# TCP tunnel

## Overview

TCP tunnel allows you to provide access to any service using TCP protocol, the most popular examples:

* Databases ([mySQL](https://tuna.am/en/docs/tunnels/examples/mysql.md), [PostgreSQL](https://tuna.am/en/docs/tunnels/examples/postgresql.md), [MSSQL](https://tuna.am/en/docs/tunnels/examples/mssql.md))
* Remote access software ([SSH](https://tuna.am/en/docs/tunnels/examples/ssh.md), [RDP](https://tuna.am/en/docs/tunnels/examples/rdp.md))
* Game servers ([Minecraft](https://tuna.am/en/docs/tunnels/examples/minecraft.md))

info

Creating a TCP tunnel is only available with a [subscription](https://tuna.am/#pricing).

## Examples

note

You can see all current flags, hints and examples by calling the help:

```shell
tuna tcp --help

```

Almost all flags have corresponding [environment variables](https://tuna.am/en/docs/guides/environment-variables.md).

### Basic example

```shell
tuna tcp 5432

```

### With IP address

```shell
tuna tcp 10.0.0.1:5432

```

### Specifying a token

You can specify a particular token using the `--token` flag or the `TUNA_TOKEN` environment variable. Overriding follows the [configuration ordering](https://tuna.am/en/docs/guides/config-ordering.md) policy.

```shell
tuna tcp 8080 --token=tt_***

```

### Specifying a connection region

You can specify a particular [region](https://tuna.am/en/docs/tunnels/guides/locations.md) using the `--location`/`-l` flag or the `TUNA_LOCATION` environment variable. Overriding follows the [configuration ordering](https://tuna.am/en/docs/guides/config-ordering.md) policy.

```shell
tuna tcp 8080 --location=nl

```

### Generating a QR code with the link

When the `--qr` flag is added, a QR code will be generated for the link and printed to the console. This can be convenient when you are testing a site on a mobile device.

![](/docs/img/examples/qr.png)

### Static port

The value of the `--port`/`-p` flag can be an alias or an assigned port. You can reserve ports in the [dashboard](https://my.tuna.am/tcp_ports), and after restarting the tunnel the address will remain the same. For more details about ports, see the dedicated [guide](https://tuna.am/en/docs/tunnels/ports.md).

```shell
tuna tcp 5432 --port=postgres
tuna tcp 5432 --port=35000

```

### IP subnet access restriction

You can define a whitelist of [subnets](https://en.wikipedia.org/wiki/Subnetwork) in CIDR format:

```shell
tuna tcp 3389 --cidr-allow="10.0.0.1/32"

```

Or deny access from specific subnets:

```shell
tuna tcp 3389 --cidr-deny="10.0.0.1/32"

```

You can combine them, for example specify a wide network and subtract private IPs:

```shell
tuna tcp 3389 --cidr-allow="10.0.0.1/24" --cidr-deny="10.0.0.33/32"

```

You can also pass lists through commas:

```shell
tuna tcp 3389 --cidr-allow="10.0.0.1/24,192.168.0.1/24" --cidr-deny="10.0.0.33/32,192.168.0.33/32"

```

### Proxy Protocol

Allows passing the original client IP and port if your application supports it. The argument expects version 1 or 2, which corresponds to the Proxy Protocol version: 1 - text, 2 - binary. Haproxy or Nginx support both and detect them automatically.

```shell
tuna tcp 8443 --proxy-protocol=1
tuna tcp 8443 --proxy-protocol=2

```