Publish a port

Instances sit behind NAT on a private network. HTTP and HTTPS reach them through the free URL or a custom domain. Anything else — an OCPP endpoint for EV chargers, a game server, MQTT, a database for a partner — needs a published port: a public port on the region’s shared address that maps to a port on your instance.

What you get

A public port in the range 20000–29999on the region’s address, forwarded to the port you choose on the instance. TCP or UDP. It is live within seconds and survives instance restarts and host reboots.

The public port is assigned by CloudNx, not chosen by you — the address is shared by every instance in the region, so two customers cannot both have :8887. Your devices connect to <address>:<public port>; your application still listens on its own port and never knows the difference.

1. Make sure the app listens on all interfaces

Inside the instance, the service must bind 0.0.0.0 (or ::), not 127.0.0.1. Check:

ss -ltnp | grep 8887
# LISTEN 0 4096  0.0.0.0:8887  ...   ← reachable
# LISTEN 0 4096  127.0.0.1:8887 ...  ← localhost only; change the bind address

2. Publish it

Portal → the instance → Networking → Published ports → Publish. Choose the protocol and the instance port; add a note so you remember what it is for. The public port appears immediately.

Or with the API:

curl -X POST https://cloudnx.in/api/v1/compute/instances/$INSTANCE_ID/port-forwards \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"protocol": "tcp", "private_port": 8887, "description": "OCPP central system"}'

# → {"id": "...", "protocol": "tcp", "public_port": 20887, "private_port": 8887, ...}

3. Allow it in the instance firewall

Publishing opens the path from the internet to the instance. The instance’s own firewall (Portal → Network → Firewall) still decides whether to accept it. Add an inbound rule for the instance port — 8887 in the example, not the public one — from the sources you want. For a fleet of chargers on mobile networks that is usually 0.0.0.0/0; for a partner database, their addresses only.

4. Test from outside

nc -vz <region address> 20887
# Connection to <region address> port 20887 [tcp/*] succeeded!

Test from a laptop or phone hotspot, not from another CloudNx instance in the same region — traffic from inside the region takes a different path and can succeed when the public one does not.

Give devices a hostname, not the address

Hard-coding the region address into firmware or a partner’s config makes any future move painful. Create a DNS record you control — ocpp.example.com → <region address>— and give devices ocpp.example.com:20887. If the address ever changes, you change one DNS record instead of every device in the field.

When you need the real port number

Some protocols and some devices insist on a fixed, well-known port. For that you need an address of your own: an Elastic IP gives the instance a dedicated public address with every port mapped 1:1, so :8887 is :8887. Elastic IPs are allocated from a limited pool per region; open a support ticket to ask about availability.

Troubleshooting

Notes

• Port 22 is already published for you as the instance’s SSH port — it cannot be published twice.
• Publishing is included with every instance. There is no per-port charge; egress counts toward the plan’s bandwidth like any other traffic.
• Deleting a published port closes it within seconds. Deleting the instance removes all of its published ports.