pipes—use them only when you need a raw public proxy and accept that traffic is unauthenticated at the Pangolin layer.

For workloads that do not need a public proxy, prefer a [private host or CIDR resource](/manage/resources/understanding-resources#private-resource-types) so traffic stays on the zero-trust tunnel with full access control.

## Benefits

- Expose any TCP or UDP service, whatever the protocol, without opening ports on the backend network.
- The backend stays behind NAT or a firewall. Only the Pangolin server needs a public port.
- Players or users connect with their normal client software, with no Pangolin client to install.
- Multiple targets across sites give round-robin routing and failover. Unlike HTTP resources, TCP/UDP always use round robin (no strategy picker).
- Proxy Protocol can pass the original client IP through to backends that support it.

## Use Cases

- Host a game server, such as Minecraft, from a home network.
- Publish a VoIP, MQTT, or other non-HTTP service that clients reach by host and port.
- Give public access to a service that has its own authentication and needs no extra layer from Pangolin.

## How TCP and UDP Resources Work

1. You map a port on the Pangolin server to the resource.
2. A client connects to `<pangolin-server>:<port>`.
3. Pangolin forwards the traffic as-is through the tunnel to a site, which delivers it to the target.

Pangolin does not inspect or authenticate the traffic, so any security has to come from the service itself.

## Target Configuration

TCP and UDP resources use **[targets](/manage/resources/public/targets)** like HTTP/HTTPS resources:

- Add one or more targets with an upstream address and port.
- Assign targets to different sites for round-robin routing and failover. Load balancing strategy options on the Proxy tab apply to HTTP resources only; see [Targets](/manage/resources/public/targets#load-balancing-strategy).

## Self-Hosted Setup

<Note>
This feature is only available in self-hosted Pangolin instances. If you're using Pangolin Cloud, you will need to deploy a remote node.
</Note>

Pangolin supports raw TCP and UDP traffic because a site can pass anything through the tunnel.

In Community Edition or Enterprise Edition, ensure you have the flag enabled in the config file:

```
flags:
  allow_raw_resources: true
```

You map the resource to a port on the host Pangolin server, so you can access the resource from `<server-public-ip>:<mapped-port>`. This is useful if you want to access the resource over the public internet, such as exposing a game server like Minecraft.

## Proxied Resources

Proxied resources require extra configuration to expose on the Pangolin server. You'll need to configure firewall rules, Docker port mappings, and Traefik entry points. These steps require a server restart.

<Steps>
<Step title="Create the resource">
  In the Pangolin dashboard, go to Resources and click Add Resource. Select "Raw TCP/UDP resource", and enter your desired publicly mapped port. This is the port you'll use to access the proxied resource.
</Step>

<Step title="Configure firewall">
  Open your desired ports on your VPS firewall, just like you did for ports 51820, 443, and 80. This is highly OS and VPS dependent.
  
  <Note>
  In this example, we're exposing two resources: TCP 1602 and UDP 1704.
  </Note>
</Step>

<Step title="Configure Docker">
  Add port mappings to your `docker-compose.yml` file:

  ```yaml title="docker-compose.yml" {4,5}
  gerbil:
    ports:
      # ... existing ports ...
      - 1704:1704/udp # ADDED: Your UDP port
      - 1602:1602 # ADDED: Your TCP port
  ```
</Step>

<Step title="Configure Traefik">
  Add entry points to your `config/traefik/traefik_config.yml`:

  ```yaml title="traefik_config.yml" {12-15}
  entryPoints:
    web:
      address: ":80"
    websecure:
      address: ":443"
      http:
        tls:
          certResolver: letsencrypt
      transport:
        respondingTimeouts:
          readTimeout: 30m
    tcp-1602:
      address: ":1602/tcp"
    udp-1704:
      address: ":1704/udp"
  ```

  <Info>
  **Important**: Always name your entry points in the format `protocol-port` (e.g., `tcp-1602`, `udp-1704`). This naming is required for Pangolin's dynamic configuration.
  </Info>
</Step>

<Step title="Restart the stack">
  Restart your Docker stack to apply all changes:

  ```bash
  sudo docker compose down
  sudo docker compose up -d
  ```
</Step>
</Steps>

<Note>
In this example, we expose port 1602 for TCP and port 1704 for UDP. You can use any available ports on your VPS.
</Note>

## Proxy Protocol

On TCP resources you can enable Proxy Protocol support to forward the original client IP address to your backend service. This is useful for logging and access control.

In order to enable proxy protocol, simply check the "Enable Proxy Protocol" box when creating or editing a TCP resource.

<Note>Your backend application must be configured to accept Proxy Protocol connections. If your backend doesn't support Proxy Protocol, enabling this will break all connections so only enable this if you know what you're doing. Make sure to configure your backend to trust Proxy Protocol headers from Traefik.</Note>

To enable Proxy Protocol in Traefik, add the following to the bottom of your `config/traefik/dynamic_config.yml`:

```yaml 
tcp:
  serversTransports:
    pp-transport-v1:
      proxyProtocol:
        version: 1
    pp-transport-v2:
      proxyProtocol:
        version: 2
```