A tunnel involves three kinds of ports: the local port of your service, the server port that people connect to, and the outbound ports the Localtonet app uses to reach the server. This page explains how to keep the server port fixed, how to choose it yourself, and how to pin the outbound ports for a strict firewall.
The three kinds of ports #
| Port | Where it is | Where you set it |
|---|---|---|
| Local port | On your device. Your service listens on it. | Local port when you create the tunnel, and later in Tunnel Details. See Settings reference. |
| Server port | On the Localtonet server. People connect to the tunnel address and this port. | Is Reserved? and Server Port in the tunnel settings. |
| Outbound ports | On the Localtonet server. The Localtonet app on your device connects out to them. | Outbound Port in the tunnel settings. |
| Setting | Tunnel types | Needs Balance |
|---|---|---|
| Is Reserved? | TCP - UDP, Proxy Server, Rotating Proxy | Yes |
| Server Port | TCP - UDP, Proxy Server (not VLESS), Rotating Proxy | Yes |
| Outbound Port | Every tunnel type, except tunnels on the Local server | Yes |
HTTP, TLS, File Server and MCP Gateway tunnels are reached by their address and have no server port setting.
Server port #
A TCP, UDP or proxy tunnel gets its server port when it starts. The tunnel list shows it in the Server Port column; select the number to copy it. The icon next to the number shows whether the port is reserved, and opens a short explanation with the matching action.
| State | What it means |
|---|---|
| Port not reserved | The port changes when the tunnel or the Localtonet app restarts. The address you gave to others then stops working. |
| Reserved port | This port stays the same when the tunnel or Localtonet app restarts. |
| Fixed port | VLESS always uses port 443. |
A tunnel that you create while your account has Balance starts with Is Reserved? on. A tunnel that was created on the Free plan does not: adding Balance later does not reserve its port. You reserve it per tunnel, as described below.
Keep the server port: Is Reserved? #
Needs Balance
-
Start the tunnel #
You can only switch a reservation on while the tunnel is running and has a server port. On a stopped tunnel whose port is not reserved, the switch stays off and the dashboard shows the port information with the action Start to reserve.
-
Reserve the port #
Open the tunnel settings and switch Is Reserved? to Yes. You can also select the icon next to the port in the tunnel list and choose Reserve port. If the tunnel is stopped, the same place offers Start to reserve; without Balance it offers Add Balance.
The dashboard confirms with "Server port reserved. It will stay the same across restarts."
To give the port up, switch Is Reserved? to No and confirm Turn off reserved port? with Turn off. The dashboard confirms with "Port reservation removed." The port may change after a restart once its reservation is removed.
Choose the server port yourself #
Needs Balance
Server Port › Change opens the Server port dialog. It changes the port people connect to on the Localtonet server. The port on your device stays the same.
| Item | Values |
|---|---|
| New server port | A number from 501 to 65535. Port 4040 is not available. |
| Suggestion | Same as local port, offered when the local port of the tunnel is in the allowed range. |
- Saving reserves the port for this tunnel, so Is Reserved? is on afterwards.
- Saving restarts a running tunnel, so the Localtonet app of its device must be connected. On a stopped tunnel the port is saved and used at the next start.
- A port is unique per server. If another tunnel on this server already uses or has reserved the port, you are asked to pick another one: "Port PORT is not available on this server."
- The server port of a VLESS proxy cannot be changed.
Moving a tunnel to another server. The tunnel keeps its port number. If that number is taken on the new server, the move is refused with "Your tunnel's port (PORT) is not available on the selected server. Change the port first."
Example: a game server on its usual port #
You run a Minecraft server on local port 25565 and share it with a TCP tunnel. Open Server Port › Change, select Same as local port and save. Players now connect to the tunnel address with port 25565, and the port stays the same after every restart.
Outbound ports #
Needs Balance
The Localtonet app on your device connects out to the server. Normally it may use any outbound port. On a network whose firewall only lets traffic out to known addresses and ports, the connection is blocked unless you allow those ports, and for that they must not change.
-
Open the dialog #
In the tunnel settings, select Outbound Port › Manage. The Outbound ports dialog opens.
-
Turn on fixed ports #
Turn on Use fixed outbound ports and select Save. From then on, later starts of the tunnel keep the same ports. Saving does not restart the tunnel.
-
Allow the addresses and ports in your firewall #
Under Allow these in your firewall the dialog lists the Server IPv4, the Server IPv6 where the server has one, and the TCP and UDP ports. Copy all copies the list. Allow outbound traffic from the device to these addresses and ports.
Turn this on only when a strict firewall lets traffic out to known addresses and ports alone. Otherwise leave it off. For a Rotating Proxy the setting applies to the Localtonet app on every device in the proxy's token groups.
The server address belongs to the server. If you move the tunnel to another server, open the dialog again and update your firewall with the new address and ports.
Troubleshooting #
"You need to purchase balance to use this feature."
Reserving a port, choosing a server port and fixed outbound ports need Balance. See Plans and Balance.
"Start the tunnel first."
The server answers this when a reservation is requested for a tunnel that is stopped or has no server port yet. Start the tunnel, then switch Is Reserved? on.
"Pick a port from 501 to 65535." or "The port must be between 500 and 65536."
The server port is outside the allowed range. Choose a number from 501 to 65535.
"Port 4040 is used by Localtonet. Pick another one."
Port 4040 is not available as a server port on any server. Choose another number.
"Port PORT is not available on this server."
Another tunnel on the same server uses or has reserved that port. Choose another port, or move the tunnel to another server.
"VLESS proxy ports cannot be changed."
A VLESS proxy always uses port 443.
"Check the device connection."
Changing the server port restarts a running tunnel, and the Localtonet app of its device is not connected. Start the app, or stop the tunnel and save again.
My port changed although I have Balance
Only tunnels that you create while your account has Balance start with Is Reserved? on. A tunnel created before that is not reserved when you add Balance. Start the tunnel and switch Is Reserved? to Yes.
