Network path

Last updated 2 November 2026

Read this when you need the path a request takes to your Machine, and the path its own connections take out.

Requests in

Each region has an edge for Machines of its own: a Network Load Balancer with a certificate from AWS Certificate Manager, in front of Envoy Gateway and machine-edge, on hosts apart from the Machines. TLS ends there. machine-edge finds the Machine by its name, checks a private port’s key, asks the controller for a running wake (see Activations), and carries the request to the Machine’s host through a tunnel, as HTTP/1.1, Server-Sent Events or WebSocket. HTTP/2 ends at the edge.

Connections out

A Machine’s own connections leave over IPv4 through the region’s NAT gateway for Machines, which no Tonbo service shares; its requests to S3 in the same region go through the region’s S3 gateway endpoint, and its DNS through Tonbo’s resolver on the host. There is no IPv6. Tonbo can block one Machine’s or one account’s outbound access (see Outbound access).

The deny list

Tonbo’s own databases

A Machine reaches its database at a name the host resolves to the region’s internal entry for databases and streams, inside Tonbo’s network, and nothing else of Tonbo’s (see Isolation claims, CL2).