# New Feature: Every public port now allowed for TCP services (this means HTTP too)

**URL:** <https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624>\
**Category:** General\
**Tags:** announcement\
**Created:** [January 7, 2022, 8:43pm UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624 "2022-01-07T20:43:08Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\
**Post date:** [January 7, 2022, 8:43pm UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624/1 "2022-01-07T20:43:09Z")

</div>

We are now allowing any and every public (exposed) ports for Fly services 🎉

A public port is the `port` you set in your services like:

```auto
[[services.ports]]
port = "12345" # <- this guy
handlers = ["http"]

```

Previously, the list of allowed public ports was limited to:

```auto
[25, 53, 80, 443, 853, 5000, 8080, 8443, (10000..10100), 25565, 26257]

```

  

**This limit is no more.**

For example: you can now accept connections on port `22` if you’d like to run a SSH server and not have to specify the port each time you connect!

We don’t yet support port ranges or a list of ports for the same `[[services.port]]` entry, but we’re working on it.

`internal_port` is unaffected and it’s always been possible to set it to any port between 1 and 65536.

UDP ports are also unaffected, can still be any and every port between 1 and 65536.

Updating our docs will happen shortly 🙂

We’re still working on this, but it should be stable enough to use.

---

<div class="post-metadata">

**Author:** ![sudhir.j](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/sudhir.j/32/39775_2.png) [@sudhir.j](https://community.fly.io/u/sudhir.j)\
**Post date:** [January 8, 2022, 6:42am UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624/2 "2022-01-08T06:42:35Z")

</div>

Nice, thanks. Was just looking into running FTP servers worldwide, this comes at an excellent time.

Will probably have to enumerate a couple thousand port numbers in the absence of a way to specify ranges, but good to know it’s possible 👍🏾

---

<div class="post-metadata">

**Author:** ![charsleysa](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/charsleysa/32/16002_2.png) [@charsleysa](https://community.fly.io/u/charsleysa)\
**Post date:** [January 17, 2022, 2:07am UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624/3 "2022-01-17T02:07:21Z")

</div>

Woohoo! Works great!

---

<div class="post-metadata">

**Author:** ![uncvrd](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/uncvrd/32/18514_2.png) [@uncvrd](https://community.fly.io/u/uncvrd)\
**Post date:** [January 19, 2022, 9:04pm UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624/4 "2022-01-19T21:04:54Z")

</div>

> [@jerome](#):
>
> For example: you can now accept connections on port `22` if you’d like to run a SSH server and not have to specify the port each time you connect!

Hey @jerome thank you for this update! I have a quick question. I have set up Wireguard and can successfully run `ssh root@xxx.internal` from my CLI to SSH in to my container, however when I try and do the equivalent with Cyberduck for SFTP, I receive a network error. Does this have to do something with port 22? Or does connecting via SFTP require something different?

 ![image](https://global.discourse-cdn.com/fly1/original/3X/5/1/510e3700434cae150ea6b5d0402e136f5539d92b.jpeg)

![image](https://global.discourse-cdn.com/fly1/original/3X/d/6/d6cef3b9cffef4ec4381431038e73dc67c2a0a32.png)

I’m trying to connect to a redis container that was created using this tutorial: [Upstash for Redis®\* · Fly Docs](https://fly.io/docs/reference/redis/)

I’d just like to inspect the data in my `/data` directory using Cyberduck

---

<div class="post-metadata">

**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\
**Post date:** [January 19, 2022, 9:44pm UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624/5 "2022-01-19T21:44:30Z")

</div>

I don’t know nearly enough about SFTP and Cyberduck.

This isn’t related to the feature we launched. This is for external services, not internal ones 🙂

Does `sftp root@xxx.internal` work for you?

---

<div class="post-metadata">

**Author:** ![uncvrd](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/uncvrd/32/18514_2.png) [@uncvrd](https://community.fly.io/u/uncvrd)\
**Post date:** [January 19, 2022, 10:00pm UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624/6 "2022-01-19T22:00:05Z")

</div>

@jerome apologies - I thought it might be similar, searching for ssh/sftp topics were slim hah! Ok so I just tried `sftp` from the command line and I receive the following output:

```auto
sftp root@encore-bull-redis.internal
Connection to encore-bull-redis.internal closed by remote host.
Connection closed

```

So I take it that the request is being denied by Fly (aka remote host)?

UPDATE:

Part of the problem was that I had reached my connection limit on my VM, I updated my `toml` and I see the following error when I view the VM logs now:

- `unexpected error: parsing SSH protocol: unhandled type subsystem` for Cyberduck
- `unexpected error: parsing SSH protocol: unhandled type simple@putty.projects.tartarus.org` using Filezilla

---

<div class="post-metadata">

**Author:** ![ignoramous](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ignoramous](https://community.fly.io/u/ignoramous)\
**Post date:** [February 5, 2022, 8:43am UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624/7 "2022-02-05T08:43:06Z")

</div>

Neat!

I imagine some kind of Linux wizardry is involved to listen on all 65K ports on multiple IPs in all edge nodes? Sounds worthy of a blog post.

---

<div class="post-metadata">

**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\
**Post date:** [February 5, 2022, 10:13pm UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624/8 "2022-02-05T22:13:34Z")

</div>

Definitely worth a post. The google search you’re looking for is `TPROXY`, if you want to learn more before we write it. 🙂

---

<div class="post-metadata">

**Author:** ![ignoramous](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ignoramous](https://community.fly.io/u/ignoramous)\
**Post date:** [April 4, 2022, 9:47am UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624/9 "2022-04-04T09:47:51Z")

</div>

Just stumbled upon [a Cloudflare blog post](https://blog.cloudflare.com/its-crowded-in-here/) on why they switched from `TPROXY` to a `BPF` based solution for Magic Transit (L3) and Specturm (L4).

Btw: Is there a way for fly apps to listen on all `2^16` ports (for both tcp and udp) without having to create `2^16` entries in `fly.toml`?

That aside, does fly ever intend to support raw IP conns (L3)? I can’t imagine the setup being all too different than proxying UDP…

> Updating our docs will happen shortly 🙂

Noting it here [that the docs](https://fly.io/docs/reference/configuration/#services-ports) are outdated.

---

<div class="post-metadata">

**Author:** ![infineon3000](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/infineon3000/32/4215_2.png) [@infineon3000](https://community.fly.io/u/infineon3000)\
**Post date:** [August 5, 2022, 5:50am UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624/10 "2022-08-05T05:50:32Z")

</div>

> [@jerome](#):
>
> `port = "12345"`

Hi, Can I do something like

```auto
  [[services.ports]]
    port = "*"

```

and do I need to have something like dedicated vm ?

---

<div class="post-metadata">

**Author:** ![pau-riosa](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/pau-riosa/32/4733_2.png) [@pau-riosa](https://community.fly.io/u/pau-riosa)\
**Post date:** [August 12, 2022, 5:42pm UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624/11 "2022-08-12T17:42:46Z")

</div>

How can I open port ranges in fly.toml config?

---

<div class="post-metadata">

**Author:** ![thomas](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/thomas/32/40188_2.png) [@thomas](https://community.fly.io/u/thomas)\
**Post date:** [September 7, 2022, 10:25pm UTC](https://community.fly.io/t/new-feature-every-public-port-now-allowed-for-tcp-services-this-means-http-too/3624/12 "2022-09-07T22:25:01Z")

</div>

We don’t support port ranges yet. We’ll get to it!