diff --git a/api/controller/gateway.go b/api/controller/gateway.go
index cf150b77e..fb22d3b84 100644
--- a/api/controller/gateway.go
+++ b/api/controller/gateway.go
@@ -24,6 +24,7 @@ import (
 	"github.com/Sirupsen/logrus"
 	"github.com/goodrain/rainbond/api/handler"
 	api_model "github.com/goodrain/rainbond/api/model"
+	"github.com/goodrain/rainbond/cmd/api/option"
 	"github.com/goodrain/rainbond/mq/api/grpc/client"
 	httputil "github.com/goodrain/rainbond/util/http"
 	"net/http"
@@ -33,6 +34,7 @@ import (
 // GatewayStruct -
 type GatewayStruct struct {
 	MQClient *client.MQClient
+	cfg *option.Config
 }
 
 // HTTPRule is used to add, update or delete http rule which enables
@@ -190,8 +192,8 @@ func (g *GatewayStruct) AddTCPRule(w http.ResponseWriter, r *http.Request) {
 	}
 	if req.Port == 0 {
 		values["port"] = []string{"The port field is required"}
-	} else if req.Port <= 20000 {
-		values["port"] = []string{"The port field should be greater than 20000"}
+	} else if req.Port <= g.cfg.MinExtPort {
+		values["port"] = []string{fmt.Sprintf("The port field should be greater than %d", g.cfg.MinExtPort)}
 	} else {
 		// check if the port exists
 		if h.PortExists(req.Port) {
@@ -238,8 +240,8 @@ func (g *GatewayStruct) updateTCPRule(w http.ResponseWriter, r *http.Request) {
 	h := handler.GetGatewayHandler()
 	// verify reqeust
 	values := url.Values{}
-	if req.Port != 0 && req.Port <= 20000 {
-		values["port"] = []string{"The port field should be greater than 20000"}
+	if req.Port != 0 && req.Port <= g.cfg.MinExtPort {
+		values["port"] = []string{fmt.Sprintf("The port field should be greater than %d", g.cfg.MinExtPort)}
 	} else {
 		// check if the port exists
 		if h.PortExists(req.Port) {
diff --git a/api/controller/manager.go b/api/controller/manager.go
index 2b836ef3c..43cada6ce 100644
--- a/api/controller/manager.go
+++ b/api/controller/manager.go
@@ -85,5 +85,6 @@ func NewManager(conf option.Config, statusCli *client.AppRuntimeSyncClient) (*V2
 	logrus.Debugf("create  entrance api proxy success")
 
 	v2r.GatewayStruct.MQClient = mqClient
+	v2r.GatewayStruct.cfg = &conf
 	return &v2r, nil
 }
diff --git a/cmd/api/option/option.go b/cmd/api/option/option.go
index 269345afc..4f914ddda 100644
--- a/cmd/api/option/option.go
+++ b/cmd/api/option/option.go
@@ -50,6 +50,7 @@ type Config struct {
 	RegionTag         string
 	LoggerFile        string
 	Debug             bool
+	MinExtPort           int // minimum external port
 }
 
 //APIServer  apiserver server
@@ -91,6 +92,7 @@ func (a *APIServer) AddFlags(fs *pflag.FlagSet) {
 	fs.StringVar(&a.RegionTag, "region-tag", "test-ali", "region tag setting")
 	fs.StringVar(&a.LoggerFile, "logger-file", "/logs/request.log", "request log file path")
 	fs.BoolVar(&a.Debug, "debug", false, "open debug will enable pprof")
+	fs.IntVar(&a.MinExtPort, "min-ext-port", 0, "minimum external port")
 }
 
 //SetLog 设置log