tnl.voxent.io is live · Let's Encrypt certs · self-hosted

Reverse tunnels
for everyone.

One command exposes your localhost to the internet over HTTPS. Same tool gives you persistent SSH back to any Linux box, from anywhere. Self-hosted. Yours. No third-party SaaS.

Install in 5 seconds detecting…
curl -fsSL https://tnl.voxent.io/install.sh | bash
Get started ↓ Download binaries View source
Checking server cert…
you@laptop: ~
# Expose your local web app to the world
$ python3 -m http.server 3000 &
$ tunnel http 3000
→ https://aabb33.tnl.voxent.io/ forwards to http://127.0.0.1:3000
level=INFO msg="tunnel registered" id=web public=aabb33.tnl.voxent.io
# From your phone, your friend's laptop, anywhere:
$ curl https://aabb33.tnl.voxent.io/
<html> ... your local files ... </html> _

What you get

Three things, one binary.

No subscription. No third-party SaaS. The server is on your VPS, the data is yours, and you can revoke any client from the dashboard in one click.

Public HTTPS in one command

tunnel http 3000 gives you https://<halfmac>.tnl.voxent.io. Real Let's Encrypt wildcard cert, no warnings.

Persistent SSH from anywhere

Install a systemd service on your home Linux box. ssh -p 2222 you@tnl.voxent.io works forever. Survives reboots, crashes, network blips.

Self-hosted & auditable

Single Go binary. Per-client tokens you can revoke. Open source on GitHub. The traffic flows through your server.

How it works

No magic. Just yamux over TLS.

Your machine dials out (no inbound ports needed). The connection stays open. Public requests get multiplexed back through it.

visitor browser, curl, ssh tunneld tnl.voxent.io :443 public HTTPS :7443 control :2222 SSH tunnels your machine tunnel client (Go) localhost:3000 / :22 https yamux/tls always-on, outbound

Step 1

Install the client

One line. Auto-detects your OS, downloads the binary, asks for a token, you're done.

curl -fsSL https://tnl.voxent.io/install.sh | bash

Detects amd64/386/arm/arm64, installs to /usr/local/bin/tunnel, offers to set up persistent SSH. 

curl -fsSL https://tnl.voxent.io/install.sh | bash

Works on Intel and Apple Silicon. Installs to /usr/local/bin/tunnel. 

iwr -useb https://tnl.voxent.io/install.ps1 | iex

Drops tunnel.exe into %LOCALAPPDATA%\remotetunnel and adds it to your user PATH.

Prefer manual? Browse all binaries at /dl/

Step 2

Get a token

Two ways: the installer asks you for an invite code automatically, or sign up right here in your browser.

Get a token now

Paste your invite code below. You'll get a token and the exact command to run on your machine.

Need access? Reach out to whoever invited you.

Step 3

Use it. Any tunnel, one command.

Expose a local web app

tunnel http 3000

→ https://<halfmac>.tnl.voxent.io forwards to localhost:3000. Subdomain derived from your machine's MAC, stable across reboots.

Pick your own subdomain

tunnel http 3000 --hostname demo

→ https://demo.tnl.voxent.io. First-come-first-served on the server.

Tunnel any TCP service (Postgres, Redis, anything)

tunnel tcp 5432 --port 15432

→ External clients connect to tnl.voxent.io:15432, hit your local Postgres on :5432.

The big one

Persistent SSH
from anywhere on Earth.

Install a systemd service on your Linux box. Restart=always. The tunnel stays up across reboots, crashes, network blips. From your laptop in any coffee shop: ssh -p 2222 you@tnl.voxent.io.

On the target machine, once:

If you used install.sh earlier, it already asked. Otherwise:

sudo tunnel install ssh ssh --port 2222
sudo systemctl daemon-reload
sudo systemctl enable --now tunnel-ssh

In an elevated PowerShell (right-click → Run as Administrator):

tunnel install ssh ssh --port 2222
sc.exe start tunnel-ssh

Auto-starts on boot. Restarts on crash. Remove with tunnel uninstall ssh.

From any machine, anywhere:

ssh -p 2222 your-user@tnl.voxent.io

Skip the -p by adding to ~/.ssh/config:

Host home
  HostName tnl.voxent.io
  Port 2222
  User your-user

Now just: ssh home. Multiple Linux boxes? Give each its own public port (2222, 2223, 2224…) and add an entry per box.

Manage it

sudo systemctl status tunnel-ssh     # live status
sudo journalctl -u tunnel-ssh -f     # follow logs
sudo systemctl restart tunnel-ssh    # force reconnect
sudo systemctl disable --now tunnel-ssh && sudo rm /etc/systemd/system/tunnel-ssh.service

When things go wrong

Troubleshooting

tunnel: command not found

Open a fresh terminal — the installer just added it to PATH and your current shell hasn't reloaded. Or run with the full path: /usr/local/bin/tunnel on Unix, %LOCALAPPDATA%\remotetunnel\tunnel.exe on Windows.

Client log says tls: unknown authority

Your client's CA store is out of date. On Linux: sudo update-ca-certificates. As a dev escape hatch, add tls_insecure: true to ~/.config/tunnel/credentials.yaml.

Client log says client revoked

You revoked the token in the dashboard. Make a new one via + Add client and re-run tunnel login --token ….

SSH says Connection refused on port 2222

Three checks: (1) sudo systemctl status tunnel-ssh on the target box. (2) Tunnels page on the dashboard should list it. (3) sudo systemctl status ssh on the target box (is sshd even running locally?).

Two boxes can't both use port 2222

One TCP port = one tunnel. Use different public ports per box (2222, 2223, 2224…). The SSH-config snippet above scales to many entries.