# TCP tunnel

## Overview

TCP tunnel allows you to provide access to any service using TCP protocol, the most popular examples:

* Databases ([mySQL](https://tuna.am/en/docs/tunnels/examples/mysql.md), [PostgreSQL](https://tuna.am/en/docs/tunnels/examples/postgresql.md), [MSSQL](https://tuna.am/en/docs/tunnels/examples/mssql.md))
* Remote access software ([SSH](https://tuna.am/en/docs/tunnels/examples/ssh.md), [RDP](https://tuna.am/en/docs/tunnels/examples/rdp.md))
* Game servers ([Minecraft](https://tuna.am/en/docs/tunnels/examples/minecraft.md))

Starting with version **0.36.0**, tuna shows a [full-screen interface](https://tuna.am/en/docs/tunnels/tui.md) in the terminal.

> **Info.** Creating a TCP tunnel is only available with a [subscription](https://tuna.am/#pricing).

## Examples

> **Note.** You can see all current flags, hints and examples by calling the help:
>
> ```shell
> tuna tcp --help
>
> ```
>
> Almost all flags have corresponding [environment variables](https://tuna.am/en/docs/guides/environment-variables.md).

### Basic example

```shell
tuna tcp 5432

```

### With IP address

```shell
tuna tcp 10.0.0.1:5432

```

### Unix socket

Instead of a port you can specify a unix socket, bytes from the tunnel are passed to it as is. The path is set with the `unix://` prefix and must be absolute:

```shell
tuna tcp unix:///var/run/app.sock

```

* A path without the prefix (`/var/run/app.sock`), a relative path (`unix://tmp/app.sock`) or an empty one (`unix://`) is not accepted.
* The `--cidr-allow`, `--cidr-deny` and `--proxy-protocol` flags work the same way as with a port.
* If the socket does not exist at startup, tuna prints a warning and keeps running. It connects to the socket on every incoming connection, so the socket can appear later without restarting the tunnel.
* tuna connects to the socket as the user who started it. That user needs write access to the socket, otherwise the connection fails with `permission denied`.
* Unix sockets are supported only by `tuna tcp` and [`tuna http`](https://tuna.am/en/docs/tunnels/http.md#unix-socket), specialized commands such as `tuna ssh`, `tuna postgres` and `tuna redis` do not support them.
* Windows is not guaranteed to work, named pipes (`npipe://` in Docker Desktop) are not supported.

#### Docker API access

> **Danger.** Access to `docker.sock` is equivalent to root access to the host: through the Docker API anyone can start a container with the host root filesystem mounted. Do not publish the socket without `--cidr-allow`, restrict access to your own IP address.

```shell
tuna tcp unix:///var/run/docker.sock --cidr-allow="203.0.113.10/32"

```

The user running tuna must be a member of the `docker` group, otherwise connecting to the socket fails with `permission denied`.

On your machine, use the tunnel address from the tuna output:

```shell
docker -H tcp://ru.tuna.am:12345 ps

```

### Specifying a token

You can specify a particular token using the `--token` flag or the `TUNA_TOKEN` environment variable. Overriding follows the [configuration ordering](https://tuna.am/en/docs/guides/config-ordering.md) policy.

```shell
tuna tcp 8080 --token=tt_***

```

### Specifying a connection region

You can specify a particular [region](https://tuna.am/en/docs/tunnels/guides/locations.md) using the `--location`/`-l` flag or the `TUNA_LOCATION` environment variable. Overriding follows the [configuration ordering](https://tuna.am/en/docs/guides/config-ordering.md) policy.

```shell
tuna tcp 8080 --location=nl

```

### Generating a QR code with the link

When the `--qr` flag is added, a QR code will be generated for the link and printed to the console. This can be convenient when you are testing a site on a mobile device.

![](/docs/img/examples/qr.png)

### Static port

The value of the `--port`/`-p` flag can be an alias or an assigned port. You can reserve ports in the [dashboard](https://my.tuna.am/tcp_ports), and after restarting the tunnel the address will remain the same. For more details about ports, see the dedicated [guide](https://tuna.am/en/docs/tunnels/ports.md).

```shell
tuna tcp 5432 --port=postgres
tuna tcp 5432 --port=35000

```

### IP subnet access restriction

You can define a whitelist of [subnets](https://en.wikipedia.org/wiki/Subnetwork) in CIDR format:

```shell
tuna tcp 3389 --cidr-allow="10.0.0.1/32"

```

Or deny access from specific subnets:

```shell
tuna tcp 3389 --cidr-deny="10.0.0.1/32"

```

You can combine them, for example specify a wide network and subtract private IPs:

```shell
tuna tcp 3389 --cidr-allow="10.0.0.1/24" --cidr-deny="10.0.0.33/32"

```

You can also pass lists through commas:

```shell
tuna tcp 3389 --cidr-allow="10.0.0.1/24,192.168.0.1/24" --cidr-deny="10.0.0.33/32,192.168.0.33/32"

```

### Proxy Protocol

Allows passing the original client IP and port if your application supports it. The argument expects version 1 or 2, which corresponds to the Proxy Protocol version: 1 - text, 2 - binary. Haproxy or Nginx support both and detect them automatically.

```shell
tuna tcp 8443 --proxy-protocol=1
tuna tcp 8443 --proxy-protocol=2

```