Modal Networking

Use this skill when configuring network behavior for Modal Functions, including static IPs, port forwarding, region selection, and inter-container communication.

For Server routing_region / compute_region on @app.server, see modal-servers. Auto Endpoints expose the same placement flags via CLI (modal-endpoints).

When to Use This Skill

• Need a static outbound IP for allow-listing
• Exposing internal container ports to the internet
• Running Functions near specific cloud regions
• Optimizing network latency with regional routing
• Connecting Functions to external private networks

Proxies (Static IP)

Route all container traffic through static IP addresses:

@app.function(proxy=modal.Proxy.from_name("my-proxy"))
def call_external_api():
    import requests
    # All traffic exits through proxy's static IP
    return requests.get("https://api.example.com").json()

Setup

1. Create a Proxy in workspace Settings (Team/Enterprise plans)
2. Each Proxy has up to 5 static IPs
3. Allow-list these IPs in your firewall

With Sandboxes

sb = modal.Sandbox.create(
    app=app,
    proxy=modal.Proxy.from_name("my-proxy"),
)

Port Forwarding (modal.forward)

Expose a container port to the internet temporarily:

@app.function()
def serve():
    with modal.forward(8080) as tunnel:
        print(f"Public URL: {tunnel.url}")
        start_server(port=8080)
        # Server accessible at tunnel.url while context is active

Useful for debugging, temporary services, or webhook receivers.

Region Selection

Container region

Run containers in specific geographic regions:

@app.function(region=["us-west"])
def west_coast_function():
    ...

Available regions

Broader regions are cheaper (1.5x) than narrow (1.75x).

Regional routing (Public Beta)

Control where Function inputs/outputs are routed (default us-east):

@app.function(routing_region="eu-west")
def eu_function():
    ...

Valid routing_region values:

Beta constraints (still accurate for deploy-time config)

• Decorator routing_region= is set at initial deploy; changing it on redeploy requires a new Function (cannot mutate in place).
• Non-us-east routing: invoke with .remote(), .map(), or HTTP for Web Functions (docs). Changelog also notes limited invoke methods during Beta.
• Inputs/outputs >2 MiB still go through object storage in us-east.

Dynamic override (SDK 1.5.2+)

Override routing at invocation time without redeploying:

f = modal.Function.from_name("my-app", "eu_function")
result = f.with_options(routing_region="us-west").remote(data)

Also available on Cls.with_options(routing_region=...) (and Go/JS clients). This complements — does not remove — the deploy-time Beta constraints above.

Servers and Endpoints

@app.server uses routing_region (proxy anchor) and optional compute_region (container placement). Auto Endpoints use --routing-region / --compute-region. See modal-servers and modal-endpoints.

Container Networking

• Containers in the same App cannot directly connect to each other by IP (except in clusters)
• Use Volumes, Dicts, or Queues for inter-Function communication
• External network access is available by default
• DNS resolution works normally

Cluster Networking (Multi-Node)

Within @modal.experimental.clustered workloads:

• Nodes get unique IPv6 addresses on a shared 50 Gbps i6pn network
• RDMA available at 3200 Gbps when rdma=True
• Access peer IPs via modal.experimental.get_cluster_info().container_ips
• Designed for distributed training (e.g., PyTorch DDP, DeepSpeed)

Private Networking

For connecting to VPCs or on-premise networks:

• Use Proxies with WireGuard tunnels
• Configure proxy with your VPN/gateway IP
• All container traffic routes through the secure tunnel

Go/TypeScript SDK Note

Networking configuration (region selection, proxies, port forwarding, modal.forward()) is defined in Python Function decorators.

From Go/TS, you can:

• Create Sandboxes with network access (containers have outbound internet by default)
• Call deployed Functions that have networking configured in Python
• Override routingRegion via withOptions at call time (SDK parity with Python 1.5.2+)
• Use sb.Exec() / sb.exec() to run networking tools inside Sandboxes

Sandbox-level network control from Go/TS:

sb, _ := mc.Sandboxes.Create(ctx, app, image, &modal.SandboxCreateParams{
    BlockNetworkAccess: true, // disable outbound internet
})

const sb = await modal.sandboxes.create(app, image, {
    blockNetworkAccess: true,
});

Symptom Triage

"External API rejects requests"

• Use a Proxy for static IP allow-listing
• Verify the proxy is online in workspace Settings

"High latency to external database"

• Use region= to run near the database
• Use routing_region= (or .with_options(routing_region=...)) to route through a closer region

"Need to expose a development server"

• Use modal.forward(port) context manager
• Use Sandbox tunnels for Sandbox-based servers

"Cannot change routing_region on redeploy"

• Expected under Public Beta for decorator config — create a new Function, or use .with_options(routing_region=...) at invoke time (1.5.2+)

Reference Map

• references/proxies.md — Proxy setup, static IPs, WireGuard
• references/port-forwarding.md — modal.forward, tunnels
• references/region-selection.md — container regions, regional routing (Public Beta), with_options, pricing
• references/container-networking.md — network behavior, DNS, inter-container comms
• Sibling skills: modal-servers (routing_region / compute_region), modal-endpoints

Guardrails

• Proxies require Team or Enterprise plan
• Region selection adds cost multipliers (1.5x–1.75x)
• Regional routing is Public Beta; deploy-time routing_region cannot be changed on redeploy (new Function required)
• Dynamic Function.with_options(routing_region=...) available from SDK 1.5.2+
• Non-us-east routing has limited invoke methods (.remote / .map / HTTP for Web Functions)
• Use broader container regions for better availability and lower cost
• Proxy traffic is encrypted with WireGuard
• Large payloads (>2 MiB) still route object storage via us-east