Default limits
A few targets are closed for every account, and a few rules protect the gateway. Everything else is open: bought traffic has no limit on threads or connections.
Blocked for everyone
| Target | How the gateway answers | Unlock |
|---|---|---|
| Mail ports 25, 465, 587 and 2525, on any host | 403 mail port … is closed | Never |
Government and military sites: .gov and .mil, and country forms such as .gov.uk | 403 government and military sites are blocked by default | Per account, after identity verification |
| Some banking, financial and payment sites | 403 banking and payment sites are blocked by default | Per account, after identity verification |
| Some ticketing sites | 403 ticketing sites are blocked by default | Per account, after identity verification |
On port 7001 each of these blocks is SOCKS5 reply 2, and a UDP datagram to them is dropped. A listed site is blocked together with all its subdomains, and a blocked request uses no traffic. The policy behind the list is section 4 of the Acceptable Use Policy.
Why these targets
- Mail. Our exits are home connections and phones. Mail sent from them, even mail people asked for, puts those addresses on spam lists and hurts the people they belong to, so no account can open these ports (Acceptable Use Policy, section 3.4).
- Government and military sites. They open only after an identity check, so that we know who is behind the traffic.
- Banking and payment sites. Card testing and attempts to sign in to other people's accounts are the common abuse here (sections 3.1 and 3.3).
- Ticketing sites. Bots that buy tickets for resale are not allowed (section 3.7).
Unlocking sites for your account
If your work needs a blocked site, such as testing a service you build for a government client or checking how a bank's public pages look in another country, ask support in the live chat or through the contact page. We ask you to verify your identity (KYC Policy) and to describe the use case, and decide case by case. Once access is approved, your logins and sub-users reach the unlocked sites within a minute, with no change to the login. Mail ports stay closed for every account, verified or not.
Trying to reach a blocked target another way breaks the Acceptable Use Policy.
No limit on threads
Bought traffic has no thread, connection or session limit: run as many parallel connections as the job needs. Traffic is counted in GB, every byte in both directions, and 1 GB is 1,000,000,000 bytes. Sub-users work the same way within their own GB limit.
The gateway checks what is left while data flows. When traffic runs out, open connections close and new ones get 402. Residential and mobile traffic are separate, so running out on one product does not stop the other.
No limit on our side is not a licence to overload a site. Keep the pace reasonable for the size of the site, and slow down when it answers 429 or 503 (Acceptable Use Policy, section 3.8).
Free trial traffic
While an account has nothing but free trial traffic left on a product, the gateway adds trial limits: a cap on sessions at once and on new connections per second, and it can close more ports. Their answers carry an X-Reason that starts with trial traffic: or ends with closed on trial traffic. Buying traffic lifts them within seconds.
Failed logins
After 30 failed logins within a minute from one IP address, the gateway answers 429 too many failed logins to every login from that address until the minute is over, correct ones included. A login with a misspelt targeting value counts as a failed one, so a single wrong line in a job with many threads is enough. A first request without any login, which browsers, Java and .NET send before the gateway asks for one, does not count. SOCKS5 clients see a rejected login instead of 429. Stop the job, fix the line and wait a minute. Everyone behind one shared office address shares the count.
Timeouts
A tunnel with no data in either direction for 10 minutes is closed, and a client that connects but sends no request within 30 seconds is disconnected. Connections that stay quiet for long stretches, such as a websocket, should send a keepalive message or reconnect. A UDP association on port 7001 is closed after 10 minutes without a datagram (SOCKS5 and UDP).
On port 7000 every refusal names its reason in an X-Reason header. Gateway errors lists the codes and texts for both ports.
Questions
No. They stay closed for every account, verified ones included.
No. A 403 without our X-Reason that arrives after the tunnel opened comes from the site itself.