> Fetch the index of every Tonbo docs page as Markdown at https://tonbo.dev/llms.txt

# Network path

Last updated 2 November 2026

> Machines are not open yet. These pages describe Machines as they will open; until then, a create answers [`region_not_offered`](https://tonbo.dev/docs/machines/troubleshooting/manage.md#region_not_offered) (422), “Machines are not offered in any region yet.”

Read this when you need the path a request takes to your Machine, and the path its own connections take out.

## Requests in

Each region has an edge for Machines of its own: a [Network Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html) with a certificate from [AWS Certificate Manager](https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html), in front of [Envoy Gateway](https://gateway.envoyproxy.io/) and machine-edge, on hosts apart from the Machines. TLS ends there. machine-edge finds the Machine by its name, checks a private port’s key, asks the controller for a running wake (see [Activations](https://tonbo.dev/docs/machines/internals/activations.md)), and carries the request to the Machine’s host through a tunnel, as HTTP/1.1, [Server-Sent Events](https://html.spec.whatwg.org/multipage/server-sent-events.html) or [WebSocket](https://www.rfc-editor.org/rfc/rfc6455.html). [HTTP/2](https://www.rfc-editor.org/rfc/rfc9113.html) ends at the edge.

## Connections out

A Machine’s own connections leave over IPv4 through the region’s [NAT gateway](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) for Machines, which no Tonbo service shares; its requests to S3 in the same region go through the region’s [S3 gateway endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html), and its DNS through Tonbo’s resolver on the host. There is no IPv6. Tonbo can block one Machine’s or one account’s outbound access (see [Outbound access](https://tonbo.dev/docs/machines/guarantees/network.md#outbound)).

## The deny list

| Denied | Toward |
| --- | --- |
| IPv4 ranges | `0.0.0.0/8`, `10.0.0.0/8`, `100.64.0.0/10`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, `192.0.0.0/24`, `192.0.2.0/24`, `192.88.99.0/24`, `192.168.0.0/16`, `198.18.0.0/15`, `198.51.100.0/24`, `203.0.113.0/24`, `224.0.0.0/4`, `240.0.0.0/4` |
| TCP ports | 10250, 25, 465, 587 toward every address, the host agent’s port 7470, and 4437–4439 toward Tonbo’s network |

## Tonbo’s own databases

A Machine reaches its database at a name the host resolves to the region’s internal entry for databases and streams, inside Tonbo’s network, and nothing else of Tonbo’s (see [Isolation claims](https://tonbo.dev/docs/machines/internals/isolation.md), CL2).