Proxies (beta)

You can securely connect with resources in your private network using a Modal Proxy. Proxies are a secure tunnel between Apps and exit nodes with static IPs. You can allow-list those static IPs in your network firewall, making sure that only traffic originating from these IP addresses is allowed into your network.

Proxies are unique and not shared between workspaces. All traffic between your Apps and the Proxy server is encrypted using Wireguard.

Modal Proxies are built on top of vprox, a Modal open-source project used to create highly available proxy servers using Wireguard.

Modal Proxies are in beta. Please let us know if you run into issues.

Creating a Proxy

Proxies are available for Team Plan users.

You can create Proxies in your workspace Settings page. There’s a limit of one IP per workspace. Please reach out to support@modal.com if you need more than one Proxy.

Using a Proxy

After a Proxy is online, add it to a Modal Function with the argument proxy=Proxy.from_name("<your-proxy>"). For example:

import modal
import subprocess

app = modal.App(image=modal.Image.debian_slim().apt_install("curl"))

@app.function(proxy=modal.Proxy.from_name("<your-proxy>"))
def my_ip():
    subprocess.run(["curl", "-s", "ifconfig.me"])

@app.local_entrypoint()
def main():
    my_ip.remote()

All network traffic from your Function will now use the Proxy as a tunnel.

The program above will always print the same IP address independent of where it runs in Modal’s infrastructure. If that same program were to run without a Proxy, it would print a different IP address depending on where it runs.

Proxies and Sandboxes

Proxies can also be used with Sandboxes. For example:

import modal

app = modal.App.lookup("sandbox-proxy", create_if_missing=True)
sb = modal.Sandbox.create(
    app=app,
    image=modal.Image.debian_slim().apt_install("curl"),
    proxy=modal.Proxy.from_name("<your-proxy>"))

process = sb.exec("curl", "-s", "https://ifconfig.me")
stdout = process.stdout.read()
print(stdout)

sb.terminate()

Similarly to our Function implementation, this Sandbox program will always print the same IP address.