Ports, tunnels and public access

An app being reachable in a browser does not mean every network service it exposes is reachable publicly.

Connection	What to check
Protected public web address	App’s supported HTTP/HTTPS behavior and proxy requirements
Direct public connection	Assigned IP, published ports, DNS and firewalls
Cloudflare Tunnel in BYOH	Supported public web apps; not general public TCP/UDP forwarding
Tailscale / Headscale	Approved devices, private DNS and private-network connectivity

WebSockets and RPC

These names can describe different protocols. For an app integration, identify whether it uses HTTP/HTTPS, WebSockets, raw TCP or UDP, plus any required port and authentication. Do not assume arbitrary RPC traffic is covered just because a website opens.

Public mail and SFTP

Public SMTP, IMAP and SFTP require an appropriate reachable network path. A normal web-only tunnel does not expose these ports. Use the connection recommended for the app, or ask support before deployment.

Firewalls

A provider firewall, host firewall and application access rule are different layers. For BYOH, the panel’s host-firewall helper does not open your router or provider firewall. For a VPS, rules also need to agree with the guest operating system.

If an app is marked incompatible in the catalog, choose another supported connection instead of trying to bypass the restriction.