TCP Tunnels

TCP mode exposes any TCP-based service. TCP tunnels start at $5/month — 5 extra tunnels at $1/month each on the free plan, or included with Team at $10/month — and they carry anything that speaks TCP: Postgres, MySQL, Redis, SSH, RDP and Minecraft Java. HTTP and UDP tunnels are free and need no credit card.

Usage

portbuddy tcp 5432

This command exposes your local PostgreSQL database on port 5432. You will get an address like net-proxy-3.portbuddy.dev:43452 — a host and a port, not a URL. There is no TLS and no hostname routing at this layer: whatever your local service speaks is what arrives, byte for byte.

What it costs

TCP switches on once your account holds 5 extra tunnels — 6 concurrent tunnels in total, since the free plan already includes one — or as soon as you are on Team. Extra tunnels are sold in blocks of 5 at $1/month each, so $5/month is the smallest TCP purchase on the free plan.

Transfer is unmetered on every plan: no bandwidth caps, no overage charges.

For comparison, ngrok's cheapest plan with a reserved TCP address is Hobbyist at $8/month billed annually ($10/month month-to-month). ngrok pricing as of August 2026.

Connecting to it

Point any ordinary client at the host and port you were given:

psql -h net-proxy-3.portbuddy.dev -p 43452 -U postgres
ssh -p 43452 user@net-proxy-3.portbuddy.dev
mysql -h net-proxy-3.portbuddy.dev -P 43452 -u root -p

The service on the other end is unchanged, so its own authentication still applies — and now applies to the whole internet. Give a database you expose this way a real password, and prefer key-based authentication for SSH.

Keeping the same address

The public port comes from a reservation, taken from the range 40000–60000. You do not have to create one first: the first TCP tunnel for a local port allocates a reservation and later tunnels for that same local host and port reuse it, so the address you hand out generally survives a restart.

Manage them on the Ports page, where a reservation can also be given a name. To pin a tunnel to a specific one, pass the name, the port, or the full host and port:

portbuddy tcp 5432 -pr staging-db
portbuddy tcp 5432 -pr 43452
portbuddy tcp 5432 -pr net-proxy-3.portbuddy.dev:43452

A reservation already in use by a running tunnel is refused rather than shared, so two services never end up behind one address.

Going further

Keep a database or SSH tunnel up across reboots by installing it as a background service.
Hosting a game server on TCP? The Minecraft guide walks through it end to end.
For web services, an HTTP tunnel is the better fit: it terminates SSL, gives you a hostname rather than a port, and can be passcode-protected.