Skip to main content
Edge Proxy protects an origin by routing connections through a protected IPv4 address. A proxy profile links that address to the origin and defines how traffic is filtered and forwarded, using policies from a Gcore-managed template. The base URL is https://api.gcore.com/security/edgeproxy.

​
Proxy profiles

A proxy profile holds one origin, one protected address, and one template id. Each rule assigns one policy from that template to one or more port mappings, which set the protocol and port clients use, so further ports stay on the same profile. An origin already used by an active profile cannot be assigned to another profile. Creating a proxy profile returns its protected IP address. Omit protected_ip_address so Gcore allocates the address. Selecting one from the available addresses is possible only when the account has an assigned non-common pool (BYOIP). An account without that pool cannot choose an address. To change an existing profile, Replace proxy profile submits its full configuration again, or Update proxy profile submits only the fields to change. An update can also move the profile to another free address from an assigned non-common pool. Activate, deactivate, or redeploy an existing profile. The ACL limit shows how many rules the account can hold and how many it currently uses.

​
Proxy templates

Gcore publishes every proxy template. A profile selects one by template_id, and the account’s default template is the entry with is_default set to true. List proxy templates and Get proxy template are the client calls. A policy describes how Edge Proxy recognizes traffic for one application. Minecraft has its own policy. An ordinary TCP service uses Generic TCP Server, whose id is tcp-server. A rule stores that id, not the policy name.

​
Quick start

A TCP service listening on port 80 uses the default template and its Generic TCP Server policy, tcp-server. The steps create a proxy profile, wait until the protected IP address is ready, and verify that connections reach the application through Edge Proxy. Edge Proxy must be active on the account, and the origin must be reachable at a public IPv4 address or domain name. The application must accept TCP connections on port 80. When a firewall restricts access, allow the Gcore edge IP addresses to reach that port. Restricting direct access to the origin also prevents clients from bypassing protection. An API token, curl, and jq are required, and Use Postman stores that token on the collection and reuses an id from the list response in the next request. Run the commands in the same shell, because later steps use variables set by earlier ones. When a command reports an error, resolve it before continuing. Set the token and the origin address:
1

Select a template and policy

A profile can use only policies from its selected template. The commands find the account’s default template (is_default is true), select its tcp-server policy, and save both IDs for profile creation.
A successful selection looks like this. The template ID may differ:
When either ID is missing, stop and select a valid template and policy.
2

Create the profile

The Create proxy profile request links the origin to the selected template and applies tcp-server to TCP port 80. It uses edge-proxy-profile as the name, which must contain 1 to 60 characters, and omits protected_ip_address so Gcore assigns an address.This request uses port 80 both on the protected IP and on the origin. When the application listens on port 8080, set outbound_port in the mapping and allow Gcore edge traffic on port 8080:
For port 80, run:
A successful request returns HTTP 201 with the profile ID and protected IP address. Deployment has started, so status is INACTIVE and is_processing is true:
An HTTP 400 response can mean that the service is inactive, no protected address is available, the origin is already used by an active profile, or the profile limit has been reached.
3

Wait for deployment

The protected IP is returned before the profile is ready to accept connections. Edge Proxy must first deploy its configuration across the network. The commands read the profile until processing finishes and save PROTECTED_IP only when the profile is ACTIVE and has no error. A new profile becomes active automatically, without a separate Activate call.
A successful deployment has status ACTIVE, is_processing false, and is_error false:
When is_error is true, read error_details before proceeding. Hold client traffic until all three conditions are met and PROTECTED_IP is set.
4

Direct clients to the protected IP

Once the profile is ready, clients can connect to PROTECTED_IP on TCP port 80 instead of connecting directly to the origin. When they use a domain name, update its DNS A record to point to the protected IP address. Connections sent directly to the origin bypass Edge Proxy filtering.
5

Verify the connection

Connect to the protected IP on port 80 with the application’s normal client. A successful test returns the application’s response through Edge Proxy rather than directly from the origin.When an HTTP service accepts requests sent to its IP address, run:
When the application selects a site based on its hostname, send the name in the Host header:
When the connection fails while the profile is ACTIVE, Connection failures covers an origin that blocks Gcore edge IP addresses, a policy that does not match the application, and a Host value the application does not recognize.