Tunnel protocol
Supported traffic, connection behavior, and connector limits.
Connection model
The connector opens an outbound connection to waf-ingress.loclix.network on port 443. It can connect before you publish a website. Each published website still needs its own DNS and certificate setup.
Transport negotiation
| Transport | Network requirement | Encryption |
|---|---|---|
| QUIC, tried first | Outbound UDP 443 | TLS 1.3 |
| HTTP/2, used if QUIC setup fails | Outbound TCP 443 | TLS 1.3 |
An established HTTP/2 connection stays active until it disconnects. The next connection attempt tries QUIC again. Transport negotiation does not replay application requests.
Allow TLS to pass through without interception by a network proxy.
Application behavior
Tunnels support HTTP requests, streaming responses, and HTTP/1.1 WebSocket upgrades. They preserve the public Host header, path, escaped delimiters, and query string.
Set local service addresses during activation or manage them from the dashboard with Local services. HTTPS local services need a trusted certificate for that address's hostname. Loclix security rules and Zero Trust apply before forwarding; access assertions reach the local service.
Tunnels publish HTTP services. They do not forward arbitrary TCP or UDP traffic. Use Private Connect for office Internet access.
Origin-confirmed API sessions require a direct origin. Shared website caching is bypassed while a tunnel origin or route is configured.
Connection interruptions
The connector needs continued access to your dashboard host to refresh its authorization. If authorization cannot be renewed for 60 seconds, requests and WebSocket connections close.
Token replacement or pausing a connector usually closes existing connections within ten seconds. Connection status can lag while reports update.
Limits
| Setting | Limit |
|---|---|
| Connectors per account | 16 |
| Published tunnel routes per website | 64 |
| Replicas per connector, per edge | 4 |
| Named local services per connector | Up to 64; activation requires at least one. |
| IDs and service names | 1–48 letters, numbers, underscores, or hyphens |
| Connector name | 1–80 characters |
All replicas must provide equivalent named services. See credential replacement before activating a replica of an existing connector.