TCP over HTTP Support
In addition to managing HTTP based applications, Pomerium can be used to protect non-HTTP systems with the same consistent authorization policy. This is achieved by tunneling TCP over HTTP with the help of a client side command built into
Operations and engineering teams frequently require access to lower level administrative and data protocols such as SSH, RDP, Postgres, MySQL, Redis, etc.
Internally, Pomerium uses the
CONNECT method to establish the TCP tunnel.
To minimize issues with TCP support, Pomerium should not be placed behind another HTTP proxy. Instead, configure your load balancer in L4 or TCP mode.
Otherwise, the HTTP proxy in front of Pomerium must know how to properly handle the
CONNECT command and proxy it upstream. This capability will be specific to each proxy implementation.
- from: tcp+https://redis.corp.example.com:6379
- claim/groups: 'email@example.com'
When creating TCP routes, note the following:
- When configuring a TCP route, any HTTP specific settings such as
set_request_headershave no effect.
- While data is encrypted from a user system to Pomerium's proxy, the underlying application protocol must also support encryption for data to be fully encrypted end-to-end. Otherwise, traffic from the Pomerium Proxy service to the upstream service will be unencrypted.
- The ports in
toare independent. Users only need to know the
fromURL to connect. The
tocan be changed without end user participation.
- The port defined in
fromdoes not dictate what port the tunneled traffic uses. This will always be the port defined by
addressin your Pomerium configuration (
443by default). The port instead differentiates multiple routes to the same hostname for different services.
Connect to TCP Routes
While HTTP routes can be consumed with just a normal browser,
pomerium-cli or Pomerium Desktop must serve as a proxy for TCP routes. See Pomerium Desktop and CLI Clients for more information.
To connect, you normally need just the external hostname and port of your TCP route:
$ pomerium-cli tcp redis.localhost.pomerium.io:6739
2023/10/02 11:19:59 listening on 127.0.0.1:53479
pomerium-cli will start a listener on loopback on a random port.
On first connection, you will be sent through a standard Pomerium HTTP authentication flow. After completing this, your TCP connection should be established!
$ redis-cli -h localhost -p 52046
localhost:52046> keys *
You may specify an optional address and port for the
tcp command to listen on.
- specifies that STDIN and STDOUT should be directly attached to the remote TCP connection. This is useful for SSH or for sending data through a shell pipe.
If the Pomerium proxy is not reachable through port
443 or the route is not in external DNS, you can use Pomerium as a bastion host using the extended TCP URL syntax in your route definition:
And then using the same URL in the pomerium-cli command invocation:
pomerium-cli tcp tcp+https://proxy.corp.example.com:8443/redis.internal.example.com:6379
The command above connects to
https://pomerium.corp.example.com:8443 and then requests the TCP route for
We've outlined how to use a TCP tunnel through Pomerium for several popular services that use TCP connections: