Your localhost,
globally accessible.
Expose any local service to the internet over a single secure, multiplexed tunnel. Live traffic inspection, replayable webhooks, WebSocket support, and automatic TLS — out of the box.
One outbound connection. Everything routed.
tun-el establishes a persistent multiplexed channel from your machine to the edge, then routes public traffic back over the same connection — securely and in order.
Run the agent
Start tun-el next to your app. A single outbound connection opens — no inbound ports, no firewall changes.
Multiplex the tunnel
Every request, WebSocket, and webhook is streamed over one persistent, multiplexed connection to the edge.
Serve the world
Your service is reachable at a stable HTTPS URL with automatic TLS, anycast routing, and global presence.
See every request the moment it happens.
Inspect headers, bodies, timing, and status for all traffic flowing through your tunnel. Replay any request — including webhooks — without leaving your terminal or browser.
- Full request & response capture with body diffing
- One-click webhook replay to your local endpoint
- Filter by method, status, path, or latency
Real-time, bidirectional, and fully transparent.
tun-el speaks WebSocket natively. Frames are forwarded both ways over the same multiplexed tunnel with zero buffering, so live dashboards, collaborative apps, and game servers behave exactly as they do locally.
Built for production from the first connection.
tun-el applies zero-trust networking principles so you can expose real services with confidence — not just demos.
Automatic TLS
Every tunnel is served over HTTPS with certificates provisioned and renewed automatically. No manual configuration.
End-to-end encryption
Traffic is encrypted from your agent to the edge. The tunnel control plane never sees plaintext payloads.
Scoped access tokens
Issue per-tunnel credentials with granular scopes and revoke them instantly from the dashboard or CLI.
Request authentication
Gate any tunnel behind OAuth, basic auth, or IP allowlists with a single flag.
Stable domains
Reserve custom subdomains and bring your own domain with CNAME — URLs that never change between sessions.
No inbound exposure
Your machine only makes outbound connections. There are no open ports for attackers to scan.
Low-latency by design, everywhere.
A Go core, connection multiplexing, and an anycast edge keep overhead in the single-digit milliseconds. tun-el routes each request to the nearest point of presence automatically.
From localhost to live in one command.
No accounts to wire up, no YAML to learn. tun-el fits the way you already work — terminal-first, scriptable, and fast.
A single Go binary you fully control.
tun-el ships as one statically-linked binary with no runtime dependencies. Run the public edge, or self-host the entire control plane and edge on your own infrastructure. The protocol and server are open source.
services:
tun-el-edge:
image: tunel/edge:latest
command: server --domain tun.el
ports:
- "443:443"
environment:
TUNEL_TLS: "auto"
TUNEL_AUTH: "oidc"
restart: unless-stoppedDrops into the stack you already run.
tun-el is just a binary and an HTTP endpoint, so it composes cleanly with your tools, frameworks, and CI.
Free and open. Managed when you need it.
Self-host the whole platform at no cost, or let tun-el run the global edge for you.
Open Source
- Full edge + control plane
- Unlimited tunnels
- WebSocket & webhook replay
- Apache-2.0 license
Pro
Popular- Managed global edge
- Reserved & custom domains
- Live traffic inspector
- OAuth & IP allowlists
- Priority routing
Expose your localhost in seconds.
Install the binary, run one command, and share a secure global URL. Free and open source.