# UDP over HTTP Support

Starting in v0.29, Pomerium can be used to protect UDP systems with the same consistent authorization policy. This is achieved by tunneling UDP over HTTP with the help of a client side command built into [`pomerium-cli`](https://www.pomerium.com/docs/deploy/clients.md).

Internally, Pomerium uses [`CONNECT-UDP`](https://datatracker.ietf.org/doc/html/rfc9298) to establish the UDP tunnel.

## Configure UDP Routes

UDP configuration is simple. Just specify the correct scheme and ports in your route [`to`](https://www.pomerium.com/docs/reference/routes/to.md) and [`from`](https://www.pomerium.com/docs/reference/routes/from.md) fields.

Example:

```yaml
routes:
  - from: udp+https://time.corp.example.com:13
    to: udp://time.internal.example.com:13
    policy:
      - allow:
          or:
            - email:
                is: contractor@not-example.com
            - claim/groups: 'datascience@example.com'
```

When creating UDP routes, note the following:

- When configuring a UDP route, any HTTP specific settings such as `regex_rewrite_pattern` or `set_request_headers` have no effect.
- The port defined in `from` does not dictate what port the tunneled traffic uses. This will always be the port defined by [`address`](https://www.pomerium.com/docs/reference/address.md) in your Pomerium configuration (`443` by default). The port instead differentiates multiple routes to the same hostname for different services.

## Connect to UDP Routes

While HTTP routes can be consumed with just a normal browser, `pomerium-cli` or Pomerium Desktop must serve as a proxy for UDP routes.

To connect, you normally need just the external hostname and port of your UDP route:

```shell-session
$ pomerium-cli udp udp.localhost.pomerium.io:1234
2023/10/02 11:19:59 listening on 127.0.0.1:52046
```

By default, `pomerium-cli` will start a listener on loopback on a random port.

On first connection, you will be sent through a standard Pomerium HTTP authentication flow. After completing this, your UDP connection should be established!

## Advanced capabilities

### Listen configuration

You may specify an optional address and port for the `udp` command to listen on.