Contents
Getting started
10-minute quick startArchitecture
Install and upgrade
Install the controllerAdd nodesOnline upgradesStaged rollout and automatic rollbackBackup and point-in-time restoreUninstall and migrate
Sites
Add a siteSet up the CNAME recordHTTPS certificatesCache rulesPurge and prefetchOrigin settingsAlways Online, 0-RTT and 103 Early HintsTiered origin (L2)Stream forwarding (Layer 4)
Security
Security overview and big screenWebsite checkupAttack logCC protectionWAFLists and access controlBots and scannersJA4 / TLS fingerprintXDP kernel-level filteringPaid features
Analytics and alerts
StatisticsAccess logsAlerts and notificationsAlert channels
Accounts and licensing
Users and plansLicenses and add-onsOnline top-up and identity verification

Stream forwarding (Layer 4)

About 8 minApplies to v2.3.1Updated 2026-11-02

Stream forwarding maps ports on your nodes to your origin. It suits games, database proxies, DNS and custom protocols. Forwarding does not parse application-layer content, so HTTP-layer features such as caching, WAF and CC do not apply; protection comes from the per-IP connection limit and the ACL.

Where to find it: administrators use Stream Forwarding › All Forwarding, tenants use Stream Forwarding › My Forwarding, and tenants can organize forwards under Stream Forwarding › Group Management. Defaults for new forwards are under Default Settings › Stream Forwarding.

Create and edit a forward

The edit page is organized in these blocks.

BlockContents
Basic InformationName, plan, group, line group, CNAME and status. A CNAME is assigned automatically on creation
Listening SettingsPorts the nodes listen on, separated by spaces; add /udp for UDP. For example 88 99/udp means TCP 88 and UDP 99
Origin Server SettingsLB method, origin port, PROXY Protocol and the origin server list
Connections per IP LimitCaps concurrent connections from a single visitor IP
UDP responses1–100. The session ends after the origin has sent that many packets; use it only for request/response protocols such as DNS
ACLChoose Allow or Deny as the default, then add rules to permit or block specific sources

Origins and load balancing

List one origin per line as IP [up|backup|down]: up takes part normally, backup is used only when all other origins are unavailable, and down is temporarily excluded. LB methods are round robin, least connections, IP hash and random. Pick IP hash when a visitor must stick to the same origin.

Caution With PROXY Protocol on, nodes prepend the visitor's real address to each connection, so the origin must have it enabled and parse it, otherwise connections fail. Configure the origin first, then turn the switch on.

Go live

Point your service domain at the forward's CNAME (the same way as for a website, see CNAME onboarding), or have clients connect to the CNAME hostname directly. The config is pushed to the nodes of the line group. The list and detail pages show which node and which port is not in effect, which helps when a port is already in use or a node is not ready.

Tip For long-lived UDP sessions such as games, leave "UDP responses" unset; otherwise the session is closed after the given number of replies.

Statistics

Open Statistics and choose Stream Forwarding in the page header. Trend shows sessions and the concurrency peak; Rank orders forwards by traffic, with TCP and UDP on the same port shown on separate rows.

Usage and billing follow the plan rules; see Users and plans.